ESET HIPS notification at startup

[Frib004]

Hello everyone
I apologize for the not so good English and if I'm posting in the wrong place.
Anyway, every time I start the computer the ESET HIPS on two notifications, would you hide them?
I configured HIPS according to the post here in the forum "as default-deny". And since then it is going up these two popups right after the system boot.

 

[SeriousHoax]

Some scripts are running at startup. Check your startup items in task manager or via the autoruns app.

 

[Frib004]

These are the items at startup:

 

[SeriousHoax]

Ok post a screenshot from the logon section of autoruns.
https://download.sysinternals.com/files/Autoruns.zip
Alos check ESET HIPS log. It should show which scripts are being blocked.
Is that 4487.4 seconds? That's too long. Mine is always between 3.9 to 4.9 seconds.

 

[Frib004]

I really don't understand what those seconds are in Task Manager, I use a Kingston A400 240GB SSD and it powers up in 8 ~ 10 seconds.
Anyway, here it is:

 

[SeriousHoax]

Nothing suspicious here. You have to check the ESET HIPS log.

 

[harlan4096]

I would expand [Image Path] column and click over the 1st entry cmd.exe, and take a new screen-shot

 

[Frib004]

Nothing suspicious here. You have to check the ESET HIPS log.

Where do I see the ESET logs?

 

[Frib004]

I would expand [Image Path] column and click over the 1st entry cmd.exe, and take a new screen-shot

Access denied.

 

[harlan4096]

I meant 1 click to select (not double lick) the entry and see below the full path...

 

[Frib004]

:

 

[harlan4096]

Ok, then run AutoRuns in Admin -> click over Run as Amind, or 1 click left mouse button over AuroRuns -> Run as Admin...

 

[Frib004]

He keeps notifying.

 

[SeriousHoax]

Where do I see the ESET logs?

Open ESET then Tools > Log files > HIPS
Something like this.

 

[Frib004]

:

 

[SeriousHoax]

It could be related to the gathernetworkinfo script. I need to see the locations of both Application and Target sections. Expand them sideways to reveal the full locations.

 

[Frib004]

:

 

[SeriousHoax]

I'm not sure what's causing this. Try this, open Task Scheduler > Microsoft > Windows > NetTrace > Now right click on GatherNetworkInfo and disable it. Then restart your pc.

 

[Frib004]

I deleted all HIPS rules and now it's back to normal.

 

[SeriousHoax]

I used those HIPS rule before and didn't have this issue so it's strange. Anyway, you can just simply install OsArmor if you want those protection and more.