WinFox - comes with Leadtek (nVIDIA based) video adapter

  • Thread starter Thread starter Bruce Sanderson
  • Start date Start date
B

Bruce Sanderson

Windows Defender is reporting that various parts of the WinFox software that
comes with Leadtek video adapters as having "potentially unwanted behaviour"
with "action taken" as "Allow".

Items reported include:
wfwiz.exe
wfioctl.sys
winfoxio.sys

Is there a way to specifically report this to the Microsoft Windows Defender
team so that a future update will cause Windows Defender to stop reporting
these items?
 
If you join Spynet as an advanced member, the decisions you make on those
prompts will be communicated to Microsoft.

Am I correct that these alerts are being raised as you install drivers for
this adapter? If so, I believe that you'll find that each such alert ends
with the phrase "unknown"--I believe they are logged to the System events
log with source WinDefend.

In this case, Windows Defender is simply stating that this driver code is
unknown to it (advanced spynet reporting will help with that)--and that it
is a class of code which can be dangerous--hence the alert. Such messages
are to be expected when installing drivers, particularly newer drivers. If
they arise at some other time, they should be serious cause for concern.

There are also web forms for vendors to either dispute a listing of their
product in Windows Defender, or to dispute when their product is listed as
some particular piece of malware--I don't believe either of these applies in
this case--Spynet reporting is one way the new drivers become "known"--not
sure what other mechanisms there are.
 
Back
Top