RubensRainelli
Beelink CS-George you mean the one with the malware?
This file:
GTRP108_WinFlash-more-VRAM-options\WinRing0×64.sys
Contains this malware:
Trojan:Win32/Vigorf.A
Full Report
VirusTotal Report
Please educate yourself. As an app developer myself, I know we carry a lot of responsibility. However, VirusTotal (VT) and other online scanners are not authoritative sources. Furthermore, it is strictly forbidden by their Terms of Service (TOS) to use their reports for anything other than personal research—for example, to ban software, attack developers, or make public posts based on the results.
WinRing0×64.sys is a kernel driver, which means it needs elevated privileges to function. It is often flagged by heuristic anti-virus engines and even Microsoft, but it’s important to understand why.
It is not a “false positive” in the traditional sense; the driver itself isn’t malware. Instead, it is flagged—often as a “Potentially Unwanted Application (PUA)” or “VulnerableDriver”—because it contains a well-known, unpatched security vulnerability. This vulnerability means other malicious programs can exploit the driver to gain kernel-level control of a system.
Despite this known risk, it’s a cost-effective and widely accepted driver that is still used by many legitimate low-level system software applications, especially for hardware monitoring and control.
I understand a VT scan can help estimate risk, but it’s just one tool among many for securing your system. Sadly, sometimes on social media, VT reports are weaponized and used in mobbing tactics. It happened to me recently.
