The Aquasuite service is constantly stopping itself for me and Leakshield is even more annoying than it was previously...

Quoted from "Remayz"

Quoted from "willh"

Thanks for ignoring my previous message.

Is there any plans to release a non-vulnerable version of Aquasuite? I'd like to use the full functionality of the software I paid for without having to bypass Windows Defender...

When you disable Aquasuite's hardware monitoring, winring0 is not loaded at all and it doesn't trigger Windows Defender. That's why the current workaround is to use Aida or HWinfo for hardware monitoring. Aquasuite can access those.

I would like to chime in and say that while disabling Aquasuite's built-in hardware monitoring and using HWinfo is a workaround, it is not a long-term solution for me. I use and pay for Aquasuite so that I can have an all-in-one hardware monitoring/fan control solution without a bunch of extra software running in the background to make it work. I would like to echo the question asked by willh: Are there any plans to release a version that does not rely on winring0?

Yes

but no ETA yet. it takes a while.

Good to know there's a permanent solution being worked on, I know there's several open source hardware control projects that have decided to just close up shop because of this change.

Can anyone confirm my two bug reports last page since 2025-09-02 update?

- RGBpx controller right-click menu is in German even if Aquasuite is set to English, picture attached
- Farbwerk 360 profile resetting to Profile 1 on cold boot

I always use profile 1 so i can't tell

But the RGBPX menu is indeed in german for me as well

With Windows Defender crippling the Aquacomputer service (I've excluded the folder and set service to automatically restart). After working around this problem, now .NET update causing Aquasuite to crash within a couple hours. Right now my PC is unusable. Powered down $7k paper weight. 100% fan speed is too loud to sleep or work nearby. My Octo controls my fan speed (to Lian Li hub) based on water temp from D5 Next.

I think my only option at this point is to hook my fan PWM directly to the D5 and stop using Aquasuite until these problems are fixed. With very little room to work with and rigid tubing, this will be many hours of work just for what I hope is only a temporary workaround. This is about as frustrated as I've ever been. Everything was built around an Aqua Computer ecosystem, and paid top dollar to do so. They've known about the winring0 issue for at least 6 months now, with no ETA or progress updates. I'm sorry but "we're working on it" just isn't good enough at this point.

Edit: I've returned the unit because Aquasuite wouldn't install no matter what, and didn't get any help from here.

Quoted from "KuraiShidosha"

Can anyone confirm my two bug reports last page since 2025-09-02 update?

- RGBpx controller right-click menu is in German even if Aquasuite is set to English, picture attached
- Farbwerk 360 profile resetting to Profile 1 on cold boot

Farbwerk360 German Context Menu - I have confirmed that the RGBpx LED Controller right-click menu is in German when Aquasuite is set to English. This is true for all devices that have an RGBpx port including Farbwerk360, Octo, D5 Next, High Flow Next, and Leakshield. I think this is an Aquasuite issue and not specific to the Farbwerk360.
Farbwerk360 Profile Load - I have 2 Fabwerk360s in my system. They are loading the proper profile after booting up. In my case, the profile they load is determined by a Global Profile, which is set to load Profile 4 at system startup. If you are using Global Profiles, I suggest checking how they are set up. Your Farbwerk360 profile may be getting changed to Profile 1 in your default Global Profile

I’ve noticed something odd since updating Aquasuite to X.83 on my Windows 10 Pro 64-bit system. Starting the day after I updated (Sept 3), I’ve been seeing repeated catalog database errors logged in: C:\Windows\System32\catroot2\dberr.txt.

The entries look like this: CatalogDB: 8:29:43 PM 9/14/2025: catadnew.cpp at line #1977 encountered error 0x800700c1.

This error (0x800700C1 = ERROR_BAD_EXE_FORMAT) normally means Windows rejected a malformed or unsigned driver file. Based on timing, I suspect it’s related to the AquaComputerService.sys driver. It seems that AquaComputer may have moved the old WinRing0 Kernel-mode functions into AquaComputerService.sys instead of shipping it as a separate driver file. I think this is what is causing the repeated catalog errors logged in C:\Windows\System32\catroot2\dberr.txt. Since the day I updated to X.83 I have been getting ~65 of these errors per day. If you would like to check your system for this error, go to: C:\Windows\System32\catroot2\ and open the log file “dberr.txt”. Scroll to the bottom for the most recent dates and see if you have repeated catadnew.cpp … error 0x800700c1 entries starting after you updated to X.83. I would like to confirm that these errors are not specific to my system so I would appreciate if forum members who also see these errors in the log file “dberr.txt” would post to confirm the problem. Here is a screenshot of what these errors look like.



More Details:
I tested to see if AquaComputer moved the Winring0 Kernel-mode functions into the AquaComputerService.sys driver, and my observations indicate that they have. When I enable any hardware monitoring in Aquasuite, the behavior is different than what it used to be. I use a program called SIV to monitor various hardware sensors. SIV is similar to HWINFO, but with deeper diagnostic tools. It has a panel called Lock Handle that shows which drivers are holding system mutexes while polling hardware sensors. The first screenshot below shows what the SIV Lock Handle panel looks like when I have not enabled any hardware monitoring in Aquasuite. The panel shows that SIV and HWINFO are both holding system mutexes (locks) while polling hardware sensors. This is normal.


Before the X.83 update, enabling any Hardware Monitoring category in Aquasuite caused Winring0 to appear in the SIV Lock Handle panel. Disabling all Aquasuite hardware monitoring made Wingring0 disappear from the Lock Handle panel. After updating to X.83, I have observed new behavior. Now, enabling any Hardware Monitoring in Aquasuite makes AquaComputerService appear in Lock Handle instead of Winring0. Windows Defender also immediately issues a Severe Threat warning, listing Winring0 as detected in AquacomputerService.sys. In addition, disabling all Hardware Monitoring in Aquasuite no longer makes it disappear from Lock Handle. Once triggered, the AquaComputerService.sys driver persists after disabling all Hardware Monitoring in Aquasuite, and even after closing Aquasuite. The only way to unload it is to stop/restart the Aqua Computer Service or reboot. The Lock Handle panel below shows AquaComputerService.sys is still running even after disabling all Hardware Monitoring in Aquasuite. The next image shows Windows Defender immediately detected Winring0 in AquaComputerService.sys.



This behavior leads me to believe AquaComputer integrated the WinRing0 kernel-mode code into a new driver named AquaComputerService.sys in X.83. The separate AquaComputerService.exe process is still required for Aquasuite to function (tray icons, presets, RGB control, and USB device communication), whereas AquaComputerService.sys exists only to provide low-level PC hardware monitoring. Enabling hardware monitoring now loads the embedded kernel-mode component in AquaComputerService.sys. Once active, this driver persists and is immediately flagged by Defender. I don’t understand why Aquacomputer would do this. Integrating an unsigned Winring0-style kernel-mode driver into AquaComputerService.sys is now causing Defender to flag AquaComputerService.sys as a Severe Threat. Eventually Defender will delete AquaComputerService.sys, which it did while I was testing. Also, once this driver is started, it is no longer unloaded by disabling hardware monitoring in Aquasuite or even closing Aquasuite. It is also likely causing the catalog errors being logged in C:\Windows\System32\catroot2\dberr.txt likely since Windows now treats AquaComputerService.sys as a driver package that must be signed, unlike the old WinRing0.sys which CatalogDB ignored.

By embedding the old WinRing0 kernel-mode functions directly into AquaComputerService.sys instead of replacing them with a properly signed driver, AquaComputer has actually made the situation worse. Previously, WinRing0.sys was an unsigned add-on file that Defender sometimes flagged but CatalogDB ignored. Now, with X.83, the new AquaComputerService.sys driver is treated as a full driver package, so Defender still flags it as vulnerable and Windows now logs continuous catalog validation errors. The WinRing0 code is still there, but the integration has introduced new problems on top of the old ones. These issues will persist until AquaComputer fully eradicates WinRing0 code and replaces it with a properly signed driver.

UPDATE: This is getting more complex. I have Aquasuite running on another computer (Computer B) that is also running Windows 10 Pro 64, but that computer has the 2025-09 .NET 8.0.20 Update for x64 Client (KB5066233) installed. The behavior I have been testing is completely different on Computer B. On Computer B the file AquaComputerService.sys never appears on disk, even though enabling hardware monitoring clearly loads the kernel driver code (confirmed in the SIV Lock Handle panel) .This suggests that KB5065957 alters how the driver is deployed. On some systems the file is placed in C:\Program Files\aquasuite., On others it may only be loaded in memory. In either case, the same WinRing0 kernel code is still running. The difference is whether Defender and CatalogDB can see it. This difference appears to depend on the installed .NET 8 runtime version which affects how the driver is deployed. I am going to try to track down where the driver is loaded on Computer B..

Quoted from "Remayz"

I always use profile 1 so i can't tell

But the RGBPX menu is indeed in german for me as well

Quoted from "Speedy-VI"

Quoted from "KuraiShidosha"

Can anyone confirm my two bug reports last page since 2025-09-02 update?

- RGBpx controller right-click menu is in German even if Aquasuite is set to English, picture attached
- Farbwerk 360 profile resetting to Profile 1 on cold boot

Farbwerk360 German Context Menu - I have confirmed that the RGBpx LED Controller right-click menu is in German when Aquasuite is set to English. This is true for all devices that have an RGBpx port including Farbwerk360, Octo, D5 Next, High Flow Next, and Leakshield. I think this is an Aquasuite issue and not specific to the Farbwerk360.
Farbwerk360 Profile Load - I have 2 Fabwerk360s in my system. They are loading the proper profile after booting up. In my case, the profile they load is determined by a Global Profile, which is set to load Profile 4 at system startup. If you are using Global Profiles, I suggest checking how they are set up. Your Farbwerk360 profile may be getting changed to Profile 1 in your default Global Profile

Thank you for confirming the language issue in those menus. I hope it gets fixed soon and we don't have to wait several months between updates like last time.

As for global profile, can you guys send screenshots of your Global Profiles menu? I never touched any settings in there and after the update on 2025-09-02 suddenly now it's defaulting to Profile 1 on cold boot. Reboots maintain the proper profile so I don't believe it's a Global Profile problem. I attached a picture of what my menu looks like.

As of Sept 17, 2025 Windows Defender is now upset about Aquacomputer's use of WinRing0 on my machine as well. I understand a fix is coming, when might that be?

Information about Windows Defender warning "HackTool:Win32/Winring0" (AquaComputerService.sys)

Is there any way I can go back to X.82? I'd really like to use a version of Aquasuite that doesn't frequently crash and functions as it should.

It's been more than 2 weeks since release and the best answer I see is "We're working on it", which frankly, is not good enough. I am a paying customer and it feels like there is VERY little care about this situation.


If a solution/method to rollback/reasonable response with a time frame isn't provided soon, I will certainly not be considering purchasing from Aqua Computer again.

Please please please let HWiNFO also supply SMART data to software sensors!
I have had problems with Aqua Computer Service for ages!
I have to manually restart it quite often in my Windows 11 system to keep getting valid software sensor data after sensor data flow from it stops.
At least now I can get Motherboard temperature data via HWiNFO and it doesn't have the problems that Aqua Computer Service has.

Quoted from "JonnyK"

As of Sept 17, 2025 Windows Defender is now upset about Aquacomputer's use of WinRing0 on my machine as well. I understand a fix is coming, when might that be?

Information about Windows Defender warning "HackTool:Win32/Winring0" (AquaComputerService.sys)

[attach]11162[/attach]

Same here, I though that disabling all hardware monitoring from aquasuite got round this problem; obviously not.

Edit: Its not affected aquasuite functionality for me as far as I can tell.

Yes please give us an option to revert to an older build. My issues with the language in RGBpx menu are confirmed by others to be a software problem. But more concerning is my farbwerk 360 profile reverting on cold boot. I just got done fully uninstalling Aquasuite and deleting all settings and files, then reinstalling and making sure the farbwerk 360 was reset to factory defaults, and the issue is still occurring which tells me it's a problem with the latest update.

I recently updated to 0.83, and now Windows reports several .tmp files every time I boot up.

I'm wondering if this was just a coincidence and something else is producing these, or if its actually related to Aquasuite.

That's Aquasuite. Same thing here

Quoted from "Lateralus23"

I recently updated to 0.83, and now Windows reports several .tmp files every time I boot up.

I'm wondering if this was just a coincidence and something else is producing these, or if its actually related to Aquasuite.

I have been trying to figure this out. I have Aquasuite installed on 2 computers, both running the same version of Windows 10. On Computer A, when I enable any hardware monitoring in Aquasuite, the driver file AquacomputerService.sys appears in c:\Programs/Aquasuite. Defender immediately flags it as a Severe Threat because the Winring0 code functionality is in this driver. If I disable all hardware monitoring in Aquasuite, the driver stays loaded, even after closing Aquasuite. The only way to unload the driver is manually stop the Aquacomputer service or reboot. The driver is also causing Windows catalog errors to be logged in C:\Windows\System32\catroot2\dberr.txt. I am getting about 65 errors per day in this catalog error log file. On Computer B, this does not happen. I think the driver is being loaded into memory, so Defender does not flag it and no catalog error is generated. If I close all hardware monitoring in Aquasuite, the driver is unloaded. On your system, it appears that the driver is being placed in a temp directory, which Defender flags. According to my research, these differences in behavior are caused by differences in the Defender platform version, whether Cloud-delivered protection is enabled in Windows Security, and which Windows updates are installed. These variables determine which path gets taken. I am working on trying to get my Computer A to behave like Computer B because I do not like having my Windows catalog error log file being flooded with these errors. I also don't like that on Computer A, the driver stays loaded even after disabling all hardware monitoring and even after closing Aquasuite.

Hopefully someday Aquacomputer will write a new driver and get it Attestation signed, which is not a very difficult process. I think the larger issue is that they have based all of their hardware monitoring on the WinRing0 driver. WinRing0 exposes a set of IOCTLs (e.g. IOCTL_RDMSR, IOCTL_READ_PCI_CONFIG). Aquasuite’s code calls these IOCTLs through DeviceIoControl(). Over the years, Aquacomputer likely built a large portion of their hardware monitoring logic around the WinRing0 API. If they replace the driver, those IOCTLs may no longer exist. Aquasuite would need new code paths to talk to the new driver. Writing a minimal KMDF (Kernel-Mode Driver Framework) driver and submitting it to Microsoft for attestation can be done in a week or two. Rewriting Aquasuite to use the new driver API instead of WinRing0’s IOCTLs is the hard part. It is a significant software engineering project. This is probably why Aquacomputer keeps stalling. The driver itself isn’t the bottleneck, the application rewrite is.

Interesting... I only recently started to learn to program a few years ago (C# mostly), so I still struggle to understand these things.

Quite frankly nothing comes close to aquasuite in my experience, so I'm cheering for them... and I hope somehow aquacomputer becomes more mainstream as a company so they have the resources to tackle problems like this. The products are so expensive but they're worth it, and I think its only a lack of awareness of how good their products are that limits their market reach.