Returnil has always had this problem of protection not being turned on at startup, despite the Protection mode being set to on. Every now and then for some mysterious reason Protection mode would be set to off - I had to turn it back to on, and reboot for the option to take effect. This little quirk happened again today with extremely annoying results. In the middle of a malware testing run it suddenly reverted to "off" after a reboot, and being in a hurry I executed a rootkit trojan before I realized the icon was green. This is the last straw. I'm giving Returnil the boot for now in favor of Windows Steadystate to see how it runs. Hopefully the 2008 version will be better than this when it's released.