are these false positives?

[DavidR]

Well, i'd be concerned about winlogon.exe mostly on that list. Because what todays viruses usually do is to infect winlogon.exe first. So if you want to clean it you can't boot the system but if you leave it, it will continue to infect anything you execute. I've experienced such scenario in the past with Virut.

So inspect what's going on there and especially take care about this EXE. Check it out if it's realyl infected on VirusTotal or something.

That is what I mentioned in Reply #3, and SAS hooks this as can be seen in the small second image in that post (using HiJackThis), so I suspect this might be what this is.

[robinb]

i tested the winlogin.exe file with virual labs and it comes up clean
but thanks anyway
robin

[DavidR]

It would because it isn't winlogon.exe that is being detected, but a process loaded into memory by winlogon.exe.