nbfc icon indicating copy to clipboard operation
nbfc copied to clipboard

Notebook fan control is flagged as trogan

Open abdullah134 opened this issue 3 months ago • 2 comments

Describe the bug This Plugin is getting flagged as trogan Image

System information Windows 11

abdullah134 avatar Oct 16 '25 07:10 abdullah134

I’m seeing the same behavior on my system as well. Windows Defender flags the file as a trojan (“Trojan:Win32/Vigorf.A”).

Could someone please confirm whether this is a false positive?

For reference, here’s the VirusTotal report.

w6a8w8 avatar Oct 26 '25 19:10 w6a8w8

It's not a false positive. Winring0 is an ancient driver from 2008, which got picked up by the gaming peripheral industry for stuff like rgb, fan control, etc. NBFC is just using it to read/write some registers for controlling fan speed, but the driver itself is vulnerable. It was surviving on borrowed time for a long while now, and seemingly microsoft has finally pulled the plug. You can allow the threat, and keep using NBFC just fine, but remember doing so is a security risk (as has been the case for the last 15 years) and there are actual exploits for this out in the wild. There are some alternative drivers being used these days, but integrating it will require work from the developer. NBFC isn't being maintained for that to happen.

Cosmic-Infinity avatar Nov 08 '25 21:11 Cosmic-Infinity