Warning: HWiNFO64 is using a Ring 0 driver - active even when program is not in use

[Vishera]

So i checked the Windows folder manually for anything suspicious and i found this:

I tried to delete it but it said that it's open in a different program even though HWiNFO64 wasnot running at the time,

I had to boot to a different OS and delete it from there.

That driver runs 24/7 in the background,

I don't like it when unnecessary things are running in the background - Espeacially if they are a ring 0 driver.

Even if you delete this,the next time you will open HWiNFO64 the program will install the driver again.

[Zando_]

I don't think using a kernel driver is surprising for a piece of monitoring software that's grabbing every sensor it can find. 

[Vishera]

1 minute ago, Zando Bob said:

I don't think using a kernel driver is surprising for a piece of monitoring software that's grabbing every sensor it can find. 

Both AIDA64 and HWMonitor don't do that.

 

 

[Zando_]

1 minute ago, Vishera said:

Both AIDA64 and HWMonitor don't do that.

Neither of them grab all the sensors HWiNFO64 does in my experience, nor do they read them as reliably. That's the reason I use HWiNFO64 to begin with. 

[Vishera]

1 minute ago, Zando Bob said:

Neither of them grab all the sensors HWiNFO64 does in my experience, nor do they read them as reliably. That's the reason I use HWiNFO64 to begin with. 

But Ring 0 driver that runs 24/7?!

[Zando_]

2 minutes ago, Vishera said:

But Ring 0 driver that runs 24/7?!

HWiNFO64 is set to run anytime I run my PC already, so not much of a concern for how I use it. If it isn't set to run on startup then I see how that could be concerning, assuming the way the driver works doesn't require it to start on boot or something. But unless you have a malicious piece of software masquerading as that driver, I don't see how it'd be a problem. 

[Vishera]

3 minutes ago, Zando Bob said:

If it isn't set to run on startup then I see how that could be concerning, assuming the way the driver works doesn't require it to start on boot or something.

The thing is that i didn't set it to run on startup.

I scanned it and it's legit.

[Zando_]

1 minute ago, Vishera said:

The thing is that i didn't set it to run on startup.

I scanned it and it's legit.

Then it should be good. If you're super paranoid then uninstall HWiNFO I guess, otherwise it's a non-issue. 

[Vishera]

Just now, Zando Bob said:

Then it should be good. If you're super paranoid then uninstall HWiNFO I guess, otherwise it's a non-issue. 

The thing is that ring 0 drivers are a potential security risks so i had rather have no unnecessary ring 0 stuff running in the background.

1 minute ago, Zanthed said:

It also does not run 24/7 unless you make it do so. Not every single driver in System32/drivers are running at the same time.

But it did run 24/7,

I tried to delete it and Windows complained that it was in use even though the program was not running..

[Zando_]

1 minute ago, Vishera said:

The thing is that ring 0 drivers are a potential security risks so i had rather have no unnecessary ring 0 stuff running in the background.

But it did run 24/7,

I tried to delete it and Windows complained that it was in use even though the program was not running..

Do you have any other software that uses the HWiNFO driver, apparently some antivirus software use it to get the data they need as well (according to one of the HWiNFO staff): https://www.hwinfo.com/forum/threads/hwinfo32-64-kernel-driver-just-appears.2848/post-13397. 

[Vishera]

1 minute ago, Zando Bob said:

Do you have any other software that uses the HWiNFO driver, apparently some antivirus software use it to get the data they need as well (according to one of the HWiNFO staff): https://www.hwinfo.com/forum/threads/hwinfo32-64-kernel-driver-just-appears.2848/post-13397. 

It's pretty much a clean install,

I just installed a bunch of benchmarks and games.

[Kilrah]

42 minutes ago, Vishera said:

I tried to delete it and Windows complained that it was in use even though the program was not running..

Because it's a driver running as a service, you can go stop it / disable autostart if you want, or uninstall it but then HwInfo likely won't work anymore...