And just when you think the HIPS monster has been tamed...it re-spawns. I consider it a good investment in time lately to remove HIPS altogether during troubleshooting/ fix actions/ verification/ observation.
When satisfied, then turn it back on.
I'm not convinced that everything I need to see in ProgramData\McAfee\ folder is a complete picture of what is or is not happening. If HIPS is disabled altogether, I like my chances more. I suspect a HIPS admin would detect issues if he was glued to a console and keenly interested in my issue. That never seems to be the case though.