Author Topic: So suddenly, after an update - Avast Blocked A Vuln. Driver: WinRing0x64.sys  (Read 22322 times)

0 Members and 1 Guest are viewing this topic.

Offline jamesmilton

  • Newbie
  • *
  • Posts: 1
This is beyond annoying as its used by Notebook Fan Control to control the fan on my ASUS laptop.



This is the only fan program that works on it....

Have tried doing whats suggested and disabling "Block Vulnerable Kernel Drivers", but seems its reverted on every reboot?

This is the pits Avast....why?

This has been working fine FOR YEARS

When will update day not also mean "break something thats worked for years day"
« Last Edit: February 09, 2023, 06:19:19 AM by jamesmilton »

Offline Rundvleeskroket

  • Poster
  • *
  • Posts: 508
Have you tried to add an exception for the .sys file?

Also see if there is a newer version of the Asus software for your laptop. Maybe that fixes the vulnerability (unlikely but worth a shot).

Offline Spec8472

  • Avast team
  • Sr. Member
  • *
  • Posts: 297
Hello jamesmilton,

this driver is indeed vulnerable: https://nvd.nist.gov/vuln/detail/CVE-2020-14979
Any malware running under any user account (even non admin) can connect to this driver (if loaded) and control whole system from kernel. There is no option to exclude single driver, but you can disable vulnerable driver blocking completely.

Offline Spec8472

  • Avast team
  • Sr. Member
  • *
  • Posts: 297
The revert of the "Block vulnerable kernel drivers" setting on reboot is not reproducible, can you please provide a support package?

https://support.avast.com/en-us/article/submit-support-file/#pc

Offline Wizzzzard

  • Newbie
  • *
  • Posts: 4
I also had the same issue with this driver but with a different app "Real Temp" I have been running this app for many years

I spent so many hours and multiple attempts to system restore in order to try and fix or figure out what was causing the error
 message that was appearing on startup "Driver not loaded try run as administrator". It would have been nice if Avast had of displayed a popup to notify me of an issue! It was only when I tried to run the program once windows was loaded did I get an Avast popup and discover what was causing the error.

If your going to add a new driver block like this to your anti virus then please make sure that your app gives the user an Avast warning about it on startup, so that they like myself don't have to spend hours trying to discover what is causing the error. Thanks.

Not good enough Avast!


« Last Edit: February 19, 2023, 02:37:58 AM by Wizzzzard »

Offline Nilom

  • Newbie
  • *
  • Posts: 2
I have this problem aswell.

It worked for over a year. Then you update Avast and my system is a messy piece of shit now. Thanks that's what I pay premium security for.

Just block access to random files and don't allow us to whitelist programs that use these files. A great idea.

Also I want to note that the popup is completely buggy.


Offline gio8585

  • Newbie
  • *
  • Posts: 1
Same. Fan control software blocked. Any attempt to add the .sys file to exceptions doesn't work. Sometimes the PC is literally unusuable because I can't even click anywhere outside the Avast warning window. If this is not solved in AT MOST two days, I'm uninstalling Avast for good. This is unacceptable.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88773
  • No support PMs thanks
Has anyone run the support package as requested ?

The revert of the "Block vulnerable kernel drivers" setting on reboot is not reproducible, can you please provide a support package?

https://support.avast.com/en-us/article/submit-support-file/#pc
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.1.6099 (build 24.1.8821.762) UI 1.0.796/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Dimpie

  • Newbie
  • *
  • Posts: 7
Any fix yet for "real temp" ? ... this pop-up (without ANY real info is so annoying :(

Offline AvangionQ

  • Newbie
  • *
  • Posts: 1

Offline xraiderv18

  • revival specialist -destiny
  • Jr. Member
  • **
  • Posts: 79
  • when the going gets tough..bring a shotgun.
literally had this start popping up again for winring, which WAS a signal rgb driver. couldn't get it to run back in february because this driver was blocked. left it, now the alert is back, on EVERY SINGLE reboot....literally.
freedom is the right of all sentient beings -optimus prime, transformers 2007
-------
just because you dont see a problem, that does not mean it doesn't exist. keep an open mind.
-------
momma didn't raise no door mat.

Offline Omar23

  • Newbie
  • *
  • Posts: 1
SAME SHIT HAPPENING  HERE< EVERY SINGE REBOOT! Fix this AVAST!

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48468
  • 63 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v22H2 64bit, 16 Gig Ram, 1TB SSD, Avast Free 23.5.6066, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88773
  • No support PMs thanks
SAME SHIT HAPPENING  HERE< EVERY SINGE REBOOT! Fix this AVAST!
https://forum.avast.com/index.php?topic=322571.msg1700924#msg1700924

I guess people don't bother reading what has been posted or requested.

We don't even know if this is the same driver, as this would have been detected earlier.
Given the topic was started in February about "Avast Blocked A Vulnerable Driver: WinRing0x64.sys"
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.1.6099 (build 24.1.8821.762) UI 1.0.796/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Jim85

  • Newbie
  • *
  • Posts: 1
Newly installed Avast last night, but on repeated boot ups of my pc produce this same error with no description of what program is involved so Im attempting a search for the file. winring.  Every google search says its crypto currency trojan.  Ive got Trojan killer working as well as Malwarebytes but soo far nothing is produced. Only Avast is picking it up but no description or log describes what program or where this sys file is.