Thanks for the response. That's what I want to know: how do I go through the MS KBs to see if a particular file was updated in it? When I go to the KB article and the security update that's related, I don't see a description of what files are updated when it is installed. So in the future, if ESS prompts me, I want to be able to make an informed decision, instead of always clicking Deny. I mean, if it happens right after I install an MS update, I'm pretty sure that's what caused it. If it happens two weeks afterwards, I have no idea if that file was legitimately updated recently or is the victim of a zero-day.
I think the fact that Deny was grayed out here is probably just a fluke.