Windows blocking WingRing driver

manage
manage Member Posts: 3 ✭
in Remote Monitoring and Management

I'm starting to get calls from customers that have constant popups in Windows indicating that the WingRing0x64.sys driver is a vulnerable driver and Windows is blocking it.

The popup keeps coming up and the user ends up with a bunch of them.

Not the best experience for the user with a screen full of popups telling them they have some type of infection.

There is a checkbox to not show the message again.

Anyone else with this problem? Any recommendations? I worked with Atera support via chat last night and I ended up deleting the folders under 'C:\Program Files\Atera Networks\AteraAgent\Packages' and then restarting the ateraagent service.

I'm hoping I don't have to do that with a lot of devices

WingRing Driver Windows.jpeg

Comments

  • giles
    giles Member Posts: 1 ✭

    We are seeing the same thing. Did you find a solution?

  • manage
    manage Member Posts: 3 ✭

    I was told to try these commands, to delete the AgentPackageMonitoring folder and then restart the ateraagent service:

    cd C:\Program Files\Atera Networks\AteraAgent\Packages
    rmdir /s /q AgentPackageMonitoring
    sc stop ateraagent && sc start ateraagent

    Not sure this will fix it, even if you push it using Atera, I don't think it stops Windows from blocking the driver. I'm thinking that Atera needs to look at this issue and provide a fix.

  • RooneyIT
    RooneyIT Member Posts: 1 ✭

    same here…. fix seems to have worked.

  • gilgi
    gilgi Administrator, Moderator, Internal Posts: 287 admin
    https://community.atera.com/discussion/comment/3005#Comment_3005

    On it!

  • SofTec_Solutions
    SofTec_Solutions Member Posts: 1 ✭

    Same issue here. At this point it is only happening on one laptop. But I suspect I will get a flood of calls. The fix above seems to have worked for now, on the one machine.

    cd C:\Program Files\Atera Networks\AteraAgent\Packages
    rmdir /s /q AgentPackageMonitoring
    sc stop ateraagent && sc start ateraagent

    Let's hope Atera gets this fixed quickly. Very quickly.

Topics