: Analysis tools frequently flag RemoveWAT executables for "suspicious activity," such as unauthorized file removal or modifying access control lists. Better Alternatives for Windows Activation
Open Command Prompt as Admin and type: sfc /scannow This will attempt to restore the patched winlogon.exe .
This usually means the patch failed but the WAT service was removed. You are in a limbo state. Run the tool again as Administrator, or use the "Restore" function if you backed up your license files.