Jump to content

Archived

This topic is now archived and is closed to further replies.

Recommended Posts

Hello, I'm having what may be a non-issue with HIPS however I'd appreciate some guidance.

I'm seeing multiple entries of the following (xml exported from hips event log) : nvdisplay.container.exe targeting csrss.exe

I'd like to understand if this is a false positive and

  • if so how do we allow nvdisplay.container.exe when it is constantly changing it's folder location
  • if not then can we clear up as to why? maybe nvdisplay.container.exe is just throwing a handle into something it shouldn't be here?

 

So far it's been a non-issue because no noticeable ill-effects from this event have lead me to looking for a root cause.. Just purely me looking through the recent logs and noticed a lot of these entries.

 

Thank you

Share this post


Link to post
Share on other sites

We could investigate it if it causes some issues on your machine. However, you mentioned that you did not experience any issues. Therefore please make sure that you have logging of blocked operations disabled. This option serves for troubleshooting HIPS-related issues and should not stay enabled longer than necessary. Leaving it enabled could cause confusion for you (as it already did) and could have also adverse effect on performance.

image.png

Share this post


Link to post
Share on other sites

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...