Sophos Client Firewall: 'Memory Modified' reported as the reason for blocking an application

Issue
An application is blocked by Sophos Client Firewall with the message ‘Modified Memory’.
NOTE: modified memory detection only applies on 32-bit platforms. It is not supported on 64-bit platforms.

Sophos product and version
Sophos Client Firewall

Operating system
Windows 2000 Professional, Windows XP, Vista and Windows 7
This is not supported on server operating systems.

Technical information
By default the Sophos Client Firewall will block applications that have had their process memory modified by another application.

What to do

1. In the system tray, right-click on the Sophos Client Firewall icon and select View Log.
2. Open the Processes folder.
3. Check the most recently blocked application, or a time that correlates with the last time the blocked application ran.
4. The 'Event' column should state 'Memory Modified'. If this is the case, close the Log.
5. In the system tray, right-click on the Sophos Client Firewall icon and select Configure.
6. Deselect the option ‘Block processes if memory is modified by another application’.

Note: Disabling this feature will not compromise the endpoint protection level when suspicious behaviour has been enabled in Sophos Anti-Virus.