Microsoft signed a dodgy driver - It is now being exploited ...

Silvio · Mar 6, 2025

Ransomware scum abusing Microsoft Windows-signed driver

Five flaws found in Paragon Partition Manager's kernel-level .sys

www.theregister.com

antspants · Mar 6, 2025

That’s interesting. Microsoft has already been in contact with Paragon and it has been fixed. Hopefully users will be informed of an update.

BruceR · Mar 6, 2025

Vulnerable versions of the driver have been added to Microsoft's Vulnerable Driver Blocklist so that the OS no longer trusts the buggy driver if it shows up in a BYOVD-based infection. Windows 11 devices enable this blocklist by default.

[Penultimate paragraph of original The Register article - emphasis added]

pseymour · Mar 6, 2025

Kernel-mode BYOVD is only a problem if you run with admin rights.

neves · Mar 6, 2025

We're all humans, so hey - that's a honest mistake. Far from what's happening with Facebook/Meta - on a daily basis - bluntly ignoring and accepting advertisement contracts - from the most obvious scammers: ad pages filled with fake images of people praising a scamming product, fake A.i. videos of a fake professional (a fake doctor, fake so called scientist - with fake voice and fake scripts promoting that product through blunt lies), even fake products or worst - a legit product from a prestigious brand in the images - at less than 40% of its actual price - but they're sure to disappear after enough people are stupid enough to send them money (thinking Facebook it's a legit place - for being part of such a big corporation).

garlin · Mar 6, 2025

I'm writing a PS parser for the recommended blocklist's XML (converting it back to normal text), and yeah...

Quite a number of recognized vendors get called out. Over half are kernel drivers for "management tools" or HW info tools.

Scott · Mar 6, 2025

pseymour · Mar 6, 2025

Scott said:
View attachment 127521

View attachment 127522

If I were the type to attack a PC, I would just drop some small payload on the device, and use that to download the driver from the internet. If I were that type of person.

hdmi · Mar 8, 2025

pseymour said:
If I were the type to attack a PC, I would just drop some small payload on the device, and use that to download the driver from the internet. If I were that type of person.

I wouldn't.

Forget vulnerable drivers - Admin is all you need — Elastic Security Labs

Bring Your Own Vulnerable Driver (BYOVD) is an increasingly popular attacker technique whereby a threat actor brings a known-vulnerable signed driver alongside their malware, loads it into the kernel, then exploits it to perform some action within the kernel that they would not otherwise be able...

www.elastic.co

pseymour · Mar 8, 2025

hdmi said:
I wouldn't.

Forget vulnerable drivers - Admin is all you need — Elastic Security Labs

Bring Your Own Vulnerable Driver (BYOVD) is an increasingly popular attacker technique whereby a threat actor brings a known-vulnerable signed driver alongside their malware, loads it into the kernel, then exploits it to perform some action within the kernel that they would not otherwise be able...

www.elastic.co

You would, do what, link them to an article?

garlin · Mar 8, 2025

Vulnerable drivers XML is dated December 2024, and may not reflect the driver policy changes getting forced on March 2025's CU.

To get a grasp on how widespread the problem is, I'm writing a parser to convert the XML into table form. There's some gaps because MS didn't prepare the source rules in a consistent manner.

The XML is broken down into three parts:

1. List of banned signing certs (some are just outdated, some are compromised).

2. List of DENY rules, based on known SHA1 & SHA256 hashes.

3. List of FILEATTRIB rules, based on known filenames (but not hashes).

Not every rule is associated with a driver's publisher. Some you can infer by reading the full list, and "filling in the gaps". Attached are the full versions of both lists in CSV format, which are the ones you should be using. I've compacted the list on ElevenForum for easier reading.

Banned signing certs:

Code:

ID                         Publisher                                                           
--                         ---------                                                           
ACEBASE_1                  DigiCert Assured ID Code Signing CA-1                               
ACEBASE_2                  DigiCert SHA2 Assured ID Code Signing CA                            
AGNITUM_2004               Agnitum Ltd.                                                        
AGNITUM_2009               Agnitum Ltd.                                                        
AGNITUM_2010               Agnitum Ltd.                                                        
AGNITUM_2010_1             Agnitum Ltd.                                                        
ALSYSIO_1                  ALCPU                                                               
ALSYSIO_2                  ALCPU                                                               
AMDPP                      Advanced Micro Devices Inc.                                         
AMON                       AMON SOFTWARE LTD                                                   
APPID                      Microsoft Windows                                                   
ARTIFICIAL_1               Artificial Software                                                 
ARTIFICIAL_2               Artificial Software                                                 
ARTIFICIAL_SOFT            Artificial Software BV                                              
ASROCK_RWDRV               ASROCK Incorporation                                                
ASWARPOT_1                 Avast Software s.r.o.                                               
ASWARPOT_2                 Microsoft Windows Hardware Compatibility Publisher                  
ASWARPOT_3                 Avast plc                                                           
ASWARPOT_4                 Avast Software s.r.o.                                               
ASWARPOT_5                 AVAST Software s.r.o.                                               
ASWARPOT_6                 AVAST Software s.r.o.                                               
ASWSNX_1                   DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1            
ASWSNX_2                   DigiCert Trusted Root G4                                            
ASWSNX_3                   AVAST Software a.s.                                                 
ASWSNX_4                   AVG Technologies USA, Inc.                                          
ATIDSMXX                   Advanced Micro Devices, Inc.                                        
ATILLK                     ATI Technologies, Inc                                               
ATOOLS_1                   Antiy Labs                                                          
ATOOLS_2                   Antiy Labs                                                          
AVGELAM_1                  AVAST Software s.r.o.                                               
AVGELAM_2                  AVAST Software s.r.o.                                               
BAOJI                      Baoji zhihengtaiye co.,ltd                                          
BEIJING_CHUNBAI            Beijing Chunbai Technology Development Co., Ltd                     
BEIJING_VSK                Beijing VSK Soft Development Co.,Ltd;                               
CAPCOM                     CAPCOM Co.,Ltd.                                                     
CHEAT_ENGINE               Cheat Engine                                                        
COMODO_IQVW                COMODO RSA Certification Authority                                  
COMPUTERZ_1                Chengdu Qiying Technology Co.,Ltd.                                  
COMPUTERZ_2                Chengdu Qiying Technology Co.,Ltd.                                  
CPUZ_1                     CPUID S.A.R.L.U.                                                    
CPUZ_2                     CPUID                                                               
CVM_SOFT_1                 CVM Software Solutions Ltd.                                         
CVM_SOFT_2                 CVM Software Solutions Ltd.                                         
CVM_SOFT_3                 CVM Software Solutions Ltd.                                         
CVM_SOFT_4                 CVM Software Solutions Ltd.                                         
DIGICERT_EV                DigiCert EV Code Signing CA (SHA2)                                  
ECSIODRV                   ELITEGROUP COMPUTER SYSTEMS CO                                      
ELBY                       Elaborate Bytes AG                                                  
ENE                        ENE Technology Inc.                                                 
ETDSUPPORT                 HP Inc.                                                             
FAIRPLAY_1                 Hans Roes                                                           
FAIRPLAY_2                 Hans Roes                                                           
FAIRPLAY_3                 Hans Roes                                                           
FAIRPLAY_4                 Hans Roes                                                           
FILSECLAB                  Filseclab Corporation                                               
GEOTRUST_SRL_2009          Microsoft Software Validation v2                                    
GEOTRUST_SRL_2010          Microsoft Software Validation v2                                    
GETAC                      Getac Technology Corp.                                              
GLOBAL_SOFT                Global Software, LLC                                                
GLOBALSIGN_CHEAT_ENGINE    Cheat Engine                                                        
GLOBALSIGN_G2_CHEAT_ENGINE Cheat Engine                                                        
GLOBALSIGN_G2_MICROSTAR    MICRO-STAR INTERNATIONAL CO., LTD.                                  
GLOBALSIGN_MICROSTAR       Micro-Star Int'l Co. Ltd.                                           
GLOBALSIGN_TG_SOFT         TG Soft di Tonello Gianfranco ed Enrico S.r.l.                      
GMER                       GMEREK Systemy Komputerowe Przemyslaw Gmerek                        
GMEREK                     GMEREK Systemy Komputerowe Przemyslaw Gmerek                        
GOOD_WEI                   Shanjun Wei                                                         
HANDAN                     Handan City Congtai District LiKang  Daily Goods Department         
HAXM_1                     XM Cyber LTD                                                        
HAXM_2                     XM LTD                                                              
HAXM_3                     XM LTD                                                              
HERMETICWIPER_1            CHENGDU YIWO Tech Development Co., Ltd.                             
HERMETICWIPER_2            Chengdu Yiwo Tech Development Co., Ltd.                             
HERMETICWIPER_3            CHENGDU YIWO Tech Development Co., Ltd.                             
HERMETICWIPER_4            CHENGDU YIWO Tech Development Co., Ltd.                             
HP                         HP Inc.                                                             
HW_A                       Marvin Test Solutions, Inc.                                         
HW_B                       Marvin Test Solutions, Inc.                                         
HW_C                       Marvin Test Solutions, Inc.                                         
HW_D                       Geotest - Marvin Test Systems, Inc.                                 
HWDETECTNG                 iNFERRE                                                             
HWINFO_1                   Zhengzhou Heng Kuai Information Technology Co., Ltd                 
HWINFO_2                   Martin Malik - REALiX                                               
HWINFO_3                   REALiX                                                              
HWINFO_4                   Martin Malik - REALiX                                               
HWINFO_5                   Zhengzhou Heng Kuai Information Technology Co., Ltd                 
HWINFO_6                   Martin Malik - REALiX                                               
HWRWDRV_1                  Shuttle Inc.                                                        
HWRWDRV_2                  SHUTTLE INC.                                                        
HYPERTECH                  HYPER TECH CO., LTD.                                                
INTEL_IQVW                 Intel External Basic Policy CA                                      
IOBITUNLOCKER_1            IObit CO., LTD                                                      
IOBITUNLOCKER_2            IObit Information Technology                                        
IOBITUNLOCKER_3            IObit CO., LTD                                                      
IOBITUNLOCKER_4            IObit Information Technology                                        
IOMAP                      ASUSTeK Computer Inc.                                               
ITM_1                      ITM System Co.,LTD                                                  
ITM_2                      ITM System Co.,Ltd                                                  
ITM_3                      ITM System Co.,Ltd                                                  
ITM_4                      INZENT Co., Ltd.                                                    
JCOS_1                     JCOS Media srvnetbus                                                
JCOS_2                     JCOS Media pshedmp                                                  
JEROMIN_CODY_ERIC          Jeromin Cody Eric                                                   
KSAPI_1                    Beijing Kingsoft Security software Co.,Ltd                          
KSAPI_2                    Beijing Kingsoft Security software Co.,Ltd                          
KSAPI_3                    Beijing Kingsoft Security software Co.,Ltd                          
KSAPI_4                    Zhuhai Juntian Electronic Technology Co., Ltd.                      
LDIAGIO_1                  Lenovo Information Products (Shenzhen) Co.,Ltd                      
LDIAGIO_2                  Lenovo                                                              
LDIAGIO_3                  Microsoft Windows Hardware Compatibility Publisher                  
LDIAGIO_4                  LENOVO                                                              
LDIAGIO_5                  LENOVO (UNITED STATES) INC.                                         
LV_DIAG                    Lenovo                                                              
LV_DIAG_2                  Lenovo                                                              
LV_LOGITECH                Logitech Inc                                                        
MAN_MUS                    DIGITAL SERVICES OF MANUEL MUSARELLA                                
MB_RB_HACKS                MB Rb online                                                        
MICKS                      Micks Auto Transport                                                
MIMIKATZ_KERNEL            Benjamin Delpy                                                      
MIMIKATZ_KERNEL_SHA2       Benjamin Delpy                                                      
MIMIKATZ_USER              Open Source Developer, Benjamin Delpy                               
MS_ELAM                    Microsoft Windows Third Party Component CA 2014                     
MS_ELAM_1                  Microsoft Code Signing PCA 2010                                     
MSIO32                     Creative Technology Innovation Co., Ltd.                            
MSRHOOK                    ID TECH                                                             
MYDRIVERS_1                Beijing Kingsoft Security software Co.,Ltd                          
MYDRIVERS_2                Beijing Kingsoft Security software Co.,Ltd                          
MYDRIVERS_3                Beijing Kingsoft Security software Co.,Ltd                          
NANJING                    Nanjing Zhixiao Information Technology Co.,Ltd                      
NGIODRIVER                 AVAST Software a.s.                                                 
NICHETECH                  Niche Technology, LLC                                               
NVFLASH                    NVIDIA Corporation                                                  
NVFLASH_2                  NVIDIA Corporation                                                  
NVFLASH_3                  NVIDIA Corporation                                                  
NVIDIA_2007                Leaked 2007 NVIDIA Corporation Verisign Class 3 Code Signing 2004 CA
NVIDIA_2011                Leaked 2011 NVIDIA Corporation Verisign Class 3 Code Signing 2010 CA
NVIDIA_2015                Leaked 2015 NVIDIA Corporation Verisign Class 3 Code Signing 2010 CA
NVOCLOCK                   Micro-Star Int'l Co., Ltd.                                          
OPENLIBSYS                 Noriyuki MIYAZAKI                                                   
PAN                        PAN YAZILIM BILISIM TEKNOLOJILERI TICARET LTD. STI.                 
PAVEL_Y_1                  Pavel Yosifovich                                                    
PAVEL_Y_2                  Pavel Yosifovich                                                    
PCDOC                      PC-Doctor, Inc.                                                     
PCTOOLS_1                  PC Tools                                                            
PCTOOLS_2                  PC Tools                                                            
PCTOOLS_3                  PC Tools                                                            
PHYMEM                     Super Micro Computer, Inc.                                          
PHYMEM_1                   Super Micro Computer, Inc. Taiwan                                   
PHYMEM_2                   Super Micro Computer, Inc.                                          
PHYSMEM                    Hilscher Gesellschaft fuer Systemautomation mbH                     
PROCEXP_1                  Sysinternals                                                        
PROCEXP_2                  Sysinternals                                                        
PROCEXP_3                  Microsoft Windows Hardware Compatibility Publisher                  
PROCEXP_4                  Sysinternals                                                        
PROCEXP_5                  Microsoft Windows Hardware Compatibility Publisher                  
REALTEK                    Realtek Semiconductor Corp.                                         
RENTDRV                    Hangzhou Shunwang Technology Co.,Ltd                                
RWEVERY                    ChongKim Chan                                                       
SAASAME                    SaaSaMe Ltd.                                                        
SANDRA                     SiSoftware Ltd                                                      
SANDRA_THAWTE              SiSoftware Ltd                                                      
SFDRVX32                   SOKNO S.R.L.                                                        
SPEEDFAN                   Sokno S.R.L.                                                        
STDCDRV                    Intel Corporation                                                   
STDCDRVWS                  Intel External Basic Policy CA                                      
SYMANTEC_CLASS_3           Symantec Class 3 SHA256 Code Signing CA                             
SYMANTEC_CLASS_3_EV        G2                                                                  
SYSDRV3S                   3S-Smart Software Solutions GmbH                                    
TRUESIGHT_1                Sectigo Public Code Signing Root R46                                
TRUESIGHT_2                Adlice                                                              
TRUESIGHT_3                Adlice                                                              
TRUESIGHT_4                Adlice                                                              
TRUST_ASIA                 Shanghai Yulian Software Technology Co., Ltd.                       
VBOX                       innotek GmbH                                                        
VBOX_ORCALE                Oracle Corporation                                                  
VBOX_SUN                   Sun Microsystems, Inc.                                              
VERISIGN_2004              VeriSign Class 3 Code Signing 2004 CA                               
VERISIGN_2004_ASUS_BS_DEF  ASUSTeK Computer Inc.                                               
VERISIGN_2004_BIOSTAR      BIOSTAR MICROTECH INT'L CORP                                        
VERISIGN_2009              VeriSign Class 3 Code Signing 2009-2 CA                             
VERISIGN_2009_BIOSTAR      BIOSTAR MICROTECH INT'L CORP                                        
VERISIGN_2009_REALTEK      Realtek Semiconductor Corp.                                         
VERISIGN_2010              VeriSign Class 3 Code Signing 2010 CA                               
VERISIGN_2010_2            VeriSign Class 3 Code Signing 2010 CA                               
VERISIGN_2010_BIOSTAR      BIOSTAR MICROTECH INT'L CORP                                        
VERISIGN_AMD               Advanced Micro Devices, Inc.                                        
VERISIGN_INSYDE            Insyde Software Corp.                                               
VERISIGN_NOVELL            Novell, Inc.                                                        
VERISIGN_TG_SOFT           TG Soft S.a.s. Di Tonello Gianfranco e C.                           
VERISIGN_TOSHIBA           TOSHIBA CORPORATION                                                 
VMDRV                      Voicemod Sociedad Limitada                                          
VOIDTOOLS                  voidtools                                                           
WINDOWS_3RD_PARTY_2010     Microsoft Windows Hardware Compatibility Publisher                  
WINDOWS_3RD_PARTY_2012     Microsoft Windows Hardware Compatibility Publisher                  
WINDOWS_3RD_PARTY_2014     Microsoft Windows Hardware Compatibility Publisher                  
WINKERNEXP                 Synhe Technology Co., Ltd                                           
WISEUNLO                   Beijing Lang Xingda Network Technology Co., Ltd                     
WISEUNLO_1                 Beijing Lang Xingda Network Technology Co., Ltd                     
WISEUNLO_2                 Lespeed Technology Ltd.                                             
ZAM_1                      Zemana Ltd.                                                         
ZAM_2                      GlobalSign                                                          
ZAM_3                      WATCHDOG ZAM                                                        
ZEMANA_1                   Zemana Ltd.                                                         
ZEMANA_2                   Zemana Ltd.                                                         
ZEMANA_3                   ZEMANA A.Ş.

Banned driver filenames or identifiers:

Code:

ID                 Rule Publisher                                       Driver                         
--                 ---- ---------                                       ------                         
ACEBASE            FILE                                                 ACE-BASE64                     
AGENT64            DENY                                                 Agent64                        
ALSYSIO            FILE ALSysIO                                         ALSysIO.sys                    
AMD_RYZEN          FILE                                                 AMDRyzenMasterDriver.sys       
AMDPP              FILE Advanced Micro Devices Inc.                     AMDPowerProfiler.sys           
AMIFLDRV           DENY                                                 amifldrv64                     
AMP                DENY                                                 System Mechanic CVE-2018-5701  
AODDRIVER          DENY AMD                                             AODDriver                      
AODDRIVER          FILE AMD                                             AODDriver.sys                  
AODDRIVER          FILE AMD                                             AODDriver2.sys                 
APPID              FILE Windows                                         appid.sys                      
ASHITIO            FILE ASUS                                            AsHitIo_Drv.sys                
ASIO               DENY                                                 asio                           
ASIO               DENY                                                 ASIO32.sys                     
ASIO               DENY                                                 ASIO64.sys                     
ASIO_32            DENY                                                 ASIO32.sys                     
ASIO_64            DENY                                                 ASIO64.sys                     
ASIO3              DENY                                                 asio3                          
ASMMAP             DENY                                                 Asus Memory Mapping Driver     
ASR_AUTOCHECK      FILE ASRAutoCheck                                    AsrAutoChkUpdDrv.sys           
ASR_AUTOCHECK      FILE ASRAutoCheck                                    AsrAutoChkUpdDrv_1_0_32.sys    
ASRDRV10           DENY                                                 AsrDrv10.sys                   
ASRDRV101          DENY                                                 AsrDrv101.sys                  
ASRDRV102          DENY                                                 AsrDrv102.sys                  
ASRDRV103          DENY                                                 AsrDrv103.sys                  
ASRDRV104          DENY                                                 asrdrv104                      
ASRDRV105          DENY                                                 AsrDrv105.sys                  
ASRDRV105          DENY                                                 AsrDrv105n.sys                 
ASRDRV106          DENY                                                 AsrDrv106.sys                  
ASRDRV106          DENY                                                 AsrDrv106n.sys                 
ASRDRV107          DENY                                                 AsrDrv107.sys                  
ASRDRV107          DENY                                                 AsrDrv107n.sys                 
ASRSETUPDRV103     DENY                                                 AsrSetupDrv103                 
ASUPIO64           DENY                                                 AsUpIO64.sys                   
ASWARPOT           FILE Avast                                           aswArPot.sys                   
ASWSNX             FILE Aswsnx                                          aswSnx.sys                     
ASWSP              FILE Avast                                           aswSP.sys                      
ATIDSMXX           FILE and                                             atidsmxx.sys                   
ATILLK             DENY ATI Technologies, Inc                           atillk64                       
ATILLK             FILE atillk64                                        atillk64.sys                   
ATLACCESS          FILE atlAccess                                       atlAccess.sys                  
ATOOLS             FILE Antiy Labs AToolsKrnl                           Atools2.sys                    
ATSZIO             FILE                                                 ATSZIO.sys                     
AVALUEIO           FILE Avalue                                          AVALUEIO.SYS                   
AVGELAM            FILE Avast aswElam/avgElam Overpermissive ELAM       aswElam.sys                    
BANDAI             DENY                                                 bandainamcoonline.sys          
BEDAISY            DENY                                                 BEDaisy.sys                    
BS_DEF             FILE Bs_Def                                          Bs_Def.sys                     
BS_DEF             FILE Bs_Def64                                        Bs_Def64.sys                   
BS_HWMIO64         FILE                                                 BS_HWMIO64_W10.sys             
BS_I2CIO           FILE                                                 BS_I2cIo.sys                   
BS_MEM             FILE BSMEM64_W10                                     BSMEM64_W10.sys                
BS_RCIO            DENY                                                 BS_RCIO                        
BS_RCIO            FILE BS_RCIO                                         BS_RCIO64.sys                  
BS_RCIO_W10        FILE BS_RCIO                                         BS_RCIO64_W10.sys              
BS_RCIO64          DENY                                                 BS_RCIO64                      
BSFLASH64          DENY                                                 BS_Flash64.sys                 
BSHWMIO64          DENY                                                 BS_HWMIo64.sys                 
BSMI               FILE                                                 BSMI.sys                       
CAPCOM             DENY CAPCOM Co.,Ltd.                                 capcom.sys                     
CGWIN              FILE Sangoma                                         cg6kwin2k.sys                  
COMPUTERZ          FILE Qiying                                          ComputerZ.Sys                  
CORSAIRLLACCESS    FILE CorsairLLAccess                                 Corsair LL Access              
CP2X72C            FILE Interace                                        CP2X72C                        
CP2X72C            FILE Interace                                        CP2X72C.SYS                    
CPUZ_DRIVER        FILE                                                 cpuz.sys                       
CTIIO              FILE MicSys                                          CtiIo64.sys                    
DBK                DENY                                                 Cheat Engine Driver            
DBUTIL             DENY DELL                                            dbutil.sys                     
DBUTIL             DENY                                                 DBUtil.sys 2.3 x86             
DELLBIOS           DENY                                                 DellBIOS.sys                   
DHKERNEL           DENY                                                 YY_DhKernel                    
DIRECTIO           DENY PassMark                                        DirectIo.sys                   
DIRECTIO           DENY                                                 DirectIO32                     
DRIVER7            FILE ASUS                                            Driver7                        
ECHO               DENY Inspect                                         EchoDriver                     
ECSIODRV           DENY EliteGroup                                      ECSioDriver                    
ECSIODRV           FILE EliteGroup                                      ECSIoDriver.sys                
EELAM              FILE ESET eelam Overpermissive ELAM                  eelam.sys                      
EIO64              DENY ASUS                                            EIO64                          
EIO64              FILE ASUS                                            EIO.sys                        
ELBY_DRIVER        FILE                                                 ElbyCDIO.sys                   
ETDSUPPORT         FILE HP                                              etdsupp.sys                    
FAIRPLAY           FILE                                                 MTA San Andreas                
FH_ETHER           DENY Omron                                           FH-Ether                       
FIDDRV             DENY                                                 fiddrv.sys                     
FIDDRV64           DENY                                                 fiddrv64.sys                   
FIDPCIDRV          DENY                                                 fidpcidrv.sys                  
FIDPCIDRV64        DENY                                                 fidpcidrv64.sys                
FPCIE              FILE Integration                                     FPCIE2COM.sys                  
GDRV               DENY                                                 gdrv.sys                       
GDRV               FILE Gigabyte                                        gdrv.sys                       
GEDEVDRV           DENY                                                 GEDevDrv.sys                   
GLCKIO2            DENY                                                 GLCKIO2.sys                    
GMER               DENY GMEREK Systemy Komputerowe Przemyslaw Gmerek    gmer                           
GMER               FILE GMEREK                                          gmer64.sys                     
GVCIDRV            DENY Gigabyte                                        gvcidrv                        
GVCIDRV64          DENY                                                 GVCIDrv64.sys                  
HAXM               FILE                                                 HaXM.sys                       
HPPORTIOX64        FILE HP Inc.                                         HpPortIox64.sys                
HW                 DENY                                                 hw_sys                         
HW                 FILE hw_sys                                          HW.sys                         
HWDETECTNG         FILE Hwdetectng                                      hwdetectng.sys                 
HWINFO             FILE REALiX_HWiNFO32                                 HWiNFO32.SYS                   
HWINFO             FILE REALiX_HWiNFO64A                                HWiNFO64A.SYS                  
HWINFO             FILE REALiX_HWiNFO64I                                HWiNFO64I.SYS                  
HWRWDRV            DENY SHUTTLE INC.                                    HwRwDrv.sys                    
HWRWDRV            FILE HwRwDrv                                         HwRwDrv.sys                    
INPOUTX            DENY                                                 inpoutx                        
IOACCESS           DENY                                                 IoAccess.sys                   
IOBITUNLOCKER      DENY                                                 IoBitUnlocker                  
IOBITUNLOCKER      FILE IObitUnlocker                                   IObitUnlocker.sys              
IOMAP              FILE ASUS                                            IOMap.sys                      
IOMEM              FILE DT Research iomem                               iomem.sys                      
IQVW64             FILE                                                 iQVW64.SYS                     
IREC               DENY                                                 irec32--1.sys                  
IREC               DENY                                                 irec32--10.sys                 
IREC               DENY                                                 irec32--11.sys                 
IREC               DENY                                                 irec32--2.sys                  
IREC               DENY                                                 irec32--3.sys                  
IREC               DENY                                                 irec32--5.sys                  
IREC               DENY                                                 irec32--7.sys                  
IREC               DENY                                                 irec32--8.sys                  
IREC               DENY                                                 irec32--9.sys                  
IREC               DENY                                                 irec64--16.sys                 
IREC               DENY                                                 irec64--17.sys                 
IREC               DENY                                                 irec64--18.sys                 
IREC               DENY                                                 irec64--19.sys                 
IREC               DENY                                                 irec64--21.sys                 
IREC               DENY                                                 irec64--23.sys                 
IREC               DENY                                                 irec64--24.sys                 
IREC               DENY                                                 irec64--25.sys                 
IREC               DENY                                                 irec64--26.sys                 
IREC               DENY                                                 irec64--27.sys                 
IREC               DENY                                                 irec64--28.sys                 
IREC               DENY                                                 irecARM64--45.sys              
ITLSFFN            FILE ITM s4killer ItlsFFN                            ItlsFFN.sys                    
KERNELD            DENY Firewire                                        kerneld                        
KEVP64             FILE                                                 kEvP64.sys                     
KLMD               DENY Kaspersky                                       klmd.sys                       
KSAPI              FILE KingSoft                                        ksapi.sys                      
LDIAGO             FILE Lenovo                                          LDiagIO.sys                    
LDIAGO             FILE Lenovo                                          LDiagIO_legacy.sys             
LDIAGO             FILE Lenovo                                          LDiagIO_uefi.sys               
LGCORETEMP         DENY                                                 lgcoretemp                     
LGCORETEMP         FILE LogiTech                                        LgCoreTemp.sys                 
LHA                FILE                                                 LHA.sys                        
LIBNICM_DRIVER     FILE                                                 libnicm.sys                    
LV_DIAG            FILE LenovoDiagnosticsDriver                         LenovoDiagnosticsDriver.sys    
LV561V64           FILE LV561V64                                        Lv561av.sys                    
MHYPROT2           DENY                                                 mhyprot2.sys                   
MHYPROT3           DENY                                                 mhyprot3.sys                   
MHYPROTECT         DENY                                                 mhyprotect.sys                 
MHYPROTNAP         DENY                                                 mhyprotnap.sys                 
MHYPROTRG          DENY                                                 mhyprotrpg.sys                 
MONITOR            FILE IOBit                                           Monitor.sys                    
MSIO               DENY                                                 MsIo.sys                       
MSIO               FILE MicSys                                          MsIo64.sys                     
MSR                DENY Datapath                                        msr.sys                        
MSRHOOK            DENY IDTech                                          MSRHook                        
MSRHOOK            FILE IDTech                                          Keyboard Filter Driver         
MTCBSV64           FILE                                                 mtcBSv64.sys                   
MYDRIVERS          FILE                                                 mydrivers.sys                  
NCHGBIOS2X64       FILE                                                 NCHGBIOS2x64.SYS               
NCPL_DRIVER        FILE                                                 NCPL.SYS                       
NGIODRIVER         FILE Avast                                           ngiodriver.sys                 
NICM_DRIVER        FILE                                                 NICM.SYS                       
NSCM_DRIVER        FILE                                                 nscm.sys                       
NTIOLIB            FILE                                                 NTIOLib.sys                    
NVFLASH            DENY NVIDIA Corporation                              nvflash.sys                    
NVFLASH            FILE Nvidia                                          nvflash.sys                    
NVOCLOCK           DENY Micro-Star Int'l Co., Ltd.                      nvoclock                       
NVOCLOCK           FILE Nvidia                                          nvoclock.sys                   
OPENLIBSYS         FILE OpenLibSys                                      OpenLibSys.sys                 
OTIPCIBUS          DENY                                                 otipcibus.sys                  
PANIO              FILE PanIO                                           PanIO.sys                      
PANIO              FILE PanIOx64                                        PanIOx64.sys                   
PANIOMON           FILE PanMonFlt                                       PanMonFlt.sys                  
PANIOMON           FILE PanMonFltx64                                    PanMonFltX64.sys               
PCDOC              FILE PC-Doctor                                       pcdsrvc                        
PCHUNTER           DENY PCHunter                                        Driver                         
PCHUNTER           DENY                                                 PCHunter.sys                   
PDFWKKRNL          DENY AMD                                             PDFWKRNL.sys                   
PHYDMACC           DENY                                                 phydmaccx64                    
PHYDMACC           DENY                                                 PhyDMACCx86.sys                
PHYMEM             DENY Shenzhen Moyea                                  Phymem.sys                     
PHYMEM             FILE Phymem                                          phymem.sys                     
PHYMEMX            DENY Super Micro Computer, Inc.                      Phymemx64 Memory Mapping Driver
PHYMEMX64          DENY Super Micro Computer, Inc.                      phymemx64                      
PHYSMEM            FILE Hilscher Gesellschaft fuer Systemautomation mbH physmem.sys                    
PIDDRV             DENY                                                 piddrv.sys                     
PIDDRV64           DENY                                                 piddrv64.sys                   
PPLKILLER          DENY Niche Technologies                              pplkiller.sys                  
PROCESSHACKER      DENY                                                 kprocesshacker.sys FileRule    
PROCEXP            FILE Sysinternals Process Explorer                   procexp.Sys                    
QMBSEC             DENY                                                 qmbsec.sys                     
RADHWMGR           FILE NCR                                             RadHwMgr.sys                   
RENTDRV            DENY Hangzhou                                        RentDrv.sys                    
RETLIFTEN          DENY                                                 1.sys                          
RETLIFTEN          DENY                                                 2.sys                          
RETLIFTEN          DENY                                                 80.sys                         
RETLIFTEN          DENY                                                 81.sys                         
RETLIFTEN          DENY                                                 b.sys                          
RETLIFTEN          DENY                                                 b1.sys                         
RETLIFTEN          DENY                                                 b3.sys                         
RETLIFTEN          DENY                                                 b4.sys                         
RETLIFTEN          DENY                                                 Black.sys                      
RETLIFTEN          DENY                                                 BlackBoneDrv10.sys             
RETLIFTEN          DENY                                                 bw.sys                         
RETLIFTEN          DENY                                                 bwrs.sys                       
RETLIFTEN          DENY                                                 bwrsh.sys                      
RETLIFTEN          DENY                                                 c.sys                          
RETLIFTEN          DENY                                                 cpupress.sys                   
RETLIFTEN          DENY                                                 d.sys                          
RETLIFTEN          DENY                                                 d2.sys                         
RETLIFTEN          DENY                                                 d3.sys                         
RETLIFTEN          DENY                                                 d4.sys                         
RETLIFTEN          DENY                                                 full.sys                       
RETLIFTEN          DENY                                                 gameink.sys                    
RETLIFTEN          DENY                                                 GameTerSafe.sys                
RETLIFTEN          DENY                                                 kbdcap64.sys                   
RETLIFTEN          DENY                                                 LgDCatcher.sys                 
RETLIFTEN          DENY                                                 Lurker.sys                     
RETLIFTEN          DENY                                                 My.sys                         
RETLIFTEN          DENY                                                 netfilterdrv.sys               
RETLIFTEN          DENY                                                 NetFlt.sys                     
RETLIFTEN          DENY                                                 NetProxyDriver.sys             
RETLIFTEN          DENY                                                 ni.sys                         
RETLIFTEN          DENY                                                 nstr.sys                       
RETLIFTEN          DENY                                                 nstrwsk.sys                    
RETLIFTEN          DENY                                                 nt2.sys                        
RETLIFTEN          DENY                                                 nt3.sys                        
RETLIFTEN          DENY                                                 nt4.sys                        
RETLIFTEN          DENY                                                 nt5.sys                        
RETLIFTEN          DENY                                                 nt6.sys                        
RETLIFTEN          DENY                                                 ProtectS.sys                   
RETLIFTEN          DENY                                                 Proxy32.sys                    
RETLIFTEN          DENY                                                 Proxy64.sys                    
RETLIFTEN          DENY                                                 t.sys                          
RETLIFTEN          DENY                                                 t3.sys                         
RETLIFTEN          DENY                                                 t7.sys                         
RETLIFTEN          DENY                                                 t8.sys                         
RETLIFTEN          DENY                                                 TestBone.sys                   
RETLIFTEN          DENY                                                 TGSafe.sys                     
RETLIFTEN          DENY                                                 windows7-32.sys                
RETLIFTEN          DENY                                                 windows8-10-32.sys             
RETLIFTEN          DENY                                                 windows-xp-64.sys              
RETLIFTEN          DENY                                                 WYProxy32.sys                  
RETLIFTEN          DENY                                                 WYProxy64.sys                  
RTCORE             DENY                                                 RTCore                         
RTIF               FILE TenAsys                                         rtif.sys                       
RTKIO_DRIVER       FILE                                                 rtkio.sys                      
RTKIO64_DRIVER     FILE                                                 rtkio64.sys                    
RTKIOW10X64_DRIVER FILE                                                 rtkiow10x64.sys                
RTKIOW8X64_DRIVER  FILE                                                 rtkiow8x64.sys                 
RTPORT             DENY Realtek                                         rtport                         
RTPORT             FILE Realtek                                         rtport.sys                     
RWDRV_DRIVER       FILE                                                 RwDrv.sys                      
RZPNK              FILE Razer                                           Rzpnk.sys                      
SANDBOX            FILE Agnitum                                         SandBox.sys                    
SANDRA             FILE                                                 SANDRA                         
SANDRA_DRIVER      FILE                                                 sandra.sys                     
SBIOS              FILE Samsung                                         SBIOSIO64.sys                  
SEGWINDRVX64       FILE                                                 segwindrvx64.sys               
SEMAV6MSR64        DENY                                                 semav6msr64.sys                
SEPDRV3            DENY                                                 sepdrv3.sys                    
SFDRVX32           FILE sfdrvx32                                        sfdrvx32.sys                   
SKILLER            DENY ITM                                             s4killer                       
SMARTEIO           FILE EVGA                                            SMARTEIO64.SYS                 
SSPORT             DENY HP                                              SSPORT.sys                     
STDCDRV            FILE Intel                                           stdcdrv64.sys                  
STDCDRVWS          FILE Intel                                           stdcdrvws64.sys                
SUPERBMC           DENY                                                 superbmc.sys                   
SUPERBMC           FILE Superbmc                                        superbmc.sys                   
SYMELAM            FILE SymELAM                                         SymELAM.sys                    
SYSCONP            DENY IBM                                             sysconp.sys                    
SYSDETECTOR        FILE                                                 SysInfoDetector.sys            
SYSDETECTOR        FILE SysInfoDetector                                 SysInfoDetectorAE.sys          
SYSDETECTOR        FILE SysInfoDetector                                 SysInfoDetectorAEx64.sys       
SYSDETECTOR        FILE SysInfoDetector                                 SysInfoDetectorPro.sys         
SYSDETECTOR        FILE SysInfoDetector                                 SysInfoDetectorProX64.sys      
SYSDETECTOR        FILE SysInfoDetector                                 SysInfoDetectorX64.sys         
SYSDRV3S           DENY CodeSys                                         SysDrv3S                       
SYSDRV3S           FILE SysDrv3s                                        SysDrv3S.sys                   
SYSINFO            DENY                                                 Noriyuki Miyazaki SysInfo      
TDEIO              DENY                                                 Tdeio.sys                      
TDKLIB             DENY                                                 tdklib.sys                     
TMEL               FILE TrendMicro TMEL Overpermissive ELAM             Tmel.sys                       
TREND_MICRO        FILE                                                 TmComm.sys                     
TRUESIGHT          FILE Adlice                                          Truesight                      
VBOX               FILE innotek GmbH                                    VBoxDrv.sys                    
VDBSV              FILE                                                 VdBSv64.sys                    
VIRAGT             FILE                                                 viragt.sys                     
VIRAGT64           FILE                                                 viragt64.sys                   
VMDRV              FILE Voicemod Sociedad Limitada                      vmdrv.sys                      
WCPU               FILE WCPU                                            CPU Driver                     
WFSHBR             DENY HyperTech                                       wfshbr64                       
WINFLASH64         DENY                                                 WinFlash64.sys                 
WINIO              DENY PartnerTech                                     WinIO                          
WINIO              DENY PartnerTech                                     WinIO32A.sys                   
WINIO              DENY PartnerTech                                     WinIO32B.sys                   
WINIO              DENY PartnerTech                                     WinIo64A.sys                   
WINIO              DENY PartnerTech                                     WinIo64B.sys                   
WINIO              DENY PartnerTech                                     WinIo64C.sys                   
WINKERNEXP         DENY Synhe Technology Co., Ltd                       WindowsKernelExplorer.sys      
WINKERNEXP         FILE Synhe Technology Co., Ltd                       WindowsKernelExplorer.sys      
WINRING            DENY                                                 iFlyWinRing0x64.sys            
WINRING            DENY                                                 WinRing0.sys                   
WINRING            DENY                                                 WinRing0_1_2_2.sys             
WINRING            DENY                                                 WinRing0a64.sys                
WINRING            DENY                                                 WinRing0x64.sys                
WINRING0           DENY                                                 WinRing0.sys                   
WINRING0           FILE                                                 WinRing0.sys                   
WIRWADRV           FILE Winstron                                        WiRwaDrv.sys                   
WISEUNLO           FILE WiseUnlo                                        WiseUnlo.sys                   
WNBIOS             FILE                                                 wnbios.sys                     
ZAM                FILE                                                 AntiLogger Free                
ZAM                FILE                                                 AntiLogger SDK                 
ZAM                FILE                                                 AntiMalware                    
ZAM                FILE                                                 Audit                          
ZAM                FILE WATCHDOG ZAM                                    ZAM                            
ZAM                FILE Zemana                                          ZAM.exe

hdmi · Mar 8, 2025

pseymour said:
You would, do what, link them to an article?

No, I would forget vulnerable drivers.

Microsoft signed a dodgy driver - It is now being exploited ...

Well-known member

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computer

freshly showered

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

freshly showered

My Computers

Jack of all trades – master of none

My Computers

freshly showered

My Computers

Well-known member

Attachments

My Computer

Jack of all trades – master of none

My Computers

Similar threads