Runtime behavior alerts of this type inform the user that Internet Explorer has attempted to start a suspicious-looking program that has been recently downloaded. Any unexpected attempt at this behavior could indicate a malware infection.
Please note that the behavior of some legitimate product installers can sometimes resemble that of malware. For this reason, installing or updating software carries an increased likelihood of unwanted HIPS detections and we recommend configuring HIPS to Alert Only mode for the duration of any product installs or updates. For further information please refer to the following knowledgebase article deciding whether to allow or block a file.
Unauthorised downloads can result in the installation of unlicensed software. Sophos recommends investigating HIPS/ProcMod-003 reports in order to control the software being installed on corporate networks.
HIPS/ProcMod-003 uses Sophos Behavioral Genotype technology to enhance detection accuracy.