Frequently at start-up, I will receive sidebar notifications from Windows Security, and I am looking for remedy. Please.
“Unauthorized changes blocked. Controlled folder access blocked [one, all, or more of exe-files below] from making changes to memory”
I will the next time that it occurs. It does not happen at every start-up, but only with apparent updates.
The frequency can be on average once per week, and today I cleared all the notifications after writing down the blocked exe-files.
Can you please open Event Viewer, go to Application and Services Logs (it may take a while to open), navigate to Microsoft\Windows\Windows Defender\Operational and look for the associated warnings (and post an example here)?
The warnings are related to Defender’s antiransomware feature - but we’re not sure what actually “making changes to memory” means, or why it doesn’t consider antimalware processes safe.
Product Name Microsoft Defender Antivirus
Product Version 4.18.2102.3
Unused
ID
Detection Time 2021-04-30T15:43:38.856Z
User NT AUTHORITY\SYSTEM
Path \Device\Harddisk0\DR0
Process Name C:\Program Files\Avast Software\Avast\aswToolsSvc.exe
Security intelligence Version 1.331.2590.0
Engine Version 1.1.17900.7
Product Name Microsoft Defender Antivirus
Product Version 4.18.2102.3
Unused
ID
Detection Time 2021-04-30T15:43:06.475Z
User NT AUTHORITY\SYSTEM
Path \Device\Harddisk0\DR0
Process Name C:\Program Files\Avast Software\Avast\aswidsagent.exe
Security intelligence Version 1.331.2590.0
Engine Version 1.1.17900.7