Article 37706 of alt.security:
An excellent way of starting a program before the user logs in is to
do the following:

   1.  Run the Register Editor by clicking on the Start button, 
       selecting Run, and typing REGEDIT followed by Enter.
   2.  Expand HKEY_LOCAL_MACHINE.
   3.  Expand SOFTWARE.
   4.  Expand Microsoft.
   5.  Expand  Windows.
   6.  Expand  CurrentVersion.
   8.  Expand or create RunServices.
   9.  From the Edit menu, select Edit/New/String Value.
   10. Type whatever you want to show and press enter.
   11. Press Enter again to edit the data string.
   12. Type the path and name of the program. 
       For Example:
          C:\keboardrecorder\recorder.exe
   13. Select 'OK' to store the string.
   14. Close the Register Editor.
   15. Reboot the computer.


On 14 Jun 1996 08:38:56 GMT, mroos@romulus.ut.ee (Meelis Roos) wrote:

>> There are windows programs you can stick in the startup group which will 
>> log all keypresses. But they are not as fully hidden as the dos int 9h 
>> redirection methods, since there is an icon in the startup group and down 
>> the bottom of the screen. You can make the icon invisible but it will 
>> still show up in a task list.
>> The best way to prevent these being installed would be to watch for 
>> modifications to the startup group file.
>
>Nope! You may write a DLL/DRV that does it and only change system.ini in a
>way that not everyone understands.
>And it's not difficult at all to write such DLL, I did it as my first step
>in Windoze programming.
>
>--
>Meelis Roos             CS student at Tartu University, Estonia
>                        e-mail: mroos@ut.ee
>                        www:    http://www.cs.ut.ee/~mroos