I wonder... used to be not so... There was a folder called Startup and a folder called Shutdown in earlier versions of Windows. I don't remember if that survived into Win2k or not. Still I wonder what is called to run when windows shuts down... It is a SPYware/MALware question.