Jump to content

Recommended Posts

Hello, I'm having what may be a non-issue with HIPS however I'd appreciate some guidance.

I'm seeing multiple entries of the following (xml exported from hips event log) : nvdisplay.container.exe targeting csrss.exe

I'd like to understand if this is a false positive and

  • if so how do we allow nvdisplay.container.exe when it is constantly changing it's folder location
  • if not then can we clear up as to why? maybe nvdisplay.container.exe is just throwing a handle into something it shouldn't be here?

 

So far it's been a non-issue because no noticeable ill-effects from this event have lead me to looking for a root cause.. Just purely me looking through the recent logs and noticed a lot of these entries.

 

Thank you

Link to comment
Share on other sites

  • Administrators

We could investigate it if it causes some issues on your machine. However, you mentioned that you did not experience any issues. Therefore please make sure that you have logging of blocked operations disabled. This option serves for troubleshooting HIPS-related issues and should not stay enabled longer than necessary. Leaving it enabled could cause confusion for you (as it already did) and could have also adverse effect on performance.

image.png

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...