So suddenly, after an update - Avast Blocked A Vuln. Driver: WinRing0x64.sys

[jamesmilton]

This is beyond annoying as its used by Notebook Fan Control to control the fan on my ASUS laptop.



This is the only fan program that works on it....

Have tried doing whats suggested and disabling "Block Vulnerable Kernel Drivers", but seems its reverted on every reboot?

This is the pits Avast....why?

This has been working fine FOR YEARS

When will update day not also mean "break something thats worked for years day"

[Rundvleeskroket]

Have you tried to add an exception for the .sys file?

Also see if there is a newer version of the Asus software for your laptop. Maybe that fixes the vulnerability (unlikely but worth a shot).

[Spec8472]

Hello jamesmilton,

this driver is indeed vulnerable: https://nvd.nist.gov/vuln/detail/CVE-2020-14979
Any malware running under any user account (even non admin) can connect to this driver (if loaded) and control whole system from kernel. There is no option to exclude single driver, but you can disable vulnerable driver blocking completely.

[Spec8472]

The revert of the "Block vulnerable kernel drivers" setting on reboot is not reproducible, can you please provide a support package?

https://support.avast.com/en-us/article/submit-support-file/#pc

[Wizzzzard]

I also had the same issue with this driver but with a different app "Real Temp" I have been running this app for many years

I spent so many hours and multiple attempts to system restore in order to try and fix or figure out what was causing the error
 message that was appearing on startup "Driver not loaded try run as administrator". It would have been nice if Avast had of displayed a popup to notify me of an issue! It was only when I tried to run the program once windows was loaded did I get an Avast popup and discover what was causing the error.

If your going to add a new driver block like this to your anti virus then please make sure that your app gives the user an Avast warning about it on startup, so that they like myself don't have to spend hours trying to discover what is causing the error. Thanks.

Not good enough Avast!

[Nilom]

I have this problem aswell.

It worked for over a year. Then you update Avast and my system is a messy piece of shit now. Thanks that's what I pay premium security for.

Just block access to random files and don't allow us to whitelist programs that use these files. A great idea.

Also I want to note that the popup is completely buggy.

[gio8585]

Same. Fan control software blocked. Any attempt to add the .sys file to exceptions doesn't work. Sometimes the PC is literally unusuable because I can't even click anywhere outside the Avast warning window. If this is not solved in AT MOST two days, I'm uninstalling Avast for good. This is unacceptable.

[DavidR]

Has anyone run the support package as requested ?

The revert of the "Block vulnerable kernel drivers" setting on reboot is not reproducible, can you please provide a support package?

https://support.avast.com/en-us/article/submit-support-file/#pc

[Dimpie]

Any fix yet for "real temp" ? ... this pop-up (without ANY real info is so annoying

[AvangionQ]

I got a similar problem with an MSI Gaming driver:

https://i.ibb.co/v1Nn50v/Avast-vs-MSI-gaming-vulnerable-driver-modapi-sys.png

[xraiderv18]

literally had this start popping up again for winring, which WAS a signal rgb driver. couldn't get it to run back in february because this driver was blocked. left it, now the alert is back, on EVERY SINGLE reboot....literally.

[Omar23]

SAME SHIT HAPPENING  HERE< EVERY SINGE REBOOT! Fix this AVAST!

[bob3160]

SAME SHIT HAPPENING  HERE< EVERY SINGE REBOOT! Fix this AVAST!

https://forum.avast.com/index.php?topic=322571.msg1700924#msg1700924

[DavidR]

SAME SHIT HAPPENING  HERE< EVERY SINGE REBOOT! Fix this AVAST!

https://forum.avast.com/index.php?topic=322571.msg1700924#msg1700924

I guess people don't bother reading what has been posted or requested.

We don't even know if this is the same driver, as this would have been detected earlier.
Given the topic was started in February about "Avast Blocked A Vulnerable Driver: WinRing0x64.sys"

[Jim85]

Newly installed Avast last night, but on repeated boot ups of my pc produce this same error with no description of what program is involved so Im attempting a search for the file. winring.  Every google search says its crypto currency trojan.  Ive got Trojan killer working as well as Malwarebytes but soo far nothing is produced. Only Avast is picking it up but no description or log describes what program or where this sys file is.