Hello, I was wondering, my friend recently removed a second winlogon.exe process, (no he doesn't have more than one windows account), and it crashed, then he restarted his computer and it started up normally. Is it possible his computer his performing on a corrupt keylogged version of winlogon alone? Its located in system32.