Fancontrol.sys wird blockiert

Hello @Bruce_DeBonis

Um, is this your file?

File: FanControl_207_net_4_8_Installer.exe
File size: 7.66 MB (8,027,598 bytes)
MD5 checksum: 029B06243B80C637BD37C8BB9D4F476D
SHA256 checksum: 6F5AAF67BAEA2A1BCC71732D1758B06D24809BBBF5D2884AE87A29A334305F50
Date/Time: 10/30/2024

Note: file is not signed


as test: installed in sandbox - system driver not loaded

as test: installed

as test: Block vulnerable kernel drivers = Off

as test: + Add application → Add app permissionFanControl → Add

as test: FanControl → Ransomware Protection → Allowed

as test: Block vulnerable kernel drivers = On

============================================
Edit:
further testing - Norton still objects to FanControl installer. FanControl.sys does not load. Even with all app permissions Allowed. Norton objects to FanControl installer. Norton objects to FanControl.sys install.

I’ve no notion whether FanControl.sys is needed to control fan speed or gather system/fan data.

I was imagining by allowing app permissions. Norton would be satisfied.

Caveat: I’m not familiar with FanControl nor qualified to run FanControl on my entry level machine.

Hello @Bruce_DeBonis
Please post your progress

as always, your mileage may vary

Edit:
as test: Block vulnerable kernel drivers = On
further testing - Norton still objects to FanControl installer loading FanControl.sys.

  1. allowing FanControl app permissions did not satisfy Norton.
  2. adding FanControl installer to Antivirus & Scans exclusions did not satisfy Norton.
  3. adding FanControl installed folder to Antivirus & Scans exclusions did not satisfy Norton.

Norton blocked a vulnerable driver
The driver fancontrol.sys has been blocked due to vulnerabilities that could cause your PC’s operating system instability or even put it at risk of a hacker attack.

Maybe, FanControl files need to be signed.
Maybe, fan control is too risky.

A bit old thread, maybe…

I am now trying to resolve the same issue, but without success.
Should we understand it, that Norton 360 ACTIVELY refuses my configuration?
I do trust the fancontrol.sys file and want to use it. This is what exclusions and whatnot are for…
Yet Norton still decides to know better and prevent me from doing my stuff?

What a time to be alive. As is often said, Norton is becoming more and more of a virus itself.

Fan Control → Portable or Installer?

===========================================

https://getfancontrol.com/
FanControl_211_net_4_8_Installer.exe
Identified: 1/14/25
Few users
Hundreds of users in the Norton Community have used this file.
Very new
This file was released a day ago.
Unproven
There is not enough information about this file to recommend it.

SHA-256: 7e07de39661619f9114c2cf640ef3d5bcfc0b4d6c15b4d4bf1cb2ca871e75789
VirusTotal report here

Tried both, they suffer the same fate.

Okay. Thanks…saves me the test.

No problem. I did quite a few of them… :smiley:
Still I wonder why Norton ignores the setting it allows me to do. Like… that doesn’t make any sense.

VirusTotal report here

may be related:
https://community.norton.com/t/steelfox-and-winring0-sys/253473

as test:

  • added Antivirus & Scans exclusions for FanControl installer and FanControl installed folder
  • added App permissions for FanControl



Norton remains:
Norton blocked a vulnerable driver
The driver fancontrol.sys has been blocked due to vulnerabilities that could cause your PC’s operating system instability or even put it at risk of a hacker attack.

I even tried to set those exclusions explicitly for the fancontrol.sys file, but that doesn’t help as well. Seriously getting more and more disappointed that there is no “Run anyway” like button that even Defender has.

Interesting workaround is to turn off “Block vulnerable kernel drivers”, launch FanControl (and do any setting necessary) and then turn “Block vulnerable kernel drivers” on again. This way the fancontrol.sys is already loaded and the app works as expected - up until some change in config is needed, then it re-loads the fancontrol.sys and Norton catches it again.

@bjm Do you perhaps have some way to raise it this issue to Norton dev team? To me this seems like a bug of some sort that these exclusion rules do not work.

fwiw ~
WinRing0.sys is deemed vulnerable

  1. FanControl allowed with App permissions did not satisfy Norton.
  2. FanControl installer added to Antivirus & Scans exclusions did not satisfy Norton.
  3. FanControl installed folder added to Antivirus & Scans exclusions did not satisfy Norton.

Yes…

No…fwiw ~ in my opinion…Norton is working as designed.

Caveat: I’m not familiar with FanControl nor qualified to run FanControl on my entry level machine.

  • avast blocking controlcenter vulnerable drivers here
  • AVAST antivirus detects FanControl as virus #1521 here

  • Apparently fan control has unpatchable vulnerably kernel driver here

  • Avast detects the driver as vulnerable #1908 here

No…fwiw ~ in my opinion…Norton is working as designed.

That is just nonsense, sorry. Software that does not let me control it and that ignores it’s own settings is not working as designed. Of course if you think any software should be a hindrance, then sure, it is working as designed.

I think we all understand why fancontrol.sys is being flagged and prevented. What my main issue is that I have no option to say “I know and accept this risk, allow it.”. Which was always a thing in Norton. I’ve been using it since 2006-ish and never had issue I could not resolve using exclusions and so on. Due to my nature - being software engineer - I sometimes need to do iffy things, yet want to be generally protected.

Seeing as Norton 360 fails in allowing me to do so, I will not renew my licence once it runs out.

1 Like

Hello @Jan_Surik
and you’ve opened a support ticket and offered to send debug logs?

Norton Community urges users that do not want automatic renewal to unsubscribe and remove their payment profile. [here]

Okay…based upon my read…Norton follows Avast here & here

Caveat: I’m not familiar with FanControl nor qualified to run FanControl on my entry level machine.

Hello @thread
anyone try FanControl v215?
https://getfancontrol.com/


unsure .NET Framework 4.8 vs .NET 8 ? makes a difference

I just canceled the automatic subscription renewal. If Norton can’t figure out how to let me decide whether to use fancontrol.sys or Fancontrol.exe, then…sorry.. I’m out.
This is standard software for gamers.

All switches disabled in Norton (no protection active) and still, its blocking fancontrol.sys

All: This is why Norton is nailing Fan Control:

AI Overview

There isn’t a specific CVE directly named for “fan control” in 2025 but a significant event in March 2025 involved the Windows kernel driver WinRing0.sys, which Fan Control and other monitoring software use, being flagged as malicious by Windows Defender due to a known vulnerability, CVE-2020-14979. This incident caused issues for users and highlighted the security risks of using this unsigned driver to access hardware directly.

What happened in March 2025?

  • Defender Alert:Windows Defender began flagging WinRing0.sys, a driver used by Fan Control and other monitoring software, as a threat.
  • Why it Happened:WinRing0.sys has a known security vulnerability (CVE-2020-14979) that allows unprivileged programs to gain high-level system access by manipulating memory and hardware.
  • Impact:This led to Fan Control and other software failing to detect sensors or even crashing.
  • Developer’s Response:The Fan Control developer acknowledged the issue and pointed to the vulnerability within the WinRing0 driver itself, not the software, and stated the intention to switch to an alternative library.

How this affects you:

  • Security Risk:Using software that relies on the vulnerable WinRing0 driver, even if the software itself isn’t malicious, can expose your system to security threats, as it bypasses security measures.
  • Software Reliability:If you updated Fan Control or other similar software around March 2025, you may have experienced issues or received warnings from your antivirus.

What you can do:

  • Check the Fan Control Repository:Visit the official FanControl GitHub page for updates or instructions on how to resolve the issue or use an alternative version.
  • Consider Alternatives:Look for fan control software that uses a different, more secure driver or does not rely on unsigned kernel-level drivers.
  • Be Cautious:Be wary of software that requires direct hardware access via an unsigned driver, as this poses a significant security risk.

SA

At first glance, the post seems to be an explanation. At second glance (as I see it), it’s more of an excuse. We do what others do. But: With other products, it is possible to work with exceptions. This is not possible with Norton (at least not with vulnerability drivers).
I find it interesting that you are now telling me that WinRing0.sys is also blocked. This is a driver that I have used many times. I am interested in cryptocurrencies, and WinRing is very often used in mining software (especially when mining is done via CPU only). So I will once again encounter an insurmountable hurdle when I want to mine a coin.

Why don’t you leave it up to me to decide whether I want to use this driver? I have an IT background and know very well what I’m doing. Dr. Norton is welcome to wag his finger, but leave it up to me to decide what I want to do.

Automatic subscription renewal remains disabled.