Well, 1st screen - logonui.exe (i386\logonui.ex_) 2nd screen - ntoskrnl.exe (i386\ntoskrnl.ex_) or ntkrnlmp.exe (i386\ntkrnlmp.ex_) mm... 2nd screen - it's a Windows Kernel. It may be diffirent on diffirent computers. You must change all kernel files - ntoskrnl.ex_, ntkrnlmp.ex_, ntkrpamp.exe (placed in SP2/SP3.cab) and ntkrnlpa.exe (placed in SP2/SP3 cab too). How can i open these files logonui.ex_ ,ntoskrnl.ex_ ,ntkrnlmp.ex_ ,ntoskrnl.ex_, ntkrnlmp.ex_ ????? :( :unsure: