Some months ago Auto Protect startet to tell me right after logging into the Windows 10 PC that access to c:\windows\pe_rom.dll has been blocked - as this file is a virus thread. I started to look for this file but could not find it at that location or elsewhere. Then I installed a batch file listing files of this name into a text file right after login: the text file always shows that no such file exists.
The question on the table is: where does this alert come from? What does Auto Protect check? I have a vague guess that a program launched after login (auto start, run once etc) tries to access this file and this is recorded by Auto Protect. But in this case it would be of great help if Auto Protect shows this program trying to access pe_rom.dll as this might be a nice-looking software which in fact tries to start something viral and should be removed therefore.