Is Fan Control dangerous? What the Vigrof.a „virus” alert really means

4th of September will be remembered in gaming history as a day of Hollow Knight: Silksong debut after 6 long years of waiting. This event broke multiple digital storefronts including Steam, Xbox, PlayStation, and Nintendo. However, while waiting for the transaction to be processed, some of Fan Control users might have been unpleasantly surprised by fans in their computers going haywire and sudden messages from Windows Defender informing about Vidorf.a virus that has infected their machines. Such information can scare even more tech-savvy PC enthusiasts, so let’s try to explain what is going on and whether you should start worrying or if you can safely ignore the message.

Vidorf.a detected by Microsoft Defender in Fan Control folder

You might have been surprised by a flood of alerting Microsoft Defender messages informing you that you have been affected by Vidorf.a virus recently. What is more, fans in your computer case might have started behaving in an odd manner, spinning up or slowing down when they shouldn’t. That is enough to scare even tech specialists, not to mention average users. If this is what happened to you, there is a good chance that you are, or rather were, using Fan Control to shape fan curves in relation to hardware components temperature. Yes, Fan Control is the reason why you are getting all those errors. But let’s start from the beginning.

Okay, if you are still reading you would most probably like to learn in detail what’s going on with Fan Control and Vidorf.a virus flag. You can read more about the detected threat on official Microsoft page regarding it, where you will learn that it can pose a serious problem unlocking access for bad actors to seize control over your computer. Does that mean that Fan Control got compromised and the developer is suddenly pushing malicious software? No, not at all.

The reason why all those issues have sparked is due to the fact that Fan Control uses Libre Hardware Monitor (LHM) library to function. It provides this small program all the information about sensors and allows for… control over your computer’s fans, as the name accurately suggests. However, LHM uses a specific, non-signed by Microsoft, driver called WinRing0. Only thanks to this low-level piece of code can Fan Control work. And this program is one of many that utilize WinRing0 driver. A lot of big corporations like Dell and Corsair, among many others, use it to be able to make their own software control fans, but also RGB. This has been explained thoroughly by GamersNexus a while back, when WinRing0 has been first flagged by Microsoft Defender on March 11th, 2025.

The biggest problem with WinRing0 is that it’s a driver that is no longer maintained by its original creator – hiyohiyo. The truth is that while the driver is not a problem on its own, it can leave open doors for bad actors who can exploit this vulnerability. In fact, you have been endangered by this threat for as long as you use Fan Control or any other program that utilizes WinRing0 driver. Now, with the issue highlighted by Microsoft, you are now at least more aware, and you can decide whether you would like to continue using those pieces of software allowing the compromised driver in your system and treating it as a false positive or deleting them completely, making your computer more secure. It is entirely up to you.

When it comes to Fan Control, its developer, Rem0o (Remi Mercier), is aware of the issue and is currently trying to implement workaround that is excluding the WinRing0 driver completely and substitutes it by PawnIO. Hopefully, he will be able to get rid of the compromised piece of code completely, as there are hardly any other good alternatives to his program. A whole another story is the use of this driver by big hardware manufacturers, but that’s something that has been covered by GamersNexus in already mentioned YouTube video.

• security
• hardware
• tech
• software
• viruses
• antivirus
• Microsoft Defender / Windows Defender