Strange behavior re: schedlgu.txt

[502512]

Have been having a strange problem around schedlgu.txt for some time now. Finally had time to do some research on it. Turns out that even though I enabled a single file exclusion on schedlgu.txt, Spybot still does some things with it, like:

• Spybot copies this file to the spybot backup directory every night during the scheduled scan. As of today, I found 63 instances of this file in the backup directory.
• Spybot tries to delete this file even though I have it excluded. I know this because I see 4 tries that are reported to me by TeaTimer as additions to my registry. Two use "command" and two use "cmd".
• Whenever I reboot my system, I see multiple command windows pop up, but they go by so fast I can't tell exactly what's in them. The more days between reboots the more of these occur.
• After bootup and after Spybot SD resident loads, I get a ton of messages that are the opposite of the ones I get after the scan each day; i.e. they are reported by TeaTimer as deletions from my registry again in the same 2x2 pattern as I reported in the second bullet above. The number of these is directly related to how many Spybot scans have run since the last boot.

My puzzlement is why all this activity around a file I have excluded? Just want to know if this is a bug or a result of a setting I changed. This began happening after I upgraded to 1.5.2.

Details: I run Win2KPro SP4, all latest MS updates installed. Spybot version is 1.5.2.20. I run Spybot each early AM automatically as well as very occasionally by manual means. Spybot is set to automatically update before each scan.

Just wanted you to know I searched the FAQs and the forums before posting, but couldn't find any relief. Thanks for any help you can provide.

Cheers,
Jeff

 

[Greyfox]

502512

This is an interesting question.

Spybot generates a number of files each time you ask it to fix items found in a scan. In my case the things "found" during a scan are simply usage tracks, but each time the fix is applied it generates files like Wbemess.log, wmiprov.log, wbemprox.log etc and places them in the c:\documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Backups folder. Over time there are multiples of each file generated, with a number added into the file name to keep them separate.

The file you mentioned schedLgU.txt appears to be a log of when spybot's scheduler starts and stops. It like the others is put in the ..\Backup folder and again the repeats have a number in the file name to keep them separated. Interestingly it generates multiples of this file on my PC too, even though I do not use (and have never used) the Spybot scheduler. (My system incidentally is XP-Home, SP2)

The separation by use of a digit or digits in the individual file name is neither overwriting the previous file if it exists, nor appending to it, so the "Overwrite log file if existant (else append to it)" setting that is in Settings>Log file settings would not seem to apply to these particular files.

I don't know the exact purpose of these files, nor why they are allowed to grow on what seems a never ending basis, (as does the backup copies of the hosts file), because it does become another manual housekeeping item that eventually has to be attended to.

Anyhow, the purpose of this somewhat long winded post is to say that in so far as the generation of these files is concerned, you are not unique, and also to add that I don't believe asking Spybot to exclude schedLgU.txt is valid - it is not something it would find in a scan that it could ignor if asked to exclude it, it is a log file it generates itself.

Perhaps someone on the Spybot team could shed some more light on the subject.

 

[Zenobia]

In my case the things "found" during a scan are simply usage tracks, but each time the fix is applied it generates files like Wbemess.log, wmiprov.log, wbemprox.log etc and places them in the c:\documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Backups folder.

I went hunting for the explanation on why Spybot put logfiles there,as I recall,quite a while back. This is posted on the Spybot page:
http://www.safer-networking.org/en/threats/302.html

Description Logs won't be deleted, just moved to a folder inside the Spybot-S&D directory to make it more difficult for spies to automatically detect them.

schedLgU.txt is the logfile for your computer's task scheduler.There's more on that here:
http://www.safer-networking.org/en/faq/6.html

The same is valid for the SchedLgU.txt; it is the log file of the scheduler.

Turns out that even though I enabled a single file exclusion on schedlgu.txt,

Some of the single detections I used to put into Ignore single entries used to disappear out of Ignore single entries from time to time,though I thought it stopped doing that once I got Spybot 1.5.2.
...Still,you could check to see if SchedLgU.txt is still listed in Ignore single entries(open Spybot,click Mode->Advanced Mode->Settings->Ignore single entries.)

 

[502512]

reply on schedlgu.txt behavior

First, thanks for the responses.

I'd already viewed the links Zenobia mentioned in her response prior to my request for help. They haven't helped me to solve the problem. I understand what schedlgu.txt is, I just want Spybot to stop trying to do stuff with it. V1.4 seemed to have done that, but when I upgraded to 1.5.2 it started up.

BTW Zenobia, the ignore single entries on schedlgu.txt is still showing up. Spybot SD just doesn't seem to be following it?!?!?!?

It's not a big problem, just annoying. I've removed the exclusion and am going to let Spybot run on schedule and try excluding it again. I'll let you know if this works. Any other suggestions are welcome.

Thanks,
Jeff

P.S. If I could get this kind of response for hardware and software I've paid big bucks for, I'd be a Very Happy Camper. This is one of the best online communities ever! Zenobia:flowers:, you've helped me out before and I greatly appreciate it. Kudos to Safer Networking.

 

[Zenobia]

You're welcome.
Does Spybot also find schedlgu.txt when you run a manual scan?
You could post your resident.log if you like,and see what can be seen from that.Rightclick Teatimer,then click Show log,then Copy and Paste it here.

 

[502512]

more schedlgu.txt stuff

Zenobia--

I just ran a manual scan. Prior to this, I had already removed schedlgu.txt from the ignore single entries list. It found schedlgu.txt. I'm attaching the various spybot log files and pasting the resident.log file here. It's so big that I'm only including the part where spybot first started finding schedlgu.txt.

I think I'll run another manual scan after adding schedlgu.txt back to the ignore single entries list.

Do the dialog boxes I'm getting from TeaTimer after each Spybot run that talk about adding commands to delete schedlgu.txt on system startup come from a setting I've made?

In any case, here's the resident.log:
2/8/2008 7:36:11 AM Denied (based on user decision) value "SpybotDeletingB8024" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/8/2008 7:36:23 AM Allowed (based on user decision) value "SpybotDeletingD3915" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/8/2008 7:36:34 AM Allowed (based on user decision) value "SpybotDeletingA5431" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/8/2008 7:36:45 AM Allowed (based on user decision) value "SpybotDeletingC1194" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/8/2008 9:05:13 PM Allowed (based on user decision) value "SpybotDeletingD3915" (new data: "") deleted in System Startup user entry!
2/8/2008 9:05:18 PM Allowed (based on user decision) value "SpybotDeletingA5431" (new data: "") deleted in System Startup global entry!
2/8/2008 9:05:21 PM Allowed (based on user decision) value "SpybotDeletingC1194" (new data: "") deleted in System Startup global entry!
2/9/2008 8:02:56 AM Allowed (based on user decision) value "SpybotDeletingB3753" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/9/2008 8:02:58 AM Allowed (based on user decision) value "SpybotDeletingD4377" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/9/2008 8:02:59 AM Allowed (based on user decision) value "SpybotDeletingA4167" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/9/2008 8:03:01 AM Allowed (based on user decision) value "SpybotDeletingC8741" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/9/2008 8:03:22 AM Allowed (based on authenticode whitelist) value "SpybotSnD" (new data: ""C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck") added in System Startup global entry!
2/9/2008 8:53:31 AM Allowed (based on user decision) value "SpybotDeletingB3753" (new data: "") deleted in System Startup user entry!
2/9/2008 8:53:32 AM Allowed (based on user decision) value "SpybotDeletingD4377" (new data: "") deleted in System Startup user entry!
2/9/2008 8:53:35 AM Allowed (based on user decision) value "SpybotDeletingA4167" (new data: "") deleted in System Startup global entry!
2/9/2008 8:53:36 AM Allowed (based on user decision) value "SpybotDeletingC8741" (new data: "") deleted in System Startup global entry!
2/9/2008 8:53:38 AM Allowed (based on user decision) value "SpybotSnD" (new data: "") deleted in System Startup global entry!
2/10/2008 9:07:44 AM Allowed (based on user decision) value "SpybotDeletingB9665" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/10/2008 9:07:48 AM Allowed (based on user decision) value "SpybotDeletingD6091" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/10/2008 9:07:50 AM Allowed (based on user decision) value "SpybotDeletingA1504" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/10/2008 9:07:51 AM Allowed (based on user decision) value "SpybotDeletingC6102" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/11/2008 10:47:35 AM Allowed (based on user decision) value "SpybotDeletingB6701" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/11/2008 10:47:38 AM Allowed (based on user decision) value "SpybotDeletingD6942" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/11/2008 10:47:39 AM Allowed (based on user decision) value "SpybotDeletingA6038" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/11/2008 10:47:40 AM Allowed (based on user decision) value "SpybotDeletingC5226" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/11/2008 10:47:40 AM Allowed (based on authenticode whitelist) value "SpybotSnD" (new data: ""C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck") added in System Startup global entry!
2/12/2008 8:52:40 AM Allowed (based on user decision) value "SpybotDeletingB3509" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/12/2008 8:52:42 AM Allowed (based on user decision) value "SpybotDeletingD6351" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/12/2008 8:52:44 AM Allowed (based on user decision) value "SpybotDeletingA5147" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/12/2008 8:52:48 AM Allowed (based on user decision) value "SpybotDeletingC8479" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/14/2008 1:56:03 AM Allowed (based on user decision) value "SpybotDeletingB3360" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/14/2008 1:56:06 AM Allowed (based on user decision) value "SpybotDeletingD9121" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/14/2008 1:56:07 AM Allowed (based on user decision) value "SpybotDeletingA2588" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/14/2008 1:56:09 AM Allowed (based on user decision) value "SpybotDeletingC3910" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/14/2008 3:49:24 PM Allowed (based on user decision) value "SpybotDeletingB9665" (new data: "") deleted in System Startup user entry!
2/14/2008 3:49:25 PM Allowed (based on user decision) value "SpybotDeletingD6091" (new data: "") deleted in System Startup user entry!
2/14/2008 3:49:26 PM Allowed (based on user decision) value "SpybotDeletingB6701" (new data: "") deleted in System Startup user entry!
2/14/2008 3:49:27 PM Allowed (based on user decision) value "SpybotDeletingD6942" (new data: "") deleted in System Startup user entry!
2/14/2008 3:49:28 PM Allowed (based on user decision) value "SpybotDeletingB3509" (new data: "") deleted in System Startup user entry!
2/14/2008 3:49:29 PM Allowed (based on user decision) value "SpybotDeletingD6351" (new data: "") deleted in System Startup user entry!
2/14/2008 3:49:30 PM Allowed (based on user decision) value "SpybotDeletingB3360" (new data: "") deleted in System Startup user entry!
2/14/2008 3:49:31 PM Allowed (based on user decision) value "SpybotDeletingD9121" (new data: "") deleted in System Startup user entry!
2/14/2008 3:49:32 PM Allowed (based on user decision) value "SpybotDeletingA1504" (new data: "") deleted in System Startup global entry!
2/14/2008 3:49:33 PM Allowed (based on user decision) value "SpybotDeletingC6102" (new data: "") deleted in System Startup global entry!
2/14/2008 3:49:34 PM Allowed (based on user decision) value "SpybotDeletingA6038" (new data: "") deleted in System Startup global entry!
2/14/2008 3:49:35 PM Allowed (based on user decision) value "SpybotDeletingC5226" (new data: "") deleted in System Startup global entry!
2/14/2008 3:49:36 PM Allowed (based on user decision) value "SpybotSnD" (new data: "") deleted in System Startup global entry!
2/14/2008 3:49:37 PM Allowed (based on user decision) value "SpybotDeletingA5147" (new data: "") deleted in System Startup global entry!
2/14/2008 3:49:38 PM Allowed (based on user decision) value "SpybotDeletingC8479" (new data: "") deleted in System Startup global entry!
2/14/2008 3:49:40 PM Allowed (based on user decision) value "SpybotDeletingA2588" (new data: "") deleted in System Startup global entry!
2/14/2008 3:49:41 PM Allowed (based on user decision) value "SpybotDeletingC3910" (new data: "") deleted in System Startup global entry!
2/15/2008 12:00:35 PM Allowed (based on user decision) value "SpybotDeletingB183" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/15/2008 12:00:36 PM Allowed (based on user decision) value "SpybotDeletingD914" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/15/2008 12:00:37 PM Allowed (based on user decision) value "SpybotDeletingA9836" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/15/2008 12:00:38 PM Allowed (based on user decision) value "SpybotDeletingC7748" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/16/2008 10:32:26 AM Allowed (based on user decision) value "SpybotDeletingB9256" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/16/2008 10:32:32 AM Allowed (based on user decision) value "SpybotDeletingD9488" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/16/2008 10:32:35 AM Allowed (based on user decision) value "SpybotDeletingA9153" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/16/2008 10:32:39 AM Allowed (based on user decision) value "SpybotDeletingC8042" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/16/2008 8:14:54 PM Allowed (based on user decision) value "SWHelper" (new data: ""C:\WINNT\system32\Macromed\Shockwave 10\PostUpdate.exe" 1010011") added in System Startup user entry!
2/17/2008 9:30:20 AM Allowed (based on user decision) value "SpybotDeletingB6397" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/17/2008 9:30:23 AM Allowed (based on user decision) value "SpybotDeletingD2484" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/17/2008 9:30:24 AM Allowed (based on user decision) value "SpybotDeletingA2838" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/17/2008 9:30:27 AM Allowed (based on user decision) value "SpybotDeletingC8401" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/18/2008 1:37:09 AM Allowed (based on user decision) value "SpybotDeletingB9765" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/18/2008 1:37:11 AM Allowed (based on user decision) value "SpybotDeletingD2464" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/18/2008 1:37:12 AM Allowed (based on user decision) value "SpybotDeletingA7516" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/18/2008 1:37:13 AM Allowed (based on user decision) value "SpybotDeletingC9263" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/19/2008 9:24:04 AM Allowed (based on user decision) value "SpybotDeletingB745" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/19/2008 9:24:07 AM Allowed (based on user decision) value "SpybotDeletingD7586" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/19/2008 9:24:08 AM Allowed (based on user decision) value "SpybotDeletingA4512" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/19/2008 9:24:10 AM Allowed (based on user decision) value "SpybotDeletingC3374" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/20/2008 10:33:29 AM Allowed (based on user decision) value "SpybotDeletingB1463" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/20/2008 10:33:31 AM Allowed (based on user decision) value "SpybotDeletingD8421" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/20/2008 10:33:32 AM Allowed (based on user decision) value "SpybotDeletingA4702" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/20/2008 10:33:33 AM Allowed (based on user decision) value "SpybotDeletingC7931" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/20/2008 11:32:29 AM Allowed (based on user decision) value "SpybotDeletingB183" (new data: "") deleted in System Startup user entry!
2/20/2008 11:32:31 AM Allowed (based on user decision) value "SpybotDeletingD914" (new data: "") deleted in System Startup user entry!
2/20/2008 11:32:34 AM Allowed (based on user decision) value "SpybotDeletingB9256" (new data: "") deleted in System Startup user entry!
2/20/2008 11:32:35 AM Allowed (based on user decision) value "SpybotDeletingD9488" (new data: "") deleted in System Startup user entry!
2/20/2008 11:32:35 AM Allowed (based on user decision) value "SWHelper" (new data: "") deleted in System Startup user entry!
2/20/2008 11:32:38 AM Allowed (based on user decision) value "SpybotDeletingB6397" (new data: "") deleted in System Startup user entry!
2/20/2008 11:32:41 AM Allowed (based on user decision) value "SpybotDeletingD2484" (new data: "") deleted in System Startup user entry!
2/20/2008 11:32:42 AM Allowed (based on user decision) value "SpybotDeletingB9765" (new data: "") deleted in System Startup user entry!
2/20/2008 11:32:44 AM Allowed (based on user decision) value "SpybotDeletingD2464" (new data: "") deleted in System Startup user entry!
2/20/2008 11:32:48 AM Allowed (based on user decision) value "SpybotDeletingB745" (new data: "") deleted in System Startup user entry!
2/20/2008 11:32:50 AM Allowed (based on user decision) value "SpybotDeletingD7586" (new data: "") deleted in System Startup user entry!
2/20/2008 11:32:51 AM Allowed (based on user decision) value "SpybotDeletingB1463" (new data: "") deleted in System Startup user entry!
2/20/2008 11:32:54 AM Allowed (based on user decision) value "SpybotDeletingD8421" (new data: "") deleted in System Startup user entry!
2/20/2008 11:32:55 AM Allowed (based on user decision) value "SpybotDeletingA9836" (new data: "") deleted in System Startup global entry!
2/20/2008 11:32:56 AM Allowed (based on user decision) value "SpybotDeletingC7748" (new data: "") deleted in System Startup global entry!
2/20/2008 11:32:57 AM Allowed (based on user decision) value "SpybotDeletingA9153" (new data: "") deleted in System Startup global entry!
2/20/2008 11:32:58 AM Allowed (based on user decision) value "SpybotDeletingC8042" (new data: "") deleted in System Startup global entry!
2/20/2008 11:33:00 AM Allowed (based on user decision) value "SpybotDeletingA2838" (new data: "") deleted in System Startup global entry!
2/20/2008 11:33:01 AM Allowed (based on user decision) value "SpybotDeletingC8401" (new data: "") deleted in System Startup global entry!
2/20/2008 11:33:01 AM Allowed (based on user decision) value "SpybotDeletingA7516" (new data: "") deleted in System Startup global entry!
2/20/2008 11:33:02 AM Allowed (based on user decision) value "SpybotDeletingC9263" (new data: "") deleted in System Startup global entry!
2/20/2008 11:33:02 AM Allowed (based on user decision) value "SpybotDeletingA4512" (new data: "") deleted in System Startup global entry!
2/20/2008 11:33:03 AM Allowed (based on user decision) value "SpybotDeletingC3374" (new data: "") deleted in System Startup global entry!
2/20/2008 11:33:03 AM Allowed (based on user decision) value "SpybotDeletingA4702" (new data: "") deleted in System Startup global entry!
2/20/2008 11:33:04 AM Allowed (based on user decision) value "SpybotDeletingC7931" (new data: "") deleted in System Startup global entry!
2/21/2008 9:09:20 AM Allowed (based on user decision) value "SpybotDeletingB3271" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/21/2008 9:09:22 AM Allowed (based on user decision) value "SpybotDeletingD7133" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/21/2008 9:09:24 AM Allowed (based on user decision) value "SpybotDeletingA942" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/21/2008 9:09:25 AM Allowed (based on user decision) value "SpybotDeletingC1550" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/22/2008 10:03:14 AM Allowed (based on user decision) value "SpybotDeletingB9331" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/22/2008 10:03:19 AM Allowed (based on user decision) value "SpybotDeletingD7300" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
2/22/2008 10:03:22 AM Allowed (based on user decision) value "SpybotDeletingA3905" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/22/2008 10:03:24 AM Allowed (based on user decision) value "SpybotDeletingC9840" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
2/24/2008 2:03:39 PM Allowed (based on user decision) value "SpybotDeletingB3271" (new data: "") deleted in System Startup user entry!
2/24/2008 2:03:39 PM Allowed (based on user decision) value "SpybotDeletingD7133" (new data: "") deleted in System Startup user entry!
2/24/2008 2:03:40 PM Allowed (based on user decision) value "SpybotDeletingB9331" (new data: "") deleted in System Startup user entry!
2/24/2008 2:03:41 PM Allowed (based on user decision) value "SpybotDeletingD7300" (new data: "") deleted in System Startup user entry!
2/24/2008 2:03:41 PM Allowed (based on user decision) value "SpybotDeletingA942" (new data: "") deleted in System Startup global entry!
2/24/2008 2:03:43 PM Allowed (based on user decision) value "SpybotDeletingC1550" (new data: "") deleted in System Startup global entry!
2/24/2008 2:03:44 PM Allowed (based on user decision) value "SpybotDeletingA3905" (new data: "") deleted in System Startup global entry!
2/24/2008 2:03:44 PM Allowed (based on user decision) value "SpybotDeletingC9840" (new data: "") deleted in System Startup global entry!
3/21/2008 2:38:12 AM Allowed (based on user decision) value "SpybotDeletingB3320" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/21/2008 2:38:17 AM Allowed (based on user decision) value "SpybotDeletingD1773" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/21/2008 2:38:21 AM Allowed (based on user decision) value "SpybotDeletingA7213" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
3/21/2008 2:38:23 AM Allowed (based on user decision) value "SpybotDeletingC5518" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
3/22/2008 2:13:42 AM Allowed (based on user decision) value "SpybotDeletingB7233" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/22/2008 2:13:44 AM Allowed (based on user decision) value "SpybotDeletingD1630" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/22/2008 2:13:45 AM Allowed (based on user decision) value "SpybotDeletingA5460" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
3/22/2008 2:13:47 AM Allowed (based on user decision) value "SpybotDeletingC9181" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
3/23/2008 2:24:47 AM Allowed (based on user decision) value "SpybotDeletingB1512" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/23/2008 2:24:48 AM Allowed (based on user decision) value "SpybotDeletingD6546" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/23/2008 2:24:49 AM Allowed (based on user decision) value "SpybotDeletingA8196" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
3/23/2008 2:24:50 AM Allowed (based on user decision) value "SpybotDeletingC6101" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
3/24/2008 1:57:58 AM Allowed (based on user decision) value "SpybotDeletingB7866" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/24/2008 1:57:59 AM Allowed (based on user decision) value "SpybotDeletingD7149" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/24/2008 1:58:00 AM Allowed (based on user decision) value "SpybotDeletingA5675" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
3/24/2008 1:58:01 AM Allowed (based on user decision) value "SpybotDeletingC5584" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
3/25/2008 12:29:01 PM Allowed (based on user decision) value "SpybotDeletingB7774" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/25/2008 12:29:04 PM Allowed (based on user decision) value "SpybotDeletingD1689" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/25/2008 12:29:04 PM Allowed (based on user decision) value "SpybotDeletingA6247" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
3/25/2008 12:29:05 PM Allowed (based on user decision) value "SpybotDeletingC1825" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
3/25/2008 12:29:06 PM Allowed (based on authenticode whitelist) value "SpybotSnD" (new data: ""C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck") added in System Startup global entry!
3/26/2008 1:45:06 AM Allowed (based on user decision) value "SpybotDeletingB3381" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/26/2008 1:45:08 AM Allowed (based on user decision) value "SpybotDeletingD3735" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/26/2008 1:45:09 AM Allowed (based on user decision) value "SpybotDeletingA4442" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
3/26/2008 1:45:11 AM Allowed (based on user decision) value "SpybotDeletingC9214" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
3/26/2008 1:50:01 AM Allowed (based on user decision) value "SpybotDeletingA7213" (new data: "") deleted in System Startup global entry!
3/26/2008 1:50:17 AM Allowed (based on user decision) value "SpybotDeletingC5518" (new data: "") deleted in System Startup global entry!
3/26/2008 1:50:18 AM Allowed (based on user decision) value "SpybotDeletingA5460" (new data: "") deleted in System Startup global entry!
3/26/2008 1:50:19 AM Allowed (based on user decision) value "SpybotDeletingC9181" (new data: "") deleted in System Startup global entry!
3/26/2008 1:50:20 AM Allowed (based on user decision) value "SpybotDeletingA8196" (new data: "") deleted in System Startup global entry!
3/26/2008 1:50:21 AM Allowed (based on user decision) value "SpybotDeletingC6101" (new data: "") deleted in System Startup global entry!
3/26/2008 1:50:22 AM Allowed (based on user decision) value "SpybotDeletingA5675" (new data: "") deleted in System Startup global entry!
3/26/2008 1:50:22 AM Allowed (based on user decision) value "SpybotDeletingC5584" (new data: "") deleted in System Startup global entry!
3/26/2008 1:50:23 AM Allowed (based on user decision) value "SpybotDeletingA6247" (new data: "") deleted in System Startup global entry!
3/26/2008 1:50:24 AM Allowed (based on user decision) value "SpybotDeletingC1825" (new data: "") deleted in System Startup global entry!
3/26/2008 1:50:25 AM Allowed (based on user decision) value "SpybotSnD" (new data: "") deleted in System Startup global entry!
3/26/2008 1:50:35 AM Allowed (based on user decision) value "SpybotDeletingA4442" (new data: "") deleted in System Startup global entry!
3/26/2008 1:50:35 AM Allowed (based on user decision) value "SpybotDeletingC9214" (new data: "") deleted in System Startup global entry!
3/27/2008 9:13:55 AM Allowed (based on user decision) value "SpybotDeletingB8658" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/27/2008 9:13:56 AM Allowed (based on user decision) value "SpybotDeletingD2497" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
3/27/2008 9:14:00 AM Allowed (based on user decision) value "SpybotDeletingA6576" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
3/27/2008 9:14:04 AM Allowed (based on user decision) value "SpybotDeletingC4223" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/15/2008 7:39:28 PM Allowed (based on user decision) value "SpybotDeletingB3320" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:30 PM Allowed (based on user decision) value "SpybotDeletingD1773" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:33 PM Allowed (based on user decision) value "SpybotDeletingB7233" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:34 PM Allowed (based on user decision) value "SpybotDeletingD1630" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:35 PM Allowed (based on user decision) value "SpybotDeletingB1512" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:36 PM Allowed (based on user decision) value "SpybotDeletingD6546" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:37 PM Allowed (based on user decision) value "SpybotDeletingB7866" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:38 PM Allowed (based on user decision) value "SpybotDeletingD7149" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:39 PM Allowed (based on user decision) value "SpybotDeletingB7774" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:40 PM Allowed (based on user decision) value "SpybotDeletingD1689" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:42 PM Allowed (based on user decision) value "SpybotDeletingB3381" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:43 PM Allowed (based on user decision) value "SpybotDeletingD3735" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:43 PM Allowed (based on user decision) value "SpybotDeletingB8658" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:44 PM Allowed (based on user decision) value "SpybotDeletingD2497" (new data: "") deleted in System Startup user entry!
4/15/2008 7:39:45 PM Allowed (based on user decision) value "SpybotDeletingA6576" (new data: "") deleted in System Startup global entry!
4/15/2008 7:39:46 PM Allowed (based on user decision) value "SpybotDeletingC4223" (new data: "") deleted in System Startup global entry!
4/16/2008 8:34:38 AM Allowed (based on user decision) value "SpybotDeletingB8027" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/16/2008 8:34:44 AM Allowed (based on user decision) value "SpybotDeletingD5814" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/16/2008 8:34:50 AM Allowed (based on user decision) value "SpybotDeletingA7491" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/16/2008 8:34:55 AM Allowed (based on user decision) value "SpybotDeletingC834" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/18/2008 1:36:09 PM Allowed (based on user decision) value "SpybotDeletingB3004" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/18/2008 1:36:10 PM Allowed (based on user decision) value "SpybotDeletingD9251" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/18/2008 1:36:11 PM Allowed (based on user decision) value "SpybotDeletingA2786" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/18/2008 1:36:12 PM Allowed (based on user decision) value "SpybotDeletingC7490" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/19/2008 4:11:38 AM Allowed (based on user decision) value "SpybotDeletingB7986" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/19/2008 4:11:39 AM Allowed (based on user decision) value "SpybotDeletingD2000" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/19/2008 4:11:40 AM Allowed (based on user decision) value "SpybotDeletingA2989" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/19/2008 4:11:42 AM Allowed (based on user decision) value "SpybotDeletingC9057" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/22/2008 8:13:17 PM Allowed (based on user decision) value "SpybotDeletingB8027" (new data: "") deleted in System Startup user entry!
4/22/2008 8:13:17 PM Allowed (based on user decision) value "SpybotDeletingD5814" (new data: "") deleted in System Startup user entry!
4/22/2008 8:13:18 PM Allowed (based on user decision) value "SpybotDeletingB3004" (new data: "") deleted in System Startup user entry!
4/22/2008 8:13:19 PM Allowed (based on user decision) value "SpybotDeletingD9251" (new data: "") deleted in System Startup user entry!
4/22/2008 8:13:20 PM Allowed (based on user decision) value "SpybotDeletingB7986" (new data: "") deleted in System Startup user entry!
4/22/2008 8:13:23 PM Allowed (based on user decision) value "SpybotDeletingD2000" (new data: "") deleted in System Startup user entry!
4/22/2008 8:13:24 PM Allowed (based on user decision) value "SpybotDeletingA7491" (new data: "") deleted in System Startup global entry!
4/22/2008 8:13:25 PM Allowed (based on user decision) value "SpybotDeletingC834" (new data: "") deleted in System Startup global entry!
4/22/2008 8:13:26 PM Allowed (based on user decision) value "SpybotDeletingA2786" (new data: "") deleted in System Startup global entry!
4/22/2008 8:13:27 PM Allowed (based on user decision) value "SpybotDeletingC7490" (new data: "") deleted in System Startup global entry!
4/22/2008 8:13:28 PM Allowed (based on user decision) value "SpybotDeletingA2989" (new data: "") deleted in System Startup global entry!
4/22/2008 8:13:29 PM Allowed (based on user decision) value "SpybotDeletingC9057" (new data: "") deleted in System Startup global entry!
4/23/2008 12:42:03 PM Allowed (based on user decision) value "SpybotDeletingB9465" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/23/2008 12:42:14 PM Allowed (based on user decision) value "SpybotDeletingD7050" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/23/2008 12:42:14 PM Allowed (based on user decision) value "SpybotDeletingA2415" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/23/2008 12:42:16 PM Allowed (based on user decision) value "SpybotDeletingC9573" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/23/2008 1:48:23 PM Allowed (based on user decision) value "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" (new data: "") added in ActiveX Distribution Unit!
4/23/2008 4:05:14 PM Allowed (based on user decision) value "SpybotDeletingB9465" (new data: "") deleted in System Startup user entry!
4/23/2008 4:05:15 PM Allowed (based on user decision) value "SpybotDeletingD7050" (new data: "") deleted in System Startup user entry!
4/23/2008 4:05:16 PM Allowed (based on user decision) value "SpybotDeletingA2415" (new data: "") deleted in System Startup global entry!
4/23/2008 4:05:17 PM Allowed (based on user decision) value "SpybotDeletingC9573" (new data: "") deleted in System Startup global entry!
4/24/2008 2:15:12 AM Allowed (based on user decision) value "SpybotDeletingB6650" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/24/2008 2:15:13 AM Allowed (based on user decision) value "SpybotDeletingD7594" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/24/2008 2:15:14 AM Allowed (based on user decision) value "SpybotDeletingA4020" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/24/2008 2:15:14 AM Allowed (based on user decision) value "SpybotDeletingC660" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/25/2008 11:10:47 AM Allowed (based on user decision) value "SpybotDeletingB7291" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/25/2008 11:10:49 AM Allowed (based on user decision) value "SpybotDeletingD82" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/25/2008 11:10:51 AM Allowed (based on user decision) value "SpybotDeletingA7833" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/25/2008 11:10:52 AM Allowed (based on user decision) value "SpybotDeletingC3926" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/26/2008 4:36:56 PM Allowed (based on user decision) value "SpybotDeletingB9075" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/26/2008 4:37:07 PM Allowed (based on user decision) value "SpybotDeletingD9745" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/26/2008 4:37:08 PM Allowed (based on user decision) value "SpybotDeletingA1046" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/26/2008 4:37:10 PM Allowed (based on user decision) value "SpybotDeletingC9551" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/27/2008 2:43:16 AM Allowed (based on user decision) value "SpybotDeletingB2871" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/27/2008 2:43:18 AM Allowed (based on user decision) value "SpybotDeletingD8341" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/27/2008 2:43:19 AM Allowed (based on user decision) value "SpybotDeletingA2085" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/27/2008 2:43:20 AM Allowed (based on user decision) value "SpybotDeletingC4439" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/28/2008 5:18:10 AM Allowed (based on user decision) value "SpybotDeletingB9309" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/28/2008 5:18:13 AM Allowed (based on user decision) value "SpybotDeletingD5505" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/28/2008 5:18:14 AM Allowed (based on user decision) value "SpybotDeletingA2979" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/28/2008 5:18:25 AM Allowed (based on user decision) value "SpybotDeletingC5493" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/30/2008 10:35:28 AM Allowed (based on user decision) value "SpybotDeletingB3031" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/30/2008 10:35:30 AM Allowed (based on user decision) value "SpybotDeletingD3397" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
4/30/2008 10:35:30 AM Allowed (based on user decision) value "SpybotDeletingA7462" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
4/30/2008 10:35:31 AM Allowed (based on user decision) value "SpybotDeletingC3938" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/1/2008 9:13:56 AM Allowed (based on user decision) value "SpybotDeletingB7600" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/1/2008 9:13:58 AM Allowed (based on user decision) value "SpybotDeletingD9217" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/1/2008 9:14:00 AM Allowed (based on user decision) value "SpybotDeletingA233" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/1/2008 9:14:01 AM Allowed (based on user decision) value "SpybotDeletingC8742" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/2/2008 10:03:10 AM Allowed (based on user decision) value "SpybotDeletingB1774" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/2/2008 10:03:12 AM Allowed (based on user decision) value "SpybotDeletingD3364" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/2/2008 10:03:13 AM Allowed (based on user decision) value "SpybotDeletingA4271" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/2/2008 10:03:14 AM Allowed (based on user decision) value "SpybotDeletingC7237" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/3/2008 9:19:28 AM Allowed (based on user decision) value "SpybotDeletingB754" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/3/2008 9:19:29 AM Allowed (based on user decision) value "SpybotDeletingD9224" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/3/2008 9:19:30 AM Allowed (based on user decision) value "SpybotDeletingA4979" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/3/2008 9:19:31 AM Allowed (based on user decision) value "SpybotDeletingC5630" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/5/2008 9:59:12 AM Allowed (based on user decision) value "SpybotDeletingB839" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/5/2008 9:59:14 AM Allowed (based on user decision) value "SpybotDeletingD9318" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/5/2008 9:59:14 AM Allowed (based on user decision) value "SpybotDeletingA4198" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/5/2008 9:59:15 AM Allowed (based on user decision) value "SpybotDeletingC5233" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/6/2008 10:37:08 AM Allowed (based on user decision) value "SpybotDeletingB3829" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/6/2008 10:37:10 AM Allowed (based on user decision) value "SpybotDeletingD4140" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/6/2008 10:37:10 AM Allowed (based on user decision) value "SpybotDeletingA4471" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/6/2008 10:37:11 AM Allowed (based on user decision) value "SpybotDeletingC7735" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/7/2008 9:29:15 AM Allowed (based on user decision) value "SpybotDeletingB5271" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/7/2008 9:29:16 AM Allowed (based on user decision) value "SpybotDeletingD627" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/7/2008 9:29:17 AM Allowed (based on user decision) value "SpybotDeletingA1263" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/7/2008 9:29:18 AM Allowed (based on user decision) value "SpybotDeletingC1610" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/8/2008 10:12:48 AM Allowed (based on user decision) value "SpybotDeletingB6928" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/8/2008 10:12:49 AM Allowed (based on user decision) value "SpybotDeletingD9753" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/8/2008 10:12:50 AM Allowed (based on user decision) value "SpybotDeletingA6265" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/8/2008 10:12:51 AM Allowed (based on user decision) value "SpybotDeletingC2816" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/10/2008 3:41:42 PM Allowed (based on user decision) value "SpybotDeletingB5387" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/10/2008 3:41:52 PM Allowed (based on user decision) value "SpybotDeletingD5958" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/10/2008 3:41:53 PM Allowed (based on user decision) value "SpybotDeletingA9396" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/10/2008 3:41:54 PM Allowed (based on user decision) value "SpybotDeletingC5441" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/11/2008 2:11:14 AM Allowed (based on user decision) value "SpybotDeletingB2683" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/11/2008 2:11:15 AM Allowed (based on user decision) value "SpybotDeletingD7492" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/11/2008 2:11:16 AM Allowed (based on user decision) value "SpybotDeletingA7635" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/11/2008 2:11:17 AM Allowed (based on user decision) value "SpybotDeletingC7363" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/12/2008 2:19:24 AM Allowed (based on user decision) value "SpybotDeletingB9733" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/12/2008 2:19:25 AM Allowed (based on user decision) value "SpybotDeletingD4920" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/12/2008 2:19:26 AM Allowed (based on user decision) value "SpybotDeletingA1442" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/12/2008 2:19:27 AM Allowed (based on user decision) value "SpybotDeletingC8545" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/14/2008 1:56:32 PM Allowed (based on user decision) value "SpybotDeletingB3763" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/14/2008 1:56:34 PM Allowed (based on user decision) value "SpybotDeletingD8435" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/14/2008 1:56:35 PM Allowed (based on user decision) value "SpybotDeletingA7422" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/14/2008 1:56:36 PM Allowed (based on user decision) value "SpybotDeletingC5100" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/15/2008 10:10:41 AM Allowed (based on user decision) value "SpybotDeletingB6410" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/15/2008 10:10:42 AM Allowed (based on user decision) value "SpybotDeletingD5130" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/15/2008 10:10:43 AM Allowed (based on user decision) value "SpybotDeletingA1890" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/15/2008 10:10:44 AM Allowed (based on user decision) value "SpybotDeletingC3378" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/16/2008 2:54:13 AM Allowed (based on user decision) value "SpybotDeletingB589" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/16/2008 2:54:15 AM Allowed (based on user decision) value "SpybotDeletingD5065" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/16/2008 2:54:16 AM Allowed (based on user decision) value "SpybotDeletingA8584" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/16/2008 2:54:17 AM Allowed (based on user decision) value "SpybotDeletingC8655" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/17/2008 10:59:51 AM Allowed (based on user decision) value "SpybotDeletingB907" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/17/2008 10:59:53 AM Allowed (based on user decision) value "SpybotDeletingD7395" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/17/2008 10:59:53 AM Allowed (based on user decision) value "SpybotDeletingA316" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/17/2008 10:59:54 AM Allowed (based on user decision) value "SpybotDeletingC6300" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/17/2008 1:10:15 PM Allowed (based on user decision) value "SpybotDeletingB6650" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:18 PM Allowed (based on user decision) value "SpybotDeletingD7594" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:19 PM Allowed (based on user decision) value "SpybotDeletingB7291" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:21 PM Allowed (based on user decision) value "SpybotDeletingD82" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:23 PM Allowed (based on user decision) value "SpybotDeletingB9075" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:24 PM Allowed (based on user decision) value "SpybotDeletingD9745" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:26 PM Allowed (based on user decision) value "SpybotDeletingB2871" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:29 PM Allowed (based on user decision) value "SpybotDeletingD8341" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:31 PM Allowed (based on user decision) value "SpybotDeletingB9309" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:32 PM Allowed (based on user decision) value "SpybotDeletingD5505" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:35 PM Allowed (based on user decision) value "SpybotDeletingB3031" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:37 PM Allowed (based on user decision) value "SpybotDeletingD3397" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:39 PM Allowed (based on user decision) value "SpybotDeletingB7600" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:40 PM Allowed (based on user decision) value "SpybotDeletingD9217" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:42 PM Allowed (based on user decision) value "SpybotDeletingB1774" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:45 PM Allowed (based on user decision) value "SpybotDeletingD3364" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:48 PM Allowed (based on user decision) value "SpybotDeletingB754" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:51 PM Allowed (based on user decision) value "SpybotDeletingD9224" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:52 PM Allowed (based on user decision) value "SpybotDeletingB839" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:55 PM Allowed (based on user decision) value "SpybotDeletingD9318" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:57 PM Allowed (based on user decision) value "SpybotDeletingB3829" (new data: "") deleted in System Startup user entry!
5/17/2008 1:10:59 PM Allowed (based on user decision) value "SpybotDeletingD4140" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:02 PM Allowed (based on user decision) value "SpybotDeletingB5271" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:05 PM Allowed (based on user decision) value "SpybotDeletingD627" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:07 PM Allowed (based on user decision) value "SpybotDeletingB6928" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:09 PM Allowed (based on user decision) value "SpybotDeletingD9753" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:11 PM Allowed (based on user decision) value "SpybotDeletingB5387" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:13 PM Allowed (based on user decision) value "SpybotDeletingD5958" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:15 PM Allowed (based on user decision) value "SpybotDeletingB2683" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:17 PM Allowed (based on user decision) value "SpybotDeletingD7492" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:20 PM Allowed (based on user decision) value "SpybotDeletingB9733" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:22 PM Allowed (based on user decision) value "SpybotDeletingD4920" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:27 PM Allowed (based on user decision) value "SpybotDeletingB3763" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:28 PM Allowed (based on user decision) value "SpybotDeletingD8435" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:29 PM Allowed (based on user decision) value "SpybotDeletingB6410" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:30 PM Allowed (based on user decision) value "SpybotDeletingD5130" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:31 PM Allowed (based on user decision) value "SpybotDeletingB589" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:33 PM Allowed (based on user decision) value "SpybotDeletingD5065" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:34 PM Allowed (based on user decision) value "SpybotDeletingB907" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:35 PM Allowed (based on user decision) value "SpybotDeletingD7395" (new data: "") deleted in System Startup user entry!
5/17/2008 1:11:36 PM Allowed (based on user decision) value "SpybotDeletingA4020" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:37 PM Allowed (based on user decision) value "SpybotDeletingC660" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:38 PM Allowed (based on user decision) value "SpybotDeletingA7833" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:39 PM Allowed (based on user decision) value "SpybotDeletingC3926" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:40 PM Allowed (based on user decision) value "SpybotDeletingA1046" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:41 PM Allowed (based on user decision) value "SpybotDeletingC9551" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:42 PM Allowed (based on user decision) value "SpybotDeletingA2085" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:43 PM Allowed (based on user decision) value "SpybotDeletingC4439" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:44 PM Allowed (based on user decision) value "SpybotDeletingA2979" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:45 PM Allowed (based on user decision) value "SpybotDeletingC5493" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:46 PM Allowed (based on user decision) value "SpybotDeletingA7462" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:47 PM Allowed (based on user decision) value "SpybotDeletingC3938" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:48 PM Allowed (based on user decision) value "SpybotDeletingA233" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:49 PM Allowed (based on user decision) value "SpybotDeletingC8742" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:50 PM Allowed (based on user decision) value "SpybotDeletingA4271" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:50 PM Allowed (based on user decision) value "SpybotDeletingC7237" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:51 PM Allowed (based on user decision) value "SpybotDeletingA4979" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:52 PM Allowed (based on user decision) value "SpybotDeletingC5630" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:52 PM Allowed (based on user decision) value "SpybotDeletingA4198" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:53 PM Allowed (based on user decision) value "SpybotDeletingC5233" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:54 PM Allowed (based on user decision) value "SpybotDeletingA4471" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:54 PM Allowed (based on user decision) value "SpybotDeletingC7735" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:55 PM Allowed (based on user decision) value "SpybotDeletingA1263" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:55 PM Allowed (based on user decision) value "SpybotDeletingC1610" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:56 PM Allowed (based on user decision) value "SpybotDeletingA6265" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:57 PM Allowed (based on user decision) value "SpybotDeletingC2816" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:57 PM Allowed (based on user decision) value "SpybotDeletingA9396" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:58 PM Allowed (based on user decision) value "SpybotDeletingC5441" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:58 PM Allowed (based on user decision) value "SpybotDeletingA7635" (new data: "") deleted in System Startup global entry!
5/17/2008 1:11:59 PM Allowed (based on user decision) value "SpybotDeletingC7363" (new data: "") deleted in System Startup global entry!
5/17/2008 1:12:00 PM Allowed (based on user decision) value "SpybotDeletingA1442" (new data: "") deleted in System Startup global entry!
5/17/2008 1:12:00 PM Allowed (based on user decision) value "SpybotDeletingC8545" (new data: "") deleted in System Startup global entry!
5/17/2008 1:12:01 PM Allowed (based on user decision) value "SpybotDeletingA7422" (new data: "") deleted in System Startup global entry!
5/17/2008 1:12:01 PM Allowed (based on user decision) value "SpybotDeletingC5100" (new data: "") deleted in System Startup global entry!
5/17/2008 1:12:02 PM Allowed (based on user decision) value "SpybotDeletingA1890" (new data: "") deleted in System Startup global entry!
5/17/2008 1:12:03 PM Allowed (based on user decision) value "SpybotDeletingC3378" (new data: "") deleted in System Startup global entry!
5/17/2008 1:12:03 PM Allowed (based on user decision) value "SpybotDeletingA8584" (new data: "") deleted in System Startup global entry!
5/17/2008 1:12:04 PM Allowed (based on user decision) value "SpybotDeletingC8655" (new data: "") deleted in System Startup global entry!
5/17/2008 1:12:04 PM Allowed (based on user decision) value "SpybotDeletingA316" (new data: "") deleted in System Startup global entry!
5/17/2008 1:12:05 PM Allowed (based on user decision) value "SpybotDeletingC6300" (new data: "") deleted in System Startup global entry!
5/17/2008 2:49:11 PM Allowed (based on user decision) value "SpybotDeletingB7872" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/17/2008 2:49:19 PM Allowed (based on user decision) value "SpybotDeletingD9541" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/17/2008 2:49:25 PM Allowed (based on user decision) value "SpybotDeletingA1658" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/17/2008 2:49:27 PM Allowed (based on user decision) value "SpybotDeletingC5417" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/17/2008 3:06:36 PM Allowed (based on user decision) value "SpybotDeletingB7872" (new data: "") deleted in System Startup user entry!
5/17/2008 3:06:38 PM Allowed (based on user decision) value "SpybotDeletingD9541" (new data: "") deleted in System Startup user entry!
5/17/2008 3:06:39 PM Allowed (based on user decision) value "SpybotDeletingA1658" (new data: "") deleted in System Startup global entry!
5/17/2008 3:06:40 PM Allowed (based on user decision) value "SpybotDeletingC5417" (new data: "") deleted in System Startup global entry!
5/18/2008 9:37:31 AM Allowed (based on user decision) value "scrnsave.exe" (new data: "") deleted in Desktop settings!
5/18/2008 10:20:25 AM Denied (based on user decision) value "SpybotDeletingB7305" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/18/2008 10:20:28 AM Denied (based on user decision) value "SpybotDeletingD902" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup user entry!
5/18/2008 10:20:33 AM Denied (based on user decision) value "SpybotDeletingA2401" (new data: "command /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!
5/18/2008 10:20:46 AM Denied (based on user decision) value "SpybotDeletingC4313" (new data: "cmd /c del "C:\WINNT\SchedLgU.Txt"") added in System Startup global entry!

 

[Zenobia]

No,the dialog boxes you're getting from Teatimer aren't from a setting you made.Spybot is adding those startup entries so that it can fix schedlgu.txt.Please see:

hello,

these autorun entries are generates by Spybot S&D if it encounters files that cannot be deleted during runtime because they are locked by other processes.
C:\WINDOWS\SchedLgU.Txt
for instance is the scheduler log file and is locked by Windodws as long as it runs.

For operating system compatibility reasons the autorun entries are generated with cmd and command.

http://forums.spybot.info/showthread.php?p=115123#post115123

I`m not sure why Spybot is still detecting schedlgu.txt even though you put it in the single ignore list.I thought maybe some entries had been blacklisted and things had gotten bungled up somehow,but your resident.log shows that it was you allowing and denying,so that can`t be it.
I wonder if Spybot might be excluding schedlgu.txt during a manual scan,but not excluding it during a scheduled scan for some reason?Yes,maybe try running a manual scan after you`ve added schedlgu.txt back to the ignore single entries list,and see if Spybot excludes schedlgu.txt or not.