Defence+ asks permamently about svchost

Since problems with CIS (bug reported on AV forum, no updates) I have made reinstall of CIS. But since few days my Defence+ attacks me with asks about svchost running some programs from my hard drive. Is this right way of working this service? It runs (CIS says it runs, however those aren’t running on processes list in Windows Task Manager) programs like winamp, Notepad++, games and so on. I don’t know if this is correct.

Also when I run Firefox CIS says that cmd.exe is trying to run python.exe (I have it installed as a python developer). If I choose to block cmd, it shows problems with Win32 or something (I guess its because of Access Denied error [like in cmd when you run blocked app]). Why does Firefox need to run python.exe through cmd? Anyone knows?

Please especially answer to the first issue.