So suddenly, after an update - Avast Blocked A Vuln. Driver: WinRing0x64.sys

[DavidR]

Have you read some of the replies above your post as it refers to a vulnerable driver that can be exploited.  Not that it is being exploited and why you aren't getting anything from Trojan killer and Malwarebytes. Not it isn't advisable to run multiple AVs as they can also conflict.

[Leo3487]

Not it isn't advisable to run multiple AVs as they can also conflict.

Trojan Killer is a portable AV, to run on demand, and Malwarebytes free version also is on demand

[DavidR]

Not it isn't advisable to run multiple AVs as they can also conflict.

Trojan Killer is a portable AV, to run on demand, and Malwarebytes free version also is on demand

That's fine, we do see some that have multiple active AVs, where more isn't necessarily better.

[HnyBear]

Figure I'd post here as I can't get any help on my own post. Maybe someone will see this and have some ideas.

This has been happening for some time on every reboot. I can't seem to find out what it is or how to get rid of it as the file it points to is never there. The name is always tmp?.tmp the numbers and letters in it are different every time but the tmp part stays the same. I'm on Windows 11 with latest version of Avast One Essential. Any help is very much appreciated.

These pics are old from my old post that's why the dates are so old. Everything is up to date including OS and all drivers.

[Pondus]

Is Your win11 updated / or try to update ?

[HnyBear]

Is Your win11 updated / or try to update ?

Yes, full updated. Those are old pics from my old post no one ever responded to.

Current Winver 22H2 (OS Build 22621.3155)

[bob3160]

What exactly is it that's blocked and have you reported it to Avast as a possible false positive?

Report a false positive (select file or website)
https://www.avast.com/false-positive-file-form.php

[HnyBear]

What exactly is it that's blocked and have you reported it to Avast as a possible false positive?

Report a false positive (select file or website)
https://www.avast.com/false-positive-file-form.php

That's the thing, I have no idea what is blocked. It's a random name on every reboot of some *.tmp file that isn't even a driver.

[Silviu2]

hello: 1,run a full system scan,if something is detected remove last but not list,update to windows 11 23H2 have a good ivning

[DavidR]

What exactly is it that's blocked and have you reported it to Avast as a possible false positive?

Report a false positive (select file or website)
https://www.avast.com/false-positive-file-form.php

That's the thing, I have no idea what is blocked. It's a random name on every reboot of some *.tmp file that isn't even a driver.

Then what is blocked results in a screen an alert then take a screen capture and select the see Details in the alert, that should show what is responsible for running that .tmp file.  That could be an important clue.

Update after your post - if this resolve it good - if not do as suggested above "take a screen capture and select the see Details in the alert" and attach it here.

[bob3160]

What exactly is it that's blocked and have you reported it to Avast as a possible false positive?

Report a false positive (select file or website)
https://www.avast.com/false-positive-file-form.php

That's the thing, I have no idea what is blocked. It's a random name on every reboot of some *.tmp file that isn't even a driver.

Send logs to Avast by opening Menu > Settings > Troubleshooting > Send logs to ......


You can include a link to this thread in your report and post the reference number here.

[HnyBear]

]Send logs to Avast by opening Menu > Settings > Troubleshooting > Send logs to ......


You can include a link to this thread in your report and post the reference number here.

Thank you. Doing that now.

[GregorJan]

[Question to devs]
Can you add an option to the settings to add a specific driver file to exceptions so that Avast doesn't cause such problems?
https://github.com/Rem0o/FanControl.Releases/issues/1521

[bob3160]

[Question to devs]
Can you add an option to the settings to add a specific driver file to exceptions so that Avast doesn't cause such problems?
https://github.com/Rem0o/FanControl.Releases/issues/1521

You have that option at the time the item is detected.
I personally would send it in for analysis and wait and see if I get a response or, it's removed from detection.
Your computer, your choice.

[GregorJan]

[Question to devs]
Can you add an option to the settings to add a specific driver file to exceptions so that Avast doesn't cause such problems?
https://github.com/Rem0o/FanControl.Releases/issues/1521

You have that option at the time the item is detected.
I personally would send it in for analysis and wait and see if I get a response or, it's removed from detection.
Your computer, your choice.

Yes, but this exceptions doesn't work for this function.
I disabled blocking unprotected kernel drivers, added the driver file to exceptions, enabled blocking again, restarted the app and still got blocked by Avast.