Sophos False Positive with WinLogon.EXE