Windows Defender has flagged HackTool:Win32/Winring0 as a virus #3017
Replies: 23 comments 23 replies
|
same for me. with the same questions |
|
Detected: HackTool:Win32/Winring0 This program has potentially unwanted behavior. Affected items: |
|
So, I'm not the developer of FanControl, but I am a developer of another tool that also uses the same Hardware control library, i.e. LibreHardwareMonitor. And today I am presented with the message I have allowed it as an Exception personally. |
|
The reason is because WinRing0 or WinRing0x64 (same drivers), is vulnerable to dll or driver hijacking (don't remember which one) so Windows flags it because it can be used to gain kernel level access and persistence. So if an app is using that driver it has a high chance of being flagged |
lmao but no that's not the main concern with it haha, wish it was tho would be funny. But this allows threat actors to gain kernel level access of everything and with that they can do pretty much whatever. 😔 |
If the door is open, the intruder will not only take the door mat. |
Then it does not apply to you lol but just explaining why it got flagged |
|
I also received this threat just now. Seems a lot of us got hit within the same hour. Is that concerning? |
|
I'm here for the same issue. My file is: |
|
More info: https://www.reddit.com/r/FanControl/ |
|
I'm here for the same issue. My file is: No matter how much you quarantine the file or remove it, it will exit again after 5 seconds. I tried to delete the folder where it is located but it does not allow me to do so because it is being used |
|
I wrote a PowerShell Script to monitor Hardware Sensors using Datto-RMM and Libre Hardware Monitor, my file is "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.sys" |
|
Apparently malwarebytes doesnt detect it but windows does. Sounds like windows pushed an update thats fucking it up. https://www.reddit.com/r/techsupport/comments/1j8jrs8/hack_tool_win32winring0/ |
|
I've got the same alert and all the sensors were out of whack in fancontrol. the alert disappeared when i closed the software. |
It is not a false positive. Defender flagged it for a valid reason. The comment by the author of FanControl with the latest release baffles me. "Ostrich politics" at the very least. As long as Winring0 is part of the package you are definitely more vulnerable. I have removed FanControl from my systems and won't consider a reinstall before the vulnerability has been addressed. |
|
@Sciolto66 had to make some kind of message because I was getting swarmed with the same message over and over. As far as the head in the sand, you can call it that, but then the whole project from the very beginning has been using that driver, there's nothing new here. It's basically because this driver even exists that a project like LHM is possible, which then enables FanControl. I understand the reason for your frustration if you feel like you were misinformed, but I can't just create a new signed kernel driver out of thin air. It's more complicated than you might think. Now if this is part communication issue, that I can do something about immediately. I may for example add some kind of warning next to the LHM sensor source in the software, informing that WinRing0 will be installed if LHM is enabled. |
|
It is NOT a false positive, its a valid positive! WinRing0 is extremely unsecure - https://www.youtube.com/watch?v=H_O5JtBqODA |
|
I took the time to make a write up an explanation w/ sources of the WinRing0 vulnerability and how it impacts Fan Control on Reddit: You can also just read my sources directly: https://medium.com/@matterpreter/cve-2020-14979-local-privilege-escalation-in-evga-precisionx1-cf63c6b95896 |
|
Good reddit article thanks. |
|
Also having Windows defender detecting this software as a hack recently. Had to tell it to ignore for it to work. Issue might be on Microsofts end who knows at this point:
|
|
I came across this article regarding a Defender content release, specific to HackTool:Win32/Winring0 |
|
My Win Defender flagged "HackTool:Win32/Winring0" as High Threat this morning. Researching it lead me to this thread - good read. The only difference in my situation is the offending file is "OpenHardwareMonitorLib.sys" not "FanControl.sys". Looks like "OpenHardwareMonitorLib.sys" is only used to monitor hw ... but if it uses Winring0 then it has the potential to manipulate in kernel space. If either of these *.sys are Quarantined, will this cause any computer hardware damage if it's a needed file? Research suggests it's not used by Windows11 so should be no impact. Properties of "OpenHardwareMonitorLib.sys" says Embedded Signatures: Noriyuki MIYAZAKI 2008 but the file was created 2025Feb18 which is more recent than the other files in the same folder. Thx. |
|
I do not use FanControl at all but I just got this error today and this site was among the first results that came back. Mine is in C:\Windows\system32\Drivers\WinRing0x64.sys (Created/modified May 2024) |
|
Windows warned me about it just now. I dont use FanControl either unless hits baked into Omen bloatware. This is where mine was located: "file: C:\WINDOWS\system32\Drivers\WinRing0x64.sys" pretty general location. I have not noticed any hard use of my GPU or CPU so I dont think I was being used for mining but idk. |
|
Thank you all for your comments. I experienced a very similar issue, which for us, was related to the file: "OpenHardwareMonitorLib.sys." This began to occur on the morning of 3/11/2025 Antispyware Version: 1.423.263.0 Thank you. |
|
From my understanding, the volnerability was found a few years ago at least, Microsoft said we are gonna flag it in future updates but gave people enough time to update. Now Microsoft has finally added it to defender. This means that as long as you have winring0, there is a greator risk if you got malware on your computer. Its always been a risk, Microsoft Security is just now acknowleging its risk. |
|
It is NOT a false positive, its a valid positive! WinRing0 is extremely unsecure. In a nutshell the driver is running at Ringbus 0, the same level as the windows kernal and has been exploited multiple times over the years. |
|
Hi All, Yes, WinRing0 and it's derivitives are a potential security issue and it's been known for YEARS this is the case. At this time there is no other way for an application (even with admin rights) to be able to interface with hardware directly. The way that Windows has evolved from Windows XP to Windows 11 now means that drivers which validated my Microsoft and digitally signed won't have Ring0 or direct hardware access. Many apps use WinRing0 not just FanControl and LibreHardware Monitor. Even commercial applications from major PC hardware OEM's used it. That's why Microsoft hasn't blocked it earlier. Apparently the makers of OCCT (OCBase) are working on a more secure driver which they are hoping will be digitally signed so that it can be used going forward under Windows 11 with it's enhanced security. Please see the recent YouTube Episodes on the Gamers Nexus Channel and the OCBASE channel for more information, if you need it. KInd Regards Simon Zerafa |
|
This one sums it up pretty much. — Many programs use it; the user is the one deciding if he is okay with that risk or not. Though, nothing changed, it has always been that way with WinRing0. — It’s not a direct threat like being infected or you've gotten hacked, but more like having a backdoor that could be used by bad actors and makes it easier for those. In theory, it’s a very good thing that Windows is trying to get rid of software with access lower than layer 2-3. BUT at the very least, Microsoft should properly implement an API for monitoring tools (and other cases where needed) so people don’t have to develop software like this, let alone so many others relying on it. — The WinRing0 developer discontinued this software in 2010 with a statement along the lines of "This software was a mistake and shouldn’t exist in this day and age anymore."
|
|
So, the question is: |
|
Hi, Risk assessments are personal, what are the risks and their frequency and severity and consequences? For myself I would exclude the folder that you've installed FanControl within Microsoft/Windows Defender. Make a note that that folder is marked as such in your documentation 😉 Hopefully OCCT will eventually come through with a community signed driver which others can use that won't give Defender spasms of distress. It's not just FanControl which uses this driver or it's variations so if you stop using all of them then quite a few apps will stop working. Kind Regards Simon Zerafa |
|
How do you uninstall this software. It is not in the list of program under settings. When I search for the program, the only place I see it listed in the download folder created when I installed it. But it doesn't contain an executable. Did I install something that has permanently welded into my machine? I am not a programmer. I installed this thinking it would be a benefit. It has become a curse. I want it off! |
|
I highly recommend Revo Uninstaller for anything and everything you remove from your PC. It is amazing. |
|
Yes, used it about a year ago. Then it wanted an annual subscription. I don't uninstall that many programs to justify the cost. How can I uninstall the fan control, if it is not in the program list? |
|
The readme has an uninstall section. |
|
FYI: I got this as well: 
|
|
Openhardwaremonitor is not the same software as librehardwaremonitor used by fancontrol |
|
Is this still an issue with latest versions? |
|
They removed WinRing0 in V239 and replaced it with PawnIO so the issue should be fixed. |
Same issue. My battery was dying so fast, like there was a massive process running behind the scenes |
|
Your fan control must be outdated. |
|
You seem to be in the wrong repository or have your installation named incorrectly. Is this what you use ?: If this is FanControl (this repo) you will have to update. |
and others
Uh oh!
There was an error while loading. Please reload this page.
This is in my Summary:
Located @ C:\Program Files (x86)\FanControl\FanControl.sys
Do I make an exception, do I quarantine? Ignore?
All reactions