D+ sometimes allowing execution instead of asking

I installed Comodo Firewall 3 a while ago to replace Kerio 2.1.5. But somehow I cannot get it to work properly. I have already installed it 3 times, after removing it using the advice on this forum. I have also removed every reference to Kerio I could find.
It seems Comodo is working as expected sometimes, but not always and consistently.
I’ll open separate topics for the different issues, to keep things clear…

I have D+ in paranoid mode to get some feeling with the alerts and to find out what kind of permissions applications need. At first D+ alerted me for every new application I tried to open, asking if explorer.exe could execute the application. Suddenly it stopped doing this. I can now open every application without “execute”-alerts from D+.
This seems to be only for explorer.exe though. If I run something from a command prompt for example, D+ is still asking if cmd.exe is allowed to execute.
I have checked the settings, I have removed all “allowed applications” for the “run an executable” access right for explorer.exe. Still explorer.exe can open any applicaton.
But… if I set “run an executable” to Block instead of Ask, it does block the execution of every application by explorer.exe!

Any thoughts?

Your better with the firewall at “train with safe mode” and D+ at “clean pc mode”.

Maybe, but paranoid mode should still work, no?

I leave Comodo at default since 3.0 came out and it works perfect.

Weird behavior… ???
Have you also unchecked “allow applications signed by comodo”?

Do you mean “Trust applications digitally signed by Trusted Software Vendors”? I have that unchecked.

Check that explorer.exe policy is set to Custom
Check that Image Execution Control Level is set to Normal or Aggressive and that *.exe is included in Files to Check
Make sure that “Deactivate the Defense+ permanentely” is unchecked
Run Miscellaneous → Diagnostics

explorer.exe policy is custom, image execution control level is normal, *.exe is in Files to Check and D+ is not deactivated permanently.

Diagnostics did not find any problems with the installation.