Created an exception in HIPS IPS rules to allow a .chm file to open. I currently have 14 exceptions for this signature (2662) and all the other exceptions are working fine. Initially this particular exception was working fine. I have recreated it several times and had another person go in and try to fix this and we just can't get it to work. Running HIPS 7.0.0 1102 sig. 3248
Please review the signature violation for the .chm file. When you create the signature exception, make sure you're not putting in informaion that is too specific (if you want a signature that cover a broad range of violations for this file type). If you create the exception directly from the signature violation event, in the ePO console, then the exception will be specfic to that event. Modify your exception and start with the basic details (Signature name/number, User, Processes). If the "User" info is specific users, you can set the User entry to "All Users", if you want.
If you put any entries into the "Advanced Details" section, then you will narrow down the exception to only those particular details. If you add a "File" parameter to a particular .chm file, that exception will only apply to that one file. You can try using wildcards too. Also, if you add multiple parameters then the ADD or OR operations apply. If you add multiple entries of the same parameter type, they perform an "OR" operation. If you add different parameter types, then they are "AND" together.
FILE = xxxxxxxx
FILE = xxxxxxxx
SOURCE = xxxxxxxx
Thanks for you help Kary. I did do all the things you mention and still could not get this to work. I was fianlly able to get it to work by going into the signature and reducing the severity to low, and the file opened. Went back in and changed it to medium and it now is working properly. I have no idea what happened but it is fixed now. Thank goodness it was driving me nuts!