thx had tried that, but did not help
EDIT: found it - Kees\Appdata\Roaming\Spyshelter had General User access rights when I added myself the rules were saved. Note I only have HIPS + encryption driver enabled (which works for Chrome). Set security to "Aito allow - HIGH".
By using the folder allow and reverting it to block, you can set default allow and deny. I have for instance allowed Windows folder (because most windows executables are catalog signed instead of file signed and most security programs have difficulty recognizing that) and security folder (to prevent one security program blocking the other). I also set a default deny to programs I don't use (Internet Explorer, Windows Mail and Microsoft Works), Public folders, Microsoft programs processing scripts and some utilities.