start
CloseProcesses: 
CreateRestorePoint:
HKLM\...\Winlogon: [Userinit] wscript C:\WINDOWS\run.vbs,
end