When using RVS 2011 Lite with System Protection ON and System Guard ON and 'Prompt user(s) for action when unauthorized access occurs' ticked I get the pop-up shown below when I activate Process Explorer. If I click 'Terminate' ProExp doesn't start as is to be expected. If I click 'Pass' ProExp starts up . However, if I click 'Deny' it still starts normally . If I untick 'Prompt user...' etc ProExp just starts normally. So, what should 'Deny' do? Or does it allow ProExp because it isn't actually doing anything malicious? I was was also under the impression that if I unticked 'Prompt user...' etc it would become like 'Default-Deny' and block without a warning pop-up. Not sure if I have misunderstood quite how it works but some clarification would be welcome. Also, I notice that there is a countdown timer on the pop-up and when it gets to zero the 'suspended' application then starts. Shouldn't it terminate it?