Newest update is being flaged as trojan

[SPGesus]

If you are experiencing a crash

Describe the bug
Updated to the latest version (automatically) and it's being marked as a trojan

[unknownpedestrian]

known issue, is with librehardware monitor

a core component of fan control that uses WINRING 0

it itself is not a virus and can be allowed on the system, but any program that uses Winring 0 gets flagged as a virus in the latest windows updates, due to a zero day vuln that attackers can use to execute unsigned programs in memory

this is detailed here apon setup of fancontrol

but don't take my word for it, even windows itself is calling this a vuln driver, not exactly a Trojan

[sMiNT0S]

It is categorized as a trojan, but thats before putting it in quarantine. If windows threw an update with zero day vulns on winring0 kernel it makes sense this gets flagged now.

[unknownpedestrian]

It is categorized as a trojan, but thats before putting it in quarantine. If windows threw an update with zero day vulns on winring0 kernel it makes sense this gets flagged now.

O interestesting, I guess mine got put into quarantine so fast that I didn't notice that windows was calling it a trojan

still though don't just take my word for it, do your own research

[unknownpedestrian]

if you wanna keep tabs on this you can follow dis issue

LibreHardwareMonitor/LibreHardwareMonitor#1839 (comment)

there is also this
LibreHardwareMonitor/LibreHardwareMonitor#984

the first one seems like a duplicate after further inspection

(you can also run the file in virustotal if you don't trust it)

[DKlaper]

I think this will cause quite some confusion. I only got a notification from Fan Control that my configuration was wrong. I already half panicked that my AIO died or my motherboard is broken xD.
Funny thing is I did not get an alert at all, Windows Security was like all good, all green! but then when I go into protection history I see it's blocked as you 2 described above... allowing it and restarting fan control fixed my issue of not getting my normal config.

[vuldin]

I'm running into this same issue. What is the resolution if Windows has quarantined these files? I tried reinstalling FanControl but the same problem persists.

[vuldin]

It looks like Windows won't let me restore the file:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -Name "VulnerableDriver:WinNT/Winring0.G"
Restoring the following quarantined items:

ThreatName = VulnerableDriver:WinNT/Winring0.G
   ERROR - file:C:\Users\hello\FanControl\FanControl.sys quarantined at 9/3/2025 10:07:24 AM (UTC) cannot be restored. Error code = 0x80508014
   ERROR - driver:R0FanControl quarantined at 9/3/2025 10:07:24 AM (UTC) cannot be restored. Error code = 0x80508014
CmdTool: Failed with hr = 0x80508014. Check C:\Users\hello\AppData\Local\Temp\MpCmdRun.log for more information

C:\Windows\System32>notepad C:\Users\hello\AppData\Local\Temp\MpCmdRun.log

The log doesn't give any additional info on why:

-------------------------------------------------------------------------------------
MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe"  -Restore -Name "VulnerableDriver:WinNT/Winring0.G"
 Start Time: ‎Wed ‎Sep ‎03 ‎2025 07:59:21

MpEnsureProcessMitigationPolicy(0x5): hr = 0x1
ERROR: MpQuarantineRequest failed: name: VulnerableDriver:WinNT/Winring0.G, GUID: {80071259-0000-0000-31FE-A5D82C093811} (0x80508014)
ERROR: QuarantineRestore failed (0x1)
MpCmdRun.exe: hr = 0x80508014.
MpCmdRun: End Time: ‎Wed ‎Sep ‎03 ‎2025 07:59:21
-------------------------------------------------------------------------------------

I guess I'm blocked from using FanControl from now on until Microsoft decides I can?