I just can't get rid of winlogin.exe. It shows up in the hijack this log as:

04 - Global Startup: winlogin.exe

One other questionable log file:

020 - Winlogon Notify: igfxcui - C:\Windows\System32\igfxsrvc.dll

I have gotten mixed reviews on this one. Doing a Google search it comes up as an Intel graphics dll file.

I have tried deleting the winlogin.exe from hijack this in safe mode but it says I can not delete it because it is a running process. Stop the process in Task Manager and then try to delete it. Nothing shows up in Task Manager.

It shows up in two places when I do a search.

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winlogin.exe

and

C:\Windows\pss\winlogin.exeCommon Startup

Doing a search in the registry it shows up in:

HKLM\Software\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^winlogin.exe

I also had a bout with WorldAntiSpy and right underneath the winlogin.exe in the registry is:

HKLM\Software\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WorldAntiSpy.Ink

I have run multiple virus scans as well as Adaware, Spybot and Ccleaner all in safe mode.

Can I delete both strings (winlogin and WorldAntiSpy) from the registry and then delete the winlogin.exe files from Windows?