[Update] FanControl (and other different monitoring software) blocked by Defender due to Winring0 vulnerability

[Chomiq]

FanControl tracked as virus by Windows Defender - HackTool:Win32/Winring0 · Issue #3016 · Rem0o/FanControl.Releases

If you are experiencing a crash Link the relevant/associated Windows EventViewer logs, and also FanControl's own log.txt. The R0FanControl service failed to start due to the following error: Operat...

github.com

Looks like a bunch of other monitoring software got affected by this after the latest Defender definition update.

Some detailed explanation:

https://www.reddit.com/r/FanControl/comments/1j93doq

So far confirmed for:
- FanControl
- Steelseries GG
- PBO2 Tuner
- Gigabyte Aurora and RGBFusion software
- Open Hardware Monitor
- Sidebar Diagnostics

Update:
Checked after work, it looks like MS has run some sort of background definition update and Defender is no longer flagging this as malicious. Here's hoping FanControl dev will actually work on switching to alternative library that doesn't use the unsigned driver.

Update 2:

 

[R-T-B]

Small nitpick but I believe WinRing0 IS a signed driver, just a vulnerable-to-exploit one precisely because it accesses low level hardware in ring0. Microsoft kinda frowns upon that as of late.

 

[Shihab]

First off, as a computer scientist it pains me to see people's knee jerk reaction is to override their operating system's security systems. It's there to protect you, yes it can make mistakes, but you should generally wait for an official response or similar understanding and you shouldn't do it blindly. Your security means nothing if you override your security when it's inconvenient.

It's kind of like taking the carbon monoxide alarm off the wall because you don't like that it's beeping super loudly.

Having this "pet peeve" and surfing tech forums/reddits is just begging for an aneurysm.

Small nitpick but I believe WinRing0 IS a signed driver, just a vulnerable-to-exploit one precisely because it accesses low level hardware in ring0. Microsoft kinda frowns upon that as of late.

Abstraction can be good. But abstraction without providing safe ways for controlled access under the hood to what should be accessible is just asking for people to start digging (most of the time their own graves).

Funny how, after years of strapping LEDs to everything within the 3m radius of a computer, no one figured perhaps they should have a standard way of accessing these things without *checks notes* giving everyone read/write access to the entire bloody memory!