False Positive Artemis!75940739C327

[Commodores]

We have EPO and HIPS installed.

It is constantly deleting Espresso.exe which is used to log in to our Espresso Service (http://www.discoveryeducation.co.uk/) so young children do not have to try and enter the logon details each time.

I have gone into Policy Catalogue, On-Access Default Processes Policies and Exclusions and added P:\Espresso\* and P:\Espresso\Espresso\* (for some reason it will not let me check the Also Exclude Sub Folders box) but it is still detecting this and deleting it when we regenerate the EXE file.

I am wondering if this is something to do with HIPS and perhaps something also needs to be excluded in EPO for that to stop this false positive from being detected?