Avast One Blocked a vulnerable drive - on every reboot

[HnyBear]

This has been happening for some time on every reboot. I can't seem to find out what it is or how to get rid of it as the file it points to is never there. The name is always tmp?.tmp the numbers and letters in it are different every time but the tmp part stays the same. I'm on Windows 11 with latest version of Avast One. Any help is very much appreciated.

[HnyBear]

/bump

[Myroslav Sidorov]

/bump

[Pondus]

you may Delete Your Temporary Files In Windows 11  https://www.youtube.com/watch?v=ZKKL9EHuaWI&t=65s

[Myroslav Sidorov]

I've found a way to identify the driver.

Event Viewer -> Windows Logs -> System:

Code: [Select]

Information / Service Control Manager / 7045
In my case it was:

Code: [Select]

A service was installed in the system.

Service Name:  WinRing0_1_2_0
Service File Name:  C:\Users\[username]\AppData\Local\Temp\tmp6FE0.tmp
Service Type:  kernel mode driver
Service Start Type:  demand start
Service Account: 


[Myroslav Sidorov]

If you are interested, then

I've temporarily disabled (unchecked) "Block vulnerable kernel drivers" in Avast -> Menu -> Settings -> General -> Troubleshooting -> Enable Self-Defence (to prevent blocking of the vulnerable driver).

And I've found the Software which uses this driver via Process Explorer (File -> Show Details for All Processes) -> Find -> Find Handle or DLL (Ctrl+F) -> in "Handle or DLL substring" typed "WinRing" -> Search


In my case it was PCMeterV0.4.exe which is extension for Windows 7 Gadgets "All CPU Meter" / "GPU Meter" (uses file "\Device\WinRing0_1_2_0").

And this is pretty logical that this software tries to get access to hardware via kernel drivers to monitor the states of the CPU/GPU which could be identified as mining software...

Next step, I'm planning to play with the check boxes in PCMeter settings, to partially disable it or I'll remove PCMeter in case if nothing help.

[Myroslav Sidorov]

• Removed PCMeter (as I don't need to monitor CPU frequency in realtime, percentage by core/thread is enough for me);
• Enabled back "Block vulnerable kernel drivers" in Avast;
• Restarted PC;
• Avast Alert is gone;
• PROFIT