I have just downloaded a an application called TSM_App.exe. It supposed to be safe application as it manages one of addons to one of my games. I downloaded it to my own location out of system files. Every time I tried to run it, CIS / HIPS warned me that explorer.exe was about to run this executable. I have ticked “Remember answer”.
Now, I tried to find this rule and I cannot see anything I have agreed to. Because it was HIPS, I tried to find anything in HIPS rule but there’s nothing related to explorer.exe and TSM_App.exe. Could someone please advice thank you.
Go to advanced settings > Security Settings > Defense+ > HIPS > HIPS Rules then scroll-down and look for “%windir%\explorer.exe” then right-click it and click “Edit”, in the new window you should see “Run an executable” and to the right of it the action (Ask) and to the right of that the exclusions “Modify (X/X)” ← Press Modify and the application you allowed to be launched (TSM_App.exe) should be in this list.
I am afraid you have lost me on that one. I am aware explorer.exe is different from iexplorer.exe and that explorer.exe is a System file. My question is why HIPS warns me about explorer.exe executing TSM_App.exe but not, for instance, firefox.exe, or word.exe, or anything else. It’s explorer.exe that executes TSM_App.exe not iexplorer.exe
Do you mean why HIPS doesn’t alert about explorer.exe launching Firefox.exe or do you mean Firefox.exe launching other application?
For explorer.exe launching Firefox.exe; It’s because Firefox.exe is a trusted application and since explorer.exe is also a trusted application it is then allowed to launch other trusted applications (assuming you’re not using HIPS in Paranoid mode)
For Firefox.exe launching other application; I don’t know, more information would be needed.
