- WinRing0 is a vulnerable driver used by many hardware monitoring and control apps, not a classic virus.
- Microsoft Defender flags it as a threat due to its ability to access the kernel deeply and potential for malware abuse.
- Users can choose to update or replace affected apps, or add exclusions in Defender at their own risk.
- The industry is moving towards more secure and signed drivers, although the transition is complex, especially for open projects.
If you're using Windows 10 or Windows 11 and you've suddenly received a Microsoft Defender alert about something called HackTool:Win32/WinRing0 or VulnerableDriver:WinNT/Winring0.G , it's understandable that you might be worried and think you have a serious Trojan on your PC. To make matters worse, your monitoring tools, fans, or RGB lighting may have suddenly stopped working.
The first thing you should know is that, in most cases, you're not dealing with a typical virus that infects files or encrypts your hard drive , but rather a driver with a known vulnerability that Windows has decided to aggressively block. This doesn't mean it's completely harmless, but it does significantly change how you approach it and decide whether it's worth keeping it active or not.
What is WinRing0 and why does Windows Defender detect it as a threat?
WinRing0 is a low-level hardware access driver that has been used for years in numerous PC monitoring and control applications. It's a library/driver that allows a program to communicate almost directly with the Windows kernel and certain motherboard components, bypassing many of the usual layers of protection.
Thanks to this deep access, WinRing0 has become very popular among third-party applications that need to read sensors, manage fan speeds, control RGB lighting, or fine-tune system parameters. It is one of the few free and open-source options that allow this kind of close interaction with the hardware.
The problem is that, in 2020, the WinRing0 driver was listed as a security vulnerability, CVE-2020-14979 . This vulnerability allows any application (even without administrator privileges) to request permission to read from or write to protected areas of system memory once the driver is loaded into the system, opening the door to privilege escalation or manipulation of critical processes.
For this reason, Microsoft has decided that unsigned or unsafe WinRing0 drivers will be marked in Defender as potentially dangerous software, appearing under detections such as Hacktool:Win32/Winring0 or VulnerableDriver:WinNT/Winring0.G. From a technical standpoint, the detection is legitimate: the driver has a real vulnerability and can be exploited by malware.
That doesn't mean your specific copy of WinRing0 is a virus, but rather that it has capabilities that malware could exploit . Hence the confusion: the same name is used by both the legitimate driver and certain threats that disguise themselves behind it to avoid detection.
Applications and tools that depend on WinRing0
One of the reasons this issue has generated so much buzz is that many popular applications rely on WinRing0 to function correctly. With the tightening of Microsoft Defender policies, these applications have all been affected by detections, blocks, and unusual behavior on users' PCs.
Among the most affected tools are numerous hardware monitoring programs, games, and RGB or fan management utilities. Various reports and testimonials mention, for example, CapFrameX, EVGA Precision X1 (older versions), FanCtrl, HWiNFO, Libre Hardware Monitor, MSI Afterburner, Open Hardware Monitor, OpenRGB, OmenMon, Panorama9, SteelSeries Engine, and ZenTimings , among many others.
Furthermore, some manufacturers' suites for managing peripherals and gaming equipment have used WinRing0 in the past. A real-world example seen in forums involves a user who had the driver integrated into a Razer Synapse app running in the background, preventing Windows Defender from removing it directly because the file was always marked as "in use."
In a different scenario, another user explained that WinRing0 was essential for an accessibility application that needed to temporarily disable dithering for visual health reasons. Without that driver, they literally couldn't use their laptop, and Defender would delete or block it without giving them the option to easily restore it.
All of this means that, suddenly, after an update to Defender's definitions, many users have found that their favorite tools stop starting up , their fans start spinning at maximum speed uncontrollably, or the RGB lighting is misconfigured, because the central driver that orchestrates all of this has been quarantined.
Real security risks: vulnerability vs. virus
It is important to clearly distinguish between concepts: WinRing0 is not ransomware or a typical banking trojan , but it is a vulnerable controller that can be exploited by malware to take control of the system more easily than should be allowed.
When loaded into the system, WinRing0 provides unrestricted access to protected resources . This allows any process to instruct the driver to read from or write to critical memory addresses, including areas where other processes, secrets, temporary passwords, or even internal Windows kernel structures reside.
From a security standpoint, this is especially concerning because it breaks one of the fundamental barriers protecting Windows : the separation between user space and kernel space. An exploit that abuses WinRing0 can bypass many of the usual defenses without needing to compromise the operating system itself.
That's why Microsoft has chosen to treat unsigned or vulnerable versions of WinRing0 as a "hacktool" or dangerous driver . And for the same reason, many experts recommend avoiding it whenever possible, or at least limiting its use to very specific and controlled situations, such as on lab machines or in environments where the risk is acceptable.
However, the fact that Defender flags WinRing0 doesn't automatically mean your passwords have been stolen, a keylogger installed, or your files encrypted . In most cases, the detection occurs because a legitimate application that was already installed uses that driver, and what has changed is Microsoft's criteria, not your behavior.
Why Windows is blocking it now, and what does CrowdStrike have to do with it?
Many people have wondered why, if WinRing0 has been vulnerable for years, Defender has only now begun blocking it so aggressively . There isn't a single definitive official answer, but there are several clues that help to understand the context.
On the one hand, Microsoft has been tightening its security policies for kernel drivers for some time . Following high-impact incidents such as the CrowdStrike vulnerability, which crippled systems worldwide due to a flaw in a security update, pressure has increased to limit what type of software can run with such deep privileges.
Furthermore, for several years now, Microsoft has required that drivers accessing the kernel be digitally signed using a specific kernel signing certificate. Obtaining this certificate requires being a recognized company and paying for the signature, incurring a recurring cost—something manageable for large companies but difficult for many open-source projects.
WinRing0, being a widely used open-source library , has received patches and improvements over time, but each new version must be reviewed and signed for Windows to consider it trustworthy. According to various developers, it has been patched several times in recent years, but the situation has become untenable if Microsoft decides to stop signing new versions or deems the driver's underlying philosophy too risky.
In fact, Microsoft itself has acknowledged being aware of reports about gaming and monitoring applications flagged as threats for using unsigned versions of WinRing0. While stating they are continuing their investigation, they have also clarified that Defender will continue to treat unsigned drivers as threats and that they are reviewing the detection logic to avoid false positives, without compromising long-term protection.
The impact on users: crazy fans, broken RGB lighting, and apps that won't launch
The most visible effect for the average user is that, overnight, many hardware control tools stop working . Defender detects WinRing0, quarantines or deletes it, and in doing so, it takes down a core part of those programs.
On some systems, as soon as WinRing0 disappears, the fans spin at full speed without regulation because the application that managed them can no longer communicate with the sensors or the motherboard controller. On others, the RGB lighting freezes or becomes unconfigured, or the affected apps simply close as soon as they open.
There are also cases of users who, upon seeing Defender's warning with alarming names like VulnerableDriver:WinNT/Winring0.G or Hacktool:Win32/WinRing0, have assumed their PC was compromised by a particularly sophisticated Trojan . Some have even considered reinstalling Windows from scratch for fear of remote access, keyloggers, and other such nightmares.
In a case reported in forums, a user saw a detection in a file linked to Razer software, tried to delete it, and Windows prevented him from doing so because it was "in use" by another program. Defender tried to delete it repeatedly without success. Only when he manually closed the related process from the Task Manager was the antivirus able to delete the file, and the problem disappeared.
In another case, after an apparent blocked remote access attempt, a user encountered the detection of WinRing0 and suspected a high-level Trojan. They booted their computer in safe mode and ran a full scan , even seriously considering formatting the system. While caution is always advisable in such cases, it wasn't necessarily necessary to go to that extreme if the actual source was a driver for a well-known tool.
Options for continuing to use your programs: exclusions and alternatives
If you absolutely need any of the affected applications (for example, an advanced monitoring tool, a fan controller, RGB software, or even a critical accessibility app), you have several options, each with its own implications. There's no perfect solution , but rather different ways to balance risk and convenience.
The first option is to look for updates to the application itself . Some developers have started releasing new versions that do away with WinRing0 or replace it with a proprietary or different driver, although in many cases this involves months of work and a considerable cost.
For example, SignalRGB explained that they stopped using WinRing0 in 2023 and developed their own SMBus driver, precisely to avoid relying on a system-level driver that could be vulnerable or conflict with other software versions. They themselves admit that the process was difficult and required significant engineering resources.
Another possibility is to switch to alternative tools that no longer depend on WinRing0. There are hardware monitoring and management utilities that have adapted to the new kernel signing requirements and migrated to other drivers, although they sometimes lose some advanced features in the process.
Third, some developers and users cautiously recommend adding an exclusion in Microsoft Defender to allow WinRing0 to continue functioning. This option involves accepting the risk of keeping a vulnerable driver on the system, so it should be carefully considered, especially on computers with sensitive data or those with continuous internet access.
How to add a WinRing0 exclusion in Microsoft Defender (at your own risk)
Before going into detail, it's important to emphasize what Microsoft officially states: any change that reduces security or disables protections should be carefully evaluated . These measures may be useful as a temporary solution to a specific problem, but they always involve taking on additional risk.
If you decide to proceed because you absolutely need an application that uses WinRing0 (for example, to control fans on a computer that overheats or for an accessibility requirement), you can add an exclusion in Microsoft Defender Antivirus to stop it from blocking the related file or folder.
The general steps in Windows 10 and Windows 11 are as follows:
- Open the app Windows security from Start > Settings > Update & Security > Windows Security, or by searching for it in the Start menu.
- On the main panel, enter the section Protection against viruses and threats.
- In the Virus & threat protection settings section, click on Manage settings.
- Scroll down until you reach the block Exclusions and select "Add or remove exclusions".
- Press on Add an exclusion Then choose whether you want to exclude a specific file, an entire folder, or a process. Next, select the item related to WinRing0 or the affected application.
From that point on, Defender will stop scanning and blocking anything you've added to the exclusions list. This can resolve hardware malfunctions, but it also creates a blind spot in your protection, so it should only be done when you know exactly what you're excluding and why.
If you have doubts about whether the detected threat is really just the vulnerable driver or if there might be something else on your system, it's wise to run additional scans with other anti-malware solutions, review recently installed programs, and, if necessary, ask for help in specialized forums before physically opening the door to potential malware.
What to do if Defender doesn't delete WinRing0 or detects it continuously
In some cases, Windows Defender may repeatedly attempt to remove WinRing0 without success because the file is being used by a background program. This causes a loop of warnings and removal attempts that leads nowhere, while the user repeatedly sees the active threat alert.
The most common cause is that the application using the driver is currently open or has a resident service. In this situation, you must manually close the program and its associated processes before the antivirus can act. You can do this using the Task Manager:
- Open the Task Manager (Ctrl+Shift+Esc or right-click on the taskbar > Task Manager).
- Find the main process of the related application (e.g., Razer software, RGB tools, etc.) and terminate it.
- Also check the background processes tab in case there are services linked to the same program.
Once you've stopped everything that depends on WinRing0, run the scan and removal again from within Windows Defender . In more than one testimonial, doing this has allowed the antivirus to clear the detection without needing to reinstall Windows or take any more drastic measures.
If the detection keeps recurring, the application might be reinstalling or regenerating the driver every time it starts. In that case, you'll need to decide whether to uninstall the program completely, find an updated version that doesn't use WinRing0, or use exclusion (at your own risk) to avoid this persistent conflict.
Feedback to Microsoft and the position of the developers
The change in the treatment of WinRing0 has generated considerable unease among developers and advanced users, because it directly impacts almost the entire ecosystem of third-party hardware monitoring and control, especially open source projects that depend on drivers of this type.
Developers of tools like HWiNFO or Fan Control have explained that changing the driver is not a simple minor update , but involves redoing a large part of the program, with a significant cost in time and money, all after years of work and a reputation built around these tools.
Microsoft has only commented that they are aware of the false positive reports and are re-evaluating their detection logic to refine it, but at the same time insist that unsigned or potentially vulnerable drivers will continue to be treated as a threat to reduce long-term risk.
In response to this situation, a curious player has entered the scene: iBuyPower, a company known for its pre-built gaming PCs. According to their product manager, they are attempting to obtain an updated version of WinRing0 digitally signed by Microsoft . Their plan is that, if successful, they will share this signed library with the developer community so they can distribute versions of their applications with a validated driver.
Even if that signed version were to arrive, the underlying problem would remain: WinRing0 would retain its basic design of very broad kernel access , so if malware were to manage to spoof or exploit it, it would still pose a risk. Many experts believe that the only robust solution is to migrate to new drivers designed from scratch, with stricter limits and a more modern security model.
How to send feedback and control the feedback level in Windows
If you're affected by these detections and believe Microsoft should refine its approach, you can submit feedback directly from Windows . The company itself encourages the use of built-in tools to report issues with Defender and other system components.
On the one hand, Windows is set up to automatically ask for your feedback periodically. If you want to check or adjust this automatic feedback setting, you can do so as follows:
- Go to Home > Settings > Privacy and security > Diagnostics and feedback.
- In the Feedback Frequency section, make sure it is set to "Automatically (recommended)" if you want Windows to ask for your feedback periodically.
On the other hand, you can also submit your feedback manually through the Feedback Hub whenever you want, without waiting for the system to ask you to:
- Type "Feedback Center" in the search box on the taskbar and open it.
- Within the application, go to the section Comments and select "Add new comment".
- Choose a relevant category, for example "Security, privacy and accounts > Microsoft Defender Antivirus for Windows".
In this way, your experience with WinRing0, false positives, or difficulties managing legitimate drivers is recorded and can help Microsoft adjust its policy and detection tools in future versions, at least in theory.
The diagnostics and feedback settings also allow you to control what data is sent to Microsoft and at what level of detail, which is important if you're concerned about privacy. Within this same settings section, you can review the available options and adjust them to your preference.
Today, the situation with WinRing0 is the result of years of compromises between functionality and security: a very useful driver for accessing low-level hardware , which also represents a potentially exploitable vulnerability and has now been targeted by Microsoft Defender. If you've received an alert, it's most likely due to a monitoring tool, fan control software, or RGB software you have installed, and not necessarily a newly arrived aggressive Trojan. From there, your decision will be to update or change software when possible, assess whether it's worth keeping WinRing0 by creating exclusions and accepting the risk, or simply remove it to prioritize stricter security on your system.