HIPS annoys with "SYSTEM wants to create a new file or directory"

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
#1

Hi,
since i have my new laptop (Win 10)and Comodo CIS (12.0.0.6818) installed, HIPS annoys me with frequent alerts “SYSTEM wants to create a new folder” :frowning:
i had this also on my old laptop, but now it is really annoying, as it happens several times a day, in spite of answering “treat as windows system application” or allowing to perform that action. the folder shown is in fact C:\WINDOWS\SYSTEM.
what to do? ???
thanks

#2

Was ‘Remember my answer’ checkbox checked in HIPS alert?

#3

yes, always. That’s what annoys so much… i can go on doing again and again the same thing…

#4

Could you share by PM your config file?

#5

i did this before but i can’t remember how to do that. Please instruct me.

#6

configuration file uploaded

#7

Last I remember HIPS no longer prompts about new folder creation so it must have been to modify a folder or to create a new file. You normally wouldn’t get alerts from the System process because it is already part of the default HIPS rules for the Windows System Applications file group. If you have create rules for safe applications enabled, then rules will be erased on system shutdown or reboot if new rules are being created or updated.

#8

I think the message from HIPS is “SYSTEM wants to create a new file or folder”, i have to read the next time carefully, because i alway klick it away. Does this mean i have to uncheck “create rules for safe applications”?

#9

It just happened again, with the new configuration. the message was “system wants to create a new file or directory”
https://ufile.io/9jsykadc

#10

Yes uncheck create rules for safe applications and do not have HIPS in training mode when you shutdown or reboot. Make sure the Windows System Applications file group HIPS rule is present and System is part of that group.

#11

Ok, i unchecked “create rules for safe applications” in HIPS settings, however in firewall settings it is still checked. HIPS ia always in safe mode, never was in training mode. in HIPS Rulesets the windows system application is present and when i got the alert i choose “treat as windows system application”. in HIPS rules SYSTEM is treated as “windows system application”. i hope now all is ok :slight_smile:

#12

Thank you all very much. The new configuration settings seem to work for the last few days without giving that alert. :slight_smile:

#13

Hello, I keep getting this pop-up from time to time and even when I check the remember my choice option, it keeps coming back no matter what (!?).

What would be the correct way to avoid this constant alert since the remember my choice option isn’t working for this case?

Thank you.

#14

New one:

Now for “Wifi.etl”

#15

Not safe. Very not Safe. Please take this to a true troubleshooting space as this is for Comodo tech support primarily and there are many free spaces to do this.

#16

I never checked “create rules for safe applications” in HIPS settings as well as in Firewall-settings.

I DO hope the same for me with “Remember the blockade I made permanent!”

#17

Same is true for training mode, if you leave HIPS in training mode when system restarts/shuts down, then HIPS rules can get erased. Check for the HIPS rule of Windows Systeam Applications file group, as that contains “System” as part of the file group. No one should ever get a HIPS alert from System process as it is part of the default HIPS rules of the WSA file group.

#18

Thanks for your help.

I have always selected the safe mode in HIPS, BUT: ‘Windows system applications’ was missing in the configuration that I modified. Sometimes I switched Firewall and HIPS into training mode for a short time.
Now I imported an older configuration that contains this entry and think that now everything works again.