It's happened again. Same symptom, different "baddie". I took a screenshot at the time but seems I didn't save it. It was another Windows file (apparently) and again it was (apparently) trying to access the login data for the same user as before, a user not logged in. This time I blocked it. Although I don't have a screenshot, I (eventually) managed to find in Avast where the identity of the file was recorded: sdiagnhost.exe, in c:\windows\system32.
Can an Avast person please advise what is going on here? They might be Windows processes but they shouldn't be trying to access login data for a user not even logged in. Seems to me either something nasty is going on, or Avast is misinterpreting something benign. I can't think of another explanation.
Andy