Jump to content

I recevied a lot notification "suspicious action was blocked" form kaspersky.

Recommended Posts

Hello. I recently received a lot notifications “suspicious action was blocker”. It showed my Pc memory from other processes. 

There are notifications these I got. 


Suspicious action was blocked 


Read memory from other processes


Host Process Windows Services or Windows Explorer

Application path 

C:\Windows\System32\schost.exe or C:\Windows\explorer.exe



I just want to ask. Is it a normal situation??



Link to comment
Share on other sites

Hello  @tom147527,


  • Was a "Protected" browser, & or SafeMoney browser active at the time the events were logged?

Kaspersky application reports "Suspicious action was blocked" events, for normal system processes when SafeMoney/Protected browser is active.

According to the Kaspersky Lab Technical Experts, this "known" issue, is not an issue, it is "by design", i.e. normal. 

(imo), this “normal” specific event should be documented, many folks have been concerned upon finding it in the Kaspersky application reports, sample as follows:

15.09.2019 11.21.36 Suspicious action was blocked WMI Provider Host Action: Read memory from other processes Application: WMI Provider Host Application path: C:\Windows\System32\wbem\WmiPrvSE.exe Time: 15/09/2019 11:21 AM

➡ To check/test, clear Kaspersky application reports, open a Protected / SafeMoney browser, recheck reports

To clear Kaspersky application Reports, select Settings⚙ , Additional, Reports & Quarantine, select Clear

⚠ If "Suspicious action was blocked" events are logged, when SafeMoney or Protected browser is not active, please post back?⚠

Thank you🙏.

Link to comment
Share on other sites

Please sign in to comment

You will be able to leave a comment after signing in

Sign In Now

  • Create New...