Within Win 95/98, in the root of your (main) drive is a file called logo.sys, which is your startup screen. In your Windows directory are logos.sys and logow.sys, which are your Shutdown and 'Wait till Shutdown' screens. They might not be there, when included in some other file. Placing new files with these names will replace them anyway. You can just rename a bitmap to a .sys file.

If you don't want the logo's to appear, you may open "Msdos.sys" (hidden file at C:\) in Notepad. Add or edit the line "Logo=0" under [Options].

The bitmap has got to be 256 colors ore less, and sized 320 x 400. It will get stretched to fit the screen, so you might start with a 640 x 400 picture, make it look good, then resize it.
You'll notice it's not easy to create a screen that looks good. Got to keep it a bit simple to look good. Good to know is the first color in the palette is what defines the background/border color. The animation is achieved with a palette tweak; complicated, so using one of below utilities is recommended.

There's lot of companies on the web offering 'goodies', like these screens. Just take a look at your favorite games' company.

And there's lot of utilities that do the resizing and/or reducing colordepth and/or renaming. Here's a couple utilities to add some more:

• LogoSchemes (free) lets you organize your screens in themes, so you can easily switch sets. Imports .bmp, but doesn't do the resizing and color reduction.
• Coolbar Animator (freeware) adds a animated toolbar beneath your picture. The page for it has been down a while now; since the utility is unique and easy find it (hopefully temporarily) here (174 kB).
• SpinBmp (freeware) goes a little further and lets you animate any sized & shaped area on the screen, puts even text to animation.
• LogoMania (also free) is available from PC Magazine and adds some instant stunning effects.
• At XrX they've got another utility to add a bar on your picture (shareware), but mainly there's a large collection of animated screens for download.

You might find a message popping up before login, and the need to click an OK button. Maybe you want to disable it, maybe you want one there. It's controlled by two string values in the registry you can delete/add/modify, at A value called "LegalNoticeCaption" sets the title of the box, "LegalNoticeText" the message displayed.

In 2000 there's some more "branded" moments before you're logged in. Besides the startup/bootscreen, there's a couple of login boxes and additional details that can be customized.

When dual-booting using the NT bootloader there's some files in the root of the active partition that can be customized. Most important is boot.ini. May look like this: In notepad, the titles (between quotes) can be edited, default timeout and booted OS can be changed.

Other text on this screen and in the following screen, containing a simple progress bar, is contained in ntldr. This can be edited using a hex editor, but that means you're stuck with text length and such.

Then, the startup/bootscreen. Again, if you're dual booting 2k, you can prevent the boot screen from being displayed (source: xenlab submitted this web page) by adding a space and /noguiboot after the line in your boot.ini that loads the OS. Like: There's reported problems though, not really tracked down to this, but still... plus, it also disables the blue screen error messages. If a lockup occurs there's no explanation given, so be warned :).

The bitmap itself is contained within \winnt\system32\ntoskrnl.exe (bitmap #1 for pro version, #4 for server family). Replacement of the bitmap gave a lot of people errors, not being able to log in and such :).. it's a tedious proces, and the update of the file needs to be validated somehow ("checksum", "rebase" anyone ?). We've seen mentioned Restorator works for this one, and know for sure Resource Hacker, version 3.2.x will do the job. Remember, you'll need to get around Windows File Protection - see the modding page for details.

Your replacement screen must be 16 colors (that's 16 seperate colors only, not 16-bits, but 4-bits) - but you don't have to stick to the palette of the original logo. Easiest way is to make your BMP in full color mode, in your chosen paint app, then reduce to 16 colors after editing. This can cause discoloration though, especially in more complex images, so if you have the time and patience you could work from scratch in a custom 16 color palette. There's lots of problems reported with saving the image correctly due to procedures concerning palette/compression in some of the most known graphic programs. Also note that switching color modes isn't 100% reliable - some have had problems with random pixels changing colour, only fixed by manual editing. Some have also had problems with using MSPaint, so we recommend to do the color switching with IrfanView, or some other third-party tool. Then paste it into your kernel - if the colors aren't right, you'll just get a black screen. If you don't follow this procedure, or just want to play safe, bitmap you import in the file should be about 150 kB/153.720 bytes (that is, without RLE compression, another option).

Some designing clues (the real fun):

• Background/border color is defined by the first entry in the palette. Usually black looks best.
• Color of the progress bar is defined by the second entry in the palette, or, in some cases, it seems to be defined by the upperright pixel of the screen (reported with sp2 only, check in Resource Hacker if you see a seperate pixel there, then follow this lead).
• Animation is not done with a palette tweak here, the whole area just scrolls, which gives you some options :).

If you don't want to alter the main kernel (safe), or you want a choice of boot screens, there's another way:

• Edit ntoskrnl.exe, save under a different name in \winnt\system32, then edit original again, save, etc, till you have a collection of kernels, each with one of your pictures. Make sure you stick to the 8.3 filename standard - ntoskrn1.exe, for example.
• Now, check that Win2k is configured to show the boot menu on startup (already will be, if you run a Win9x as well). Control Panel-System-Advanced-Startup And Recovery, and make sure the "Display list" checkbox is ticked.
• Find boot.ini on your root drive (usually c:), and with a bit of editing you can choose which kernel (and boot logo) you want to load.
  
  For example, following original boot.ini above, your operating systems might look something like this:
  
  [operating systems]
  multi(0)disk(0)rdisk(0)partition(3)\winnt="2000 - Original" /fastdetect
  multi(0)disk(0)rdisk(0)partition(3)\winnt="2000 - LittleWhiteDog" /fastdetect /kernel=ntoskrn1.exe
  multi(0)disk(0)rdisk(0)partition(3)\winnt="2000 - VirtualPlastic" /fastdetect /kernel=ntoskrn2.exe
  c:\="Microsoft Windows 98"
  
  ..etc. You can change the labels, and have as many options as you like. And make sure the "multi" bit is the same as in your original boot.ini, else Win2k won't boot.

Better yet - TNATSNI has written a small app, Kernrot, that both saves you from editing the boot.ini yourself, and can select a random kernel (and picture) on boot. Full details over at the site. Read the instructions carefully - naming scheme for kernels is quite specific. Another app, LWDKernel, does basically the same thing, with a GUI thrown in.

Then, there's the Microsoft logo's appearing on the "starting" and login boxes while logging in (also seen when hitting ctrl-alt-del). These, including the animated bar, are contained in "Msgina.dll". Replacing stuff speaks for itself at this point. Notable though, the "Build on NT technology" message is not part of bitmaps, but in string table 507.

You can't replace this file within Windows, as it's used by winlogon.exe, which can never be terminated. Safe mode replacement doesn't work either - winlogon always runs. There are two ways round this:

1. If you're running off a FAT drive, boot another OS or use a DOS bootdisk, and change the file from there.
   
   
2. If you're using NTFS, change the dll in Reshack/Restorator, and save it under another name in the system32 directory. Now open regedit, and go to:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
   
   There should be a String named GinaDll, with value MSGina.dll. Change this value to your file name.
   Reboot, and your graphics should be in place.

Besides the boxes themselves, there's some more to customize here:

1. First, the background (color) displayed while logging in - also applies to 9x, when running multiple profiles. By default you just see the default background color (below), or maybe your box is branded some way and there's a bitmap/logo.
   This one can be set in the registry, at the key HKEY_USERS\.DEFAULT\Control Panel\Desktop. Modify or create a string value called "Wallpaper" and set the full path to your bitmap. When keeping it simple, create a bitmap same size as your desktop. Otherwise, there's some other string values you might create/modify:
   
   
   • "TileWallpaper" - "1" enables tiling, "0" disables;
   • "WallpaperStyle" - "0" for normal, "2" to stretch to screen;
   • "WallpaperOriginX" - number of pixels from left side, when style is normal, and image smaller than desk area;
   • "WallpaperOriginY" - number of pixels from top, when style is normal, and image smaller than desk area.
   
   
   
2. Then, the color scheme you see while logging in (background, boxes, including 3d effects) is defined at HKEY_USERS\.DEFAULT\Control Panel\Colors. If you would like them to have the same colors you've defined for your own login, export the key HKEY_CURRENT_USER\Control Panel\Colors, edit the path in notepad and import again.
   
   
3. Last, at HKEY_CURRENT_USER\Control Panel\Cursors you'll find your own cursor scheme. If you want the same scheme while logging in, do same as at step 2.

XP changes things again. While that's bad in general (more protected stuff), most bad for the bootscreen (very limited), it's good for some things (login proces, very configurable).

If you just want to get rid of it and see what's going on behind it, this time add a "/sos" switch to the applicable line in boot.ini.

Editing doesn't get easier. Process is fairly similar to the 2k process above. Bitmap is in ntoskrnl.exe, #1. Sixteen colors too, but this time the palette is not taken from the bitmap itself, but bitmap loads in a standard palette, hardcoded into ntoskrnl.exe. Read on for a workaround. This is the palette: Download this palette for Adobe, Corel, Jasc and some more here. You'll see when extracting the original images from the file, palette is 16 times black. Replacing with this palette will do. After editing, switching to the 16 times black palette will smoothen up display (no flashing colors before it gets displayed).

[If you want to see original images, we've only got it to work in PSP. Open original, click SHIFT + O, load this palette, while "maintaining indexes", you'll get the file as seen at startup.]

Palette can be changed, manually with a hex editor, but there's a free tool to do this and help you create a new executable. Info has been worked out by JJoelC. We'd recommend reading the article (even if just for the fun of exploring), cool find! Summarizing, palette is defined in this, long string (do a search for it in the hex editor): These are the hex values for the colors, separated with 00 each time. Also, each seperate hex value is swapped. Like the bright orange above (#10, RGB 247 107 032), hex value is F76B20. Three colors parts are seperated (F7 6B 20), and first and last are exchanged: 20 6B F7. There's more details, like there's some overlays displayed on top of the bitmap and the boot.ini /kernel= switch still working (so use that for testing). About those bitmaps/overlays that get projected over the bootscreen; here's the bitmap resources in ntoskrnl.exe and (a start with) their explanation: Some notes on editing those:

1. The progress bar starts at (x,y) 257,354, ends at 378,362. It works with those 3 blocks scrolling. If you don't make the scrollbar background black, you'll still see lots of black squares. Also, if you don't follow structure of the original scrollbar image (#4, 8 or 9), meaning 3 blocks seperated with black space, you might experience some distortion...
2. To avoid complicated editing, fitting the overlay for your version in (#10, 11 or 12), it works to replace those with a 1x1 pixel image, so it won't show anymore.
3. When nót using black as the background color, you might find a little back rectangle in upperleft corner. This is a leftover from an option to provide branded xp versions, only shown in xp beta's (?).

After you've coped with the limitations concerning the bootscreen, following screens - logon/logoff etc - are a relief. Yes, you'll need to modify some files again, but this can really look how you want to :). First of all, some related tweaks.

If you like you can switch to the 2k logon boxes, by holding CTRL + ALT keys, then pressing Delete twice. Switch back to the Windows XP interface by clicking the Cancel button. If you want to use classic interface by default, go to control panel, User Accounts, choose "Change the way users log on or off". Clear the checkbox at "Use the Welcome screen". Note this will also disable the "Use Fast User Switching" option. You might wanna know about these options (above in 2k section) to customize the look. For XP we can add to that list:

• At HKEY_USERS\.DEFAULT\Control Panel\Desktop you could enable cleartype fontdisplay for the login screen. Change the value "FontSmoothingType" to 2.
• And mimeryme found a way to apply your custom visual style at the login boxes too. It's at
  
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager:
  
  

  ColorName	REG_SZ	NormalColor
  DllName	REG_EXPAND_SZ	%SystemRoot%\Resources\themes\Luna\Luna.msstyles
  ThemeActive	REG_SZ	1

  
  Make the "Dllname" string point to your custom .msstyle path (if there's spaces in the path, add "quotes" around). If the theme has and uses specific names for colorversions, enter that at "ColorName". "ThemeActive" switches between XP classic (0) and visual style applied (1).

Now, the XP login interface - as found by and summarizing results of zman3. Great! Interface is html based, code and supporting bitmaps are found in logonui.exe.

• You don't need to overwrite the file. Just make a copy and edit, then, in the registry, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. There's a string value "UIHost", pointing to logonui.exe. Just make the path point to your edited file and you're done.

When opened in a resource editor you'll find a UIFILE section (lots of system files containing these now...). When selected, you'll see nothing, but there's a scrollbar ;), scroll down. There's lots of things you can edit, if you know how, but check these 3 items first: This are general sections for top, whole middle, and bottom panel. Directly underneath, where it says "background: rgb(xxx,xxx,xxx);" you can replace with your own color, or when it's "background: gradient(argb(0,xxx,xxx,xxx), argb(0,xxx,xxx,xxx), 0);" enter the rgb values for your gradient. Well, if you study a bit on the "id's", there's lots more, you can change anything concerning all subitems displayed in these 3 panels.

Which won't look good if you don't edit some bitmap resources too, like there "seperators" (gradients) between those panels, and in the middle pane too. All these bitmaps are, for once, truecolor! The bitmaps numbers and what they're for: There's a third part, the "String Table" section. #1 & 4 let you specify some differing fonts, within #1, 2 and 3 you can edit some common messages, like "Welcome".

Additionally:

• The background, logo and buttons for the dialog shown when hitting "Turn Off Computer" can be found in msgina.dll. Applying the regtweak above won't work, it will set whole login to 2k style, so you'll need to edit the real file.
• The background, logo and buttons for the dialog shown when hitting "Log Off" can be found in shell32.dll. Changes will only show up after a restart.
• Then, some programs are available to get some work done. Logon Loader helps you switch themes easily, and Stardock noticed they fell behind and created LogonStudio. This one is in beta and helps you compile your own theme (note, don't trust it to import manually crafted themes yet).

And then it went boom! Both visual styles and the logon files got a whole lot of attention around, it's safe to say a brand new customization scene evolved. Talk is centered at the messageboards at neowin.net and ieXbeta.com, there's a huge gallery of styles and logons at ThemeXP and info at tweakxp.com. Some of the skin archives online host logon files too.