Windows security mitigations blocking multiple apps

Question

Hello, As of a couple days ago, the steamwebhelper.exe was getting suspended by windows defender. A simple restart of steam would allow me to quickly open a game before it was suspended again (typically 30 seconds). Ive noticed it only happens when something is downloading. Digging through forums I've tried everything recommended (whitelisting the .exe in windows defender, adding to exclusions, running as admin, deleting cef.win64 and cef.win7x64 as well as the webhelper app, disabling gpu acceleration, disabling web browser sandbox, uninstalling and reinstalling steam, and verifying windows, re-installing windows). (current event viewer error:

"Process '\Device\HarddiskVolume7\steam\bin\cef\cef.win64\steamwebhelper.exe' (PID xxxxx) was blocked from making system calls to Win32k.sys." Im not sure what to try at this point, any help is appreciated, and no i dont have any ASUS software on my pc as it seems that was a common cause.

It is now also blocking Razer apps and Opera GX. Please help as i can barely use any apps.

Windows version: 25H2, OS Build: 26200.8655

Hardware:

CPU- Ryzen 5 7600x

Motherboard- Asrock B650E PG Riptide

RAM- 32gb teamgroup DDR5

GPU- MSI Radeon RX 6950XT

Storage- 1 Samsung 970 EVO Plus 2TB, 2 Samsung 980 Pros

Answer 1

Hi Danny Devito,

I understand how disruptive it can be when several apps are blocked at the same time. Based on the behavior, this may be related to a Windows Security protection setting, such as Exploit protection, Smart App Control, or a policy-managed security rule under App & browser control.

Please try these targeted checks to narrow it down:

1. Open Windows Security > App & browser control > Exploit protection settings.
2. Go to Program settings and check whether the affected apps have custom mitigation rules.
   • If custom rules exist, change them back to Use default or remove the app-specific entry.
3. In System settings, confirm Control flow guard (CFG) is set to Use default (On), as this setting is specifically referenced in Microsoft app troubleshooting guidance.
4. Check Event Viewer > Applications and Services Logs > Microsoft > Windows > Security-Mitigations to identify the exact block event or mitigation name.
   • If you can share the event ID or mitigation name from Event Viewer, we can narrow this down further.

If this is a work or school device, some of these settings may be enforced by your organization through security policy, so you may need to contact your IT administrator if the options are unavailable or keep reverting.

I would not recommend disabling Windows Security completely. A safer approach is to identify the specific mitigation causing the block and adjust only that affected app rule.

Let me know if you need further assistance, feel free to ask me by clicking "Add Comment" or "Add Answer" if you cannot add comment so your response will be visible. Thanks for your effort.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

The behavior matches Windows security features blocking or restricting apps that are considered vulnerable or potentially unwanted, especially gaming‑related helpers and vendor utilities.

Try the following steps in order, testing after each.

1. Check for vulnerable or blocked drivers/apps Some gaming and hardware tools (monitoring, RGB, overclocking, etc.) are known to be blocked by Microsoft Defender because of vulnerable drivers (for example, WinRing0). This can affect multiple apps.

If any of these, or similar tools, are installed (even older or “leftover” versions), temporarily uninstall or fully update them:

• CapFrameX
• EVGA Precision X1 (older versions)
• FanCtrl
• HWiNFO
• Libre Hardware Monitor
• MSI Afterburner
• Open Hardware Monitor
• OpenRGB
• OmenMon
• Panorama9
• SteelSeries Engine
• ZenTimings

After uninstalling or updating, restart Windows and test Steam, Razer, and Opera GX again.

2. Use Defender exclusions only as a temporary workaround If a specific app is being blocked by Microsoft Defender Antivirus due to a vulnerable driver or similar, a temporary workaround is to add an exclusion. This reduces protection and should be used only if the app is trusted and while working on a permanent fix.

To add an exclusion in Microsoft Defender Antivirus:

1. Select Start > Settings > Privacy & security > Windows Security.
2. Select Virus & threat protection.
3. Under Virus & threat protection settings, select Manage settings.
4. Scroll to Exclusions and select Add or remove exclusions.
5. Select Add an exclusion, then choose the affected file or folder (for example, the Steam, Razer, or Opera GX install folder).

Warning: This workaround may make the computer more vulnerable to attack. Use at own risk and remove the exclusion once the underlying issue is resolved.

3. Check reputation‑based protection / PUA blocking Steam helpers, browser components, or vendor utilities can sometimes be flagged as potentially unwanted applications (PUA), especially after updates.

To check and adjust PUA/reputation‑based protection:

1. Open the Windows Security app.
2. Go to App & browser control.
3. Select Reputation-based protection.
4. Review settings such as Potentially unwanted app blocking and other reputation‑based options.
   • If these were recently turned on or tightened, temporarily relax them and test the affected apps.

Note: On managed or domain‑joined devices, these options may be locked by policy.

4. Review exploit protection settings The event log message about blocking system calls to Win32k.sys can be related to exploit protection or other advanced mitigations.

To review exploit protection:

1. Open Windows Security.
2. Select App & browser control > Exploit protection.
3. Check if there are any Program settings overrides for Steam, Razer, or Opera GX executables.
   • If custom rules were added (manually or by a security tool), reset them to default for those apps.

Exploit protection is on by default and normally safe; only change per‑app overrides that were added.

5. Check for Windows 11 gaming security features impact On Windows 11, features like memory integrity (HVCI) and Virtual Machine Platform (VMP) can impact gaming and some helper processes.

For testing only (with awareness of increased risk):

Turn off memory integrity

1. Select Start, type Core Isolation, and open Core Isolation in Windows Security.
2. Turn off Memory integrity and restart.

Turn off Virtual Machine Platform (VMP)

1. Select Start, type Windows features, and open Turn Windows features on or off.
2. Clear Virtual Machine Platform.
3. Select OK and restart.

If this resolves the issue, re‑enable these features after updating drivers and affected apps to see if the problem stays fixed.

6. Run the Windows Security troubleshooter (Windows 10 only) If the device were on Windows 10, the Windows Security troubleshooter could automatically check and fix some security feature misconfigurations (UAC, DEP, firewall, AV status). For Windows 11 this specific troubleshooter is not applicable, but the concept is similar: ensure core security features are in a healthy state.
7. If multiple apps remain blocked If, after:

• Removing or updating any gaming/monitoring tools that use low‑level drivers,
• Checking PUA/reputation‑based protection,
• Reviewing exploit protection overrides,
• Testing with memory integrity/VMP temporarily off,

the issue persists across Steam, Razer, and Opera GX, collect:

• Exact Defender or Windows Security notifications (threat name, category, path).
• Relevant Event Viewer entries from Windows Logs > System and Applications and Services Logs > Microsoft > Windows > Windows Defender.

Then contact Microsoft support or the affected app vendors with those details, as this may be a regression or compatibility issue specific to build 26200.8655.

---

References:

• Microsoft Defender Antivirus alert - VulnerableDriver:WinNT/Winring0
• Potentially unwanted apps are blocked by default
• App & browser control in the Windows Security App
• Options to optimize gaming performance in Windows 11
• Automatically fix Windows security issues