Password Protection warning about WUDFhost.exe

Avast Free Antivirus / Premium Security
1

I searched the forum and can find no prior posts on this subject. Yesterday Avast Premium Security’s Password Protection feature popped up a warning about WUDFhost.exe (see attachment 1). It happened just after I had (USB-)connected my camera to upload some pictures. I don’t think this can be a coincidence even though I have been doing this every day or two for months and have never had the warning before. I checked and confirmed that WUDFhost.exe is a standard and critical Windows component, so I clicked Allow App. Now it will always be allowed to access my login info (see attachment 2). It seems likely that this was a false positive but I remain uneasy:

  • Why would WUDFhost.exe be needing to access my login info?
  • Was connecting my camera indeed the trigger?
  • If so, why would Password Protection not have warned me before?
  • Should I have blocked access, and if so, how do I undo Allow Access?

PS I just noticed something in the screenshots that I did not notice yesterday. Th path to the login data references a user (one of three set up on the machine) who was not logged in at the time (and indeed seldom is). Now I am more concerned than I was before.

Regards,
Andy

2

→ https://support.avast.com/en-ww/article/298/ (Blocked & Allowed apps)

3

It’s happened again. Same symptom, different “baddie”. I took a screenshot at the time but seems I didn’t save it. It was another Windows file (apparently) and again it was (apparently) trying to access the login data for the same user as before, a user not logged in. This time I blocked it. Although I don’t have a screenshot, I (eventually) managed to find in Avast where the identity of the file was recorded: sdiagnhost.exe, in c:\windows\system32.

Can an Avast person please advise what is going on here? They might be Windows processes but they shouldn’t be trying to access login data for a user not even logged in. Seems to me either something nasty is going on, or Avast is misinterpreting something benign. I can’t think of another explanation.

Andy