03.03.2026, 16:58
Change Language
Register
Login
You are not logged in.
- 1
- 2
Shoggy
Sven - Admin
Information about Windows Defender warning "HackTool:Win32/Winring0" (AquaComputerService.sys)
Wednesday, March 12th 2025, 11:47am
Windows Defender and other antivirus software (repeatedly) detect the AquaComputerService.sys file as a threat or virus.
This is not a virus!
This file is a signed open source driver (WinRing0) that aquasuite has been using for many years for hardware monitoring (e.g. CPU temperature). The exact same driver is also used by numerous other, far more popular programs and companies.
A security vulnerability (CVE-2020-14979) has been known to exist in this driver for some time. The problem is that the driver lacks a security descriptor and can be accessed with user rights. Since the driver has deep access to the system, it is possible for malware to exploit the driver and gain system privileges to run malicious code.
Regardless of the version, aquasuite applies a security descriptor when installing the driver, which restricts access to system and admin rights. Based on current knowledge and our own tests, the mentioned attack scenario is no longer feasible.
Please note: If any other application installs the driver before aquasuite without a corresponding security descriptor, the driver is vulnerable. In this case, this is a failure on the part of the corresponding application.
We are already working on a solution by creating our own customized version of the driver and having it certified by Microsoft. However, this is a complex process and will therefore take some time. The main problem is the verification of our company in the Microsoft Partner Center. Microsoft switched this process to an AI-based system last year, and since then, nothing has been working properly. There are numerous reports of companies that had to wait several months before they were approved. Microsoft is aware of the problems and has been promising to solve them for months...
If you do not see any problems with using the driver, you can define it as an exception.
Alternatively, you can disable all hardware monitor modules in aquasuite via the aquasuite -> Service tab. This will prevent aquasuite from loading the corresponding driver. System data can still be transferred to aquasuite via HWiNFO or AIDA64 if required.
This is not a virus!
This file is a signed open source driver (WinRing0) that aquasuite has been using for many years for hardware monitoring (e.g. CPU temperature). The exact same driver is also used by numerous other, far more popular programs and companies.
A security vulnerability (CVE-2020-14979) has been known to exist in this driver for some time. The problem is that the driver lacks a security descriptor and can be accessed with user rights. Since the driver has deep access to the system, it is possible for malware to exploit the driver and gain system privileges to run malicious code.
Regardless of the version, aquasuite applies a security descriptor when installing the driver, which restricts access to system and admin rights. Based on current knowledge and our own tests, the mentioned attack scenario is no longer feasible.
Please note: If any other application installs the driver before aquasuite without a corresponding security descriptor, the driver is vulnerable. In this case, this is a failure on the part of the corresponding application.
We are already working on a solution by creating our own customized version of the driver and having it certified by Microsoft. However, this is a complex process and will therefore take some time. The main problem is the verification of our company in the Microsoft Partner Center. Microsoft switched this process to an AI-based system last year, and since then, nothing has been working properly. There are numerous reports of companies that had to wait several months before they were approved. Microsoft is aware of the problems and has been promising to solve them for months...
If you do not see any problems with using the driver, you can define it as an exception.
Alternatively, you can disable all hardware monitor modules in aquasuite via the aquasuite -> Service tab. This will prevent aquasuite from loading the corresponding driver. System data can still be transferred to aquasuite via HWiNFO or AIDA64 if required.
Speedy-VI
Senior Member
Friday, October 10th 2025, 3:38am
Congrats on getting the new driver written and submitted to MS for certification. Is adding the exception to Windows Defender the only change in X.84?Update on the current status (October 9, 2025):
We have developed a completely new driver with a stricter security model.
Unfortunately, it is currently unclear how long Microsoft’s certification process will take.
The aquasuite X.84 setup now automatically adds an exception for the monitoring driver in Windows Defender..
camjo99
Newbie
Defender triggers even with exclusion - Workaround - C:\Windows\SystemTemp\
Tuesday, October 14th 2025, 2:54am
Happy to hear you guys are working on a new driver!
In the meantime, I recently started getting defender notifications every time I woke up my PC. Both from full shutdown or just sleep.
This is even though I already have "C:\Windows\System32\drivers\AquaComputerService.sys" excluded in Defender.
If anyone else is facing the same, read on. I found a decent work around to use until the new signed driver is available!
Upon system resume, Defender alerts on files with names that look like this:
C:\Windows\SystemTemp\UDDC168.tmp
There is always multiple files, and always inside C:\Windows\SystemTemp\
The filenames always start with UDD but the latter digits change, so excluding these files in Defender doesn't help.
You could exclude all of C:\Windows\SystemTemp\* in defender, but this felt overly broad to me - so I started digging with Process Monitor, and tracked down what was creating these files.
As it turns out they are being created by pcasvc - a component of windows. This is the Program Compatibility Assistant Service
This service Checks for legacy application behaviors or crash data, and can create temporary .tmp or .etl (event trace log) files.
For some reason, at least on my system, this service was tripping up on AquaComputerService.sys on every boot - Maybe assuming the driver is having an issue on resume.
(now that I type that out, this makes sense. When I first put together this rig I had to manually create a custom task to restart the aquasuite service 30s after any "workstation unlock". I have never had the service properly resume after sleep mode, I would always lose HW monitoring data)
So, as soon as pcasvc sees whatever issue happen, it must be extracting the winring0 driver (or a part of it) and creating an error/dump file inside C:\Windows\SystemTemp\
This then gets picked up by defender, as I did not have this path excluded!
So - instead of excluding the whole SystemTemp folder in Defender, The workaround is to block pcasvc from reading AquaComputerService.sys
This can be done like so in an administrative command prompt:
This will add an ACL entry to deny the service from reading the file. And if it can't read it - it can't copy it to SystemTemp!
This resolved my issue and I don't get a defender popup when I wake from sleep anymore.
If anyone else is having this issue - hopefully this helps while we wait for the new driver!
Here's hoping the new driver will natively handle wake from sleep better as well...
In the meantime, I recently started getting defender notifications every time I woke up my PC. Both from full shutdown or just sleep.
This is even though I already have "C:\Windows\System32\drivers\AquaComputerService.sys" excluded in Defender.
If anyone else is facing the same, read on. I found a decent work around to use until the new signed driver is available!
Upon system resume, Defender alerts on files with names that look like this:
C:\Windows\SystemTemp\UDDC168.tmp
There is always multiple files, and always inside C:\Windows\SystemTemp\
The filenames always start with UDD but the latter digits change, so excluding these files in Defender doesn't help.
You could exclude all of C:\Windows\SystemTemp\* in defender, but this felt overly broad to me - so I started digging with Process Monitor, and tracked down what was creating these files.
As it turns out they are being created by pcasvc - a component of windows. This is the Program Compatibility Assistant Service
This service Checks for legacy application behaviors or crash data, and can create temporary .tmp or .etl (event trace log) files.
For some reason, at least on my system, this service was tripping up on AquaComputerService.sys on every boot - Maybe assuming the driver is having an issue on resume.
(now that I type that out, this makes sense. When I first put together this rig I had to manually create a custom task to restart the aquasuite service 30s after any "workstation unlock". I have never had the service properly resume after sleep mode, I would always lose HW monitoring data)
So, as soon as pcasvc sees whatever issue happen, it must be extracting the winring0 driver (or a part of it) and creating an error/dump file inside C:\Windows\SystemTemp\
This then gets picked up by defender, as I did not have this path excluded!
So - instead of excluding the whole SystemTemp folder in Defender, The workaround is to block pcasvc from reading AquaComputerService.sys
This can be done like so in an administrative command prompt:
|
Source code |
1 |
icacls "C:\Windows\System32\drivers\AquaComputerService.sys" /deny "NT SERVICE\PcaSvc":(R) |
This will add an ACL entry to deny the service from reading the file. And if it can't read it - it can't copy it to SystemTemp!
This resolved my issue and I don't get a defender popup when I wake from sleep anymore.
If anyone else is having this issue - hopefully this helps while we wait for the new driver!
Here's hoping the new driver will natively handle wake from sleep better as well...
Speedy-VI
Senior Member
RE: Defender triggers even with exclusion - Workaround - C:\Windows\SystemTemp\
Wednesday, October 15th 2025, 10:57pm
Interesting. I wonder if this is related to the constant stream of Catalog DB errors I have been seeing in C:\Windows\System32\catroot2\dberr.txt since the day I updated Aquasuite to X.83. Here is a LINK to my post detailing my observations about the behavior of the AquaComputerService.sys driver file on my main Windows 10 machine. Strangely, my other machine also running Windows 10 had totally different behavior. I never did figure out why, but I am still getting these errors on my main Windows 10 machine. Here is a partial screenshot of today’s errors. I never got any response from Aquacomputer about this.If anyone else is facing the same, read on. I found a decent work around to use until the new signed driver is available!
The entries look like this: CatalogDB: 8:29:43 PM 9/14/2025: catadnew.cpp at line #1977 encountered error 0x800700c1. This error (0x800700C1 = ERROR_BAD_EXE_FORMAT) normally means Windows rejected a malformed or unsigned driver file. Based on timing, I suspect it’s related to the AquaComputerService.sys driver. Do you know if there is a way to stop these errors from being logged?
Antikythera
Newbie
Friday, November 28th 2025, 10:28am
note to use the above fix you will need to make sure the path is correct.
i believe the above is the default install location.
@rays2c - i believe windows defender has quarantined / deleted the file on your machine.
you will need to either reverse that quarantine or reinstall Aquasuite. then you need to whitelist the service so that defender does not do it again.
|
|
Source code |
1 |
icacls "C:\Program Files\aquasuite\AquaComputerService.sys" /deny "NT SERVICE\PcaSvc":(R) |
i believe the above is the default install location.
@rays2c - i believe windows defender has quarantined / deleted the file on your machine.
you will need to either reverse that quarantine or reinstall Aquasuite. then you need to whitelist the service so that defender does not do it again.
jasnxl
Newbie
Wednesday, February 25th 2026, 10:22pm
I appreciate Aquacomputer working on this, however will it be required to pay for an additional term of the update service to get this functional update?The aquasuite X.84 setup now automatically adds an exception for the monitoring driver in Windows Defender.
This setting is enabled by default but can be disabled during installation if desired.
I'm still running X.79 and am hoping that whatever fix is implemented for this issue, it's backported to earlier versions as well.
Remayz
Senior Member
Thursday, February 26th 2026, 9:54am
It won't be backported, that you can be sure of 
In the licence, if an important security update is needed, it can warrant granting you a free update to the safer version. Up to them to determine if it fits the category. In my opinion it does but we will see once Microsoft wakes up on signing the updated driver.
In the licence, if an important security update is needed, it can warrant granting you a free update to the safer version. Up to them to determine if it fits the category. In my opinion it does but we will see once Microsoft wakes up on signing the updated driver.
Speedy-VI
Senior Member
Friday, February 27th 2026, 3:03am
I agree with Remayz on this one. I have never seen Aquacomputer say yes to anyone who wants to roll back to an earlier version of Aquasuite for whatever reason. Since X.79 there have been 2 firmware updates for the D5 Next and 1 for the Leakshield. If you have either of these devices and you update Aquasuite and the device firmware (which is usually required to work with the Aquasuite update), there is no going back. I have no idea what is going on with the new driver, but I suspect the limited engineering resources Aquacomputer has have been totally focused on getting the Ampinel released.It won't be backported, that you can be sure of
- 1
- 2
Similar threads
-
English forum »-
Hacktool in AquaComputerService.sys
(Mar 11th 2025, 10:30am)
-
- Überwachung und Steuerung »
-
AquaComputerService.sys als HackTool:Win32/Winring0 erkannt
(Mar 11th 2025, 6:38pm)
-
- Überwachung und Steuerung »
-
Aquasuite HackTool:Win32/Winring0
(Mar 12th 2025, 7:53am)
-
- Überwachung und Steuerung »
-
Windows Defender has detected HackTool:Win32/Winring0 in AquaComputerService.sys
(Mar 11th 2025, 8:41am)