I recevied a lot notification "suspicious action was blocked" form kaspersky.

[tom147527]

Hello. I recently received a lot notifications “suspicious action was blocker”. It showed my Pc memory from other processes. 

There are notifications these I got. 

 

Suspicious action was blocked 

Action 

Read memory from other processes

Application 

Host Process Windows Services or Windows Explorer

Application path 

C:\Windows\System32\schost.exe or C:\Windows\explorer.exe

 

 

I just want to ask. Is it a normal situation??

 

 

[Flood and Flood's wife]

Hello  @tom147527,

Welcome!

• Was a "Protected" browser, & or SafeMoney browser active at the time the events were logged?

Kaspersky application reports "Suspicious action was blocked" events, for normal system processes when SafeMoney/Protected browser is active.

According to the Kaspersky Lab Technical Experts, this "known" issue, is not an issue, it is "by design", i.e. normal. 

(imo), this “normal” specific event should be documented, many folks have been concerned upon finding it in the Kaspersky application reports, sample as follows:

15.09.2019 11.21.36 Suspicious action was blocked WMI Provider Host Action: Read memory from other processes Application: WMI Provider Host Application path: C:\Windows\System32\wbem\WmiPrvSE.exe Time: 15/09/2019 11:21 AM
 

➡ To check/test, clear Kaspersky application reports, open a Protected / SafeMoney browser, recheck reports

•  Reports & Quarantine - Clear

To clear Kaspersky application Reports, select Settings⚙ , Additional, Reports & Quarantine, select Clear. 

⚠ If "Suspicious action was blocked" events are logged, when SafeMoney or Protected browser is not active, please post back?⚠

Thank you🙏.