"cleanmgr.exe is trying to execute dismhost.exe" alert

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
1

I keep getting this alert from comodo HIPS. I have checked it to allow and remember, but it won’t. I believe that is because dismHost is located always in different location in the temp folder.

I have HIPS set to Clean PC mode. Is there a safe way to allow it permanently without having to be asked each time?

Windows 10

2

You can either set HIPS to Safe Mode or go to the HIPS rules for cleanmgr.exe and under “Run and executable” access right, click exclusions and edit the entry to *\DismHost.exe

3

OK, I will try safe mode and see if that does the trick. See, I never really understood the difference between safe and clean modes (though I read the help page). If that doesn’t work I’ll try your other suggestion. Thanks a lot.

4

I think you might possibly have a system store corruption.

Run the command prompt as admin and enter → sfc/scannow

Let it finish and if any integrity violations are found then run the Command prompt as admin again and enter → Dism /Online /Cleanup-Image /RestoreHealth

Locations for DismHost -

DismHost.exe C:\Users\XPC\AppData\Local\Temp\8A2A4C29-1AD5-49E9-9B60-C36E218C4ED6\
DismHost.exe C:\Windows\System32\Dism\
DismHost.exe C:\Windows\SysWOW64\Dism\
DismHost.exe C:\Windows\WinSxS\amd64_microsoft-windows-d…ing-management-core_31bf3856ad364e35_6.2.9200.16384_none_83fdcd69b483512b\
DismHost.exe C:\Windows\WinSxS\x86_microsoft-windows-d…ing-management-core_31bf3856ad364e35_6.2.9200.16384_none_27df31e5fc25dff5\
DISMHOST.EXE-D3A7990C.pf C:\Windows\Prefetch\

Good Luck.

Edit : You could also add a rule for cleanmgr.exe under hips and set it to installer or updater. That will stop the alerts if all else fails.

5

I ran sfc but it did not find any integrity violations. After I set HIPS to safe mode as suggested by futuretech I haven’t had the issue again as yet. Thanks a lot.

6

Greetings hippiemaster. Glad you found the solution. :slight_smile:

7

I set it to Safe Mode but still these many pop ups for dismhost.exe.
For the Hips rules, can you guide me step by step how to do this ?

THX

8

Most easy way would be to add cleanmgr.exe to the HIPS rule as a Windows System Application ruleset. Open the advanced settings and navigate to HIPS rules, click add then browse select application and type cleanmgr.exe (assuming the opened window is in windows syster32 directory), then to the right of use ruleset select windows system application and ok out all windows.

9

Doesnt work, when I click on OK the window disappear, then I click OK again and this windows appears again and when I click it again and so on.


OK, this doesnt work so how I do this ?:

“You can either set HIPS to Safe Mode or go to the HIPS rules for cleanmgr.exe and under “Run and executable” access right, click exclusions and edit the entry to *\DismHost.exe”

10

Then that means there is already a rule for cleanmgr which means you just need edit its rule to be windows system application instead of custom.

11

It is set to Windows System Application !

What about the second part of my question ? Because I want to get rid of dismhost.exe pop ups everytime.

"OK, this doesnt work so how I do this ?:

“You can either set HIPS to Safe Mode or go to the HIPS rules for cleanmgr.exe and under “Run and executable” access right, click exclusions and edit the entry to *\DismHost.exe”"

12

What kind of alerts are you getting for dismhost? Are you getting alerts for cleanmgr trying to execute dismhost or are the alerts for dismhost trying to do some action? You shouldn’t be getting alerts for dismhost if HIPS is set to safe mode as dismhost is a trusted application. When I recommended to add dismhost to the run an executable exclusion it achieves the same affect when cleanmgr is set to windows system application ruleset because cleanmgr will be allowed to execute dismhost no matter where dismhost is located at. Again make sure HIPS is not in clean PC mode and is set to Safe Mode and look for dismhost in the file list and set the rating to trusted.

13

The alerts are for dismhost trying to do some action.
HIPS is always in Safe Mode.
I looked in the file list and set dismhost.exe to “Trusted”.
Let´s see if this works.

Thanks for your help and your patience !

Have a nice day !

14

Hoping that 4 months are not too many to reply here, and due to the fact that I was unable to find a search function anywhere on the forum, I post here.

I have installed WinX today.
Same message.
I did not answer to the popup, because I had no idea of what to do.

I have read a bit in internet and some people think that these two exe are totally useless if not even negative.

So I would like to ask a few questions:

  1. are these two exe good for anything? I tend to disable all what is not needed. I also have a SSD and I do not want programs cleaning stuff and do writings all the time.
  2. what advantages and disadvantages would I have, setting Hips to Safe? I thought that that would make it more invasive in his controls over the system and I want it more light.

I have run the cdm check and no integrity violation was found.

Thanks