Just installed PG 3.050 on my WinXP SP-2 system. Started clean. I happen to have a little command-line utility named sleep.exe, which I use in command scripts (i.e. CMD files) to pause during their execution. I have a few scripts that load on startup, and those scripts call sleep.exe. So far so good. I had PG's learning mode enabled. Long after startup, and when no command scripts (nor sleep.exe) were running, I ran Sysinternals Regmon 6.12. This was new to PG, so I expected PG to block the dynamic driver loading, and then I'd dismiss Regmon's error message, then rerun it, and all would be well. Instead, I got an error from Regmon, and also alert from PG that sleep.exe was trying to install a driver. So learning mode added an entry in PG to give sleep.exe permission to install drivers. I'm as confused as you are. I wasn't running Regmon from a batch file, and again, sleep.exe wasn't even running at the time. (I double checked in Process Explorer.) But again, I had run sleep.exe by way of the scripts that run at startup, within the same Windows session. I deleted the sleep.exe line in PG, and ran Regmon again. This time all went exactly as I expected: Regmon threw an error, PG threw an alert, learning mode added what it needed to, and a second run of Regmon worked fine. The file sleep.exe didn't come up at all. Out of curiousity, I deleted Regmon in PG, and tried again. It did the same thing it did the first time, adding an entry for sleep.exe. I just thought this was strange.