Is FanControl Safe? The Vigorf Alert, PawnIO and the Official Download

Short answer: Is FanControl safe? The genuine Fan Control by Rémi Mercier (Rem0o), downloaded from github.com/Rem0o/FanControl.Releases or through getfancontrol.com, is a legitimate, digitally signed fan utility. The antivirus alerts people remember, including “Trojan:Win32/Vigorf.A”, hit an old hardware driver called WinRing0 that has a published vulnerability. Fan Control stopped shipping WinRing0 in version 238 and now uses the signed PawnIO driver. Update to the current release, which is V279, and check the SHA-256 hash.

Where the real Fan Control lives

Fan Control is made by Rémi Mercier, who publishes on GitHub as Rem0o. Downloads come from the repository github.com/Rem0o/FanControl.Releases. The repository’s README links the logo and the documentation to getfancontrol.com, and that site’s download button points back to the same GitHub releases. So getfancontrol.com is the developer’s own site, not a lookalike. When we checked it on September 26, 2026, its download button still said V273, while GitHub already had V279. Use the GitHub release page when you want the newest build.

Two points often surprise people:

• It is free but closed source. The README says “Sources for this software are closed.” The sensor layer it relies on, LibreHardwareMonitor, is open source.
• It is not a laptop tool. The developer’s FAQ says it mostly does not work on laptops, because most laptops do not expose their fans to third-party software. It will install, but it may find no fans at all.

Other official install routes, all listed in the README: winget install Rem0o.FanControl, Scoop’s extras bucket, and Chocolatey.

The current release, checked

We read these values from GitHub’s releases API on September 26, 2026. GitHub computes the SHA-256 digest of each release file when it is uploaded. We downloaded the .NET 10 ZIP ourselves and got the same hash.

V279 is a small update. Its notes list a Windows theme-switching fix, localized menu strings and tray menu spacing. Releases come often: V276, V277 and V278 all shipped in September 2026.

Signature: the developer’s notes for V251, released December 7, 2025, say “FanControl is now a signed app.” We checked FanControl.exe from the V279 ZIP. Its Authenticode signature is valid, the signer is “Rémi Mercier” (Québec, Canada), and the certificate was issued by Microsoft’s code-signing service. Later releases signed the remaining helper DLLs too.

Why antivirus flagged Fan Control: the WinRing0 story

Fan Control reads motherboard sensors through LibreHardwareMonitor, and that library needs a kernel driver to reach the hardware. Until version 237, the driver was WinRing0, which Fan Control installed as FanControl.sys.

WinRing0 has a known vulnerability, CVE-2020-14979. Microsoft’s support page for the Defender alert “VulnerableDriver:WinNT/Winring0” says plainly: “This detection is valid.” PCWorld explained the risk: malware already on a PC can abuse the driver to gain system-level privileges. The driver is not malware itself, but it gives an attacker a way in.

The detections came in two waves:

• March 2025. Defender started flagging WinRing0x64.sys. In the V216 and V217 release notes, dated March 12, 2025, the developer wrote that the driver “always had a known vulnerability” that could theoretically be exploited “on an infected machine,” and that neither the driver nor the program was malicious.
• September 2025, “Vigorf”. On September 4, 2025, users reported that Defender now called the same file Trojan:Win32/Vigorf.A. Replying on GitHub the same day, the developer called it “just WinRing0 being flagged (again)” and pointed out there had been no Fan Control update, only “a detection update from Windows Security.” The README now says versions 237 and below are flagged this way and that sensors stop being detected.

A new name on an old file is confusing. The honest summary is this. The flagged file was the vulnerable WinRing0 driver, not a Trojan hidden in Fan Control. It was still a real security weakness, which is why the fix is to update, not to add a Defender exclusion. Microsoft itself warns that excluding the driver “may make a computer or a network more vulnerable to attack.”

What Fan Control uses now: PawnIO

Version 238, released September 18, 2025, “migrated to the PawnIO version of LHM” and stopped shipping WinRing0. PawnIO is a separate kernel driver by the developer namazso. Its site describes it as “a scriptable universal kernel driver” and says the official edition is “digitally signed.”

• On first run, current Fan Control versions prompt you to install PawnIO. You can decline. The developer’s notes say you then lose motherboard sensors, while other sensor sources keep working.
• Some anti-cheat systems objected to PawnIO. The README says the FACEIT problem was fixed with PawnIO 2.1.0. V265 bundled PawnIO 2.2.0.
• PawnIO is a system-wide driver. Other hardware tools can use it too, which matters when you uninstall.

If you still run V237 or older, updating is the fix for both the alert and the missing sensors.

.NET 10 or .NET 4.8: which package to download

Every release comes in two builds, each as a ZIP (portable) or an installer.

• net_10_0 targets Microsoft’s modern .NET 10. We read its FanControl.runtimeconfig.json: it needs the .NET 10 Desktop Runtime to be present. Fan Control moved from .NET 8 to .NET 10 in V248 (November 17, 2025).
• net_4_8 targets .NET Framework 4.8. Microsoft’s documentation shows .NET Framework 4.8 is built into Windows 10 version 1903 and later and into Windows 11, where newer releases carry the in-place 4.8.1 update. The download is smaller.

Both builds are signed and published side by side, so neither is the “safer” one. Pick net_10_0 if you already have the .NET 10 Desktop Runtime or do not mind installing it from Microsoft. Pick net_4_8 if you want nothing extra on the PC.

Is FanControl safe to download? How to verify it

1. Check the link. It must start with https://github.com/Rem0o/FanControl.Releases/. Treat a Fan Control “download” hosted anywhere else as unverified.
2. Compare the hash. In PowerShell, in your Downloads folder:

   Get-FileHash .\FanControl_279_net_10_0.zip -Algorithm SHA256

   The result must match the digest on the GitHub release page, or the table above for V279.

3. Check the signature. Right-click FanControl.exe, open Properties > Digital Signatures, and confirm the signer is Rémi Mercier.
4. Update inside the app afterward. The built-in updater pulls from the same releases. The app’s license file says it sends one anonymous request with the downloaded version number to Google Analytics when you update this way. If you prefer not to, download new versions by hand.

Our Fan Control download page links straight to the official release and lists the current hashes. See our guide to fake download sites for why the link and the hash both matter.

How to uninstall Fan Control cleanly

1. Stop it starting with Windows. Untick the start-with-Windows option in Fan Control, or delete the “Fan Control” task in Task Scheduler. The README calls this out, because deleting the files alone leaves the task behind.
2. Remove the program. Installer version: uninstall it from the Windows apps list. Portable version: delete the folder.
3. Decide about PawnIO. Uninstalling Fan Control does not remove PawnIO by itself. If no other tool on the PC uses it, remove it too. When users reported that PawnIO could not be removed, the developer replied in July 2026 that some process was probably still using it. He suggested closing Fan Control and any other app that relies on PawnIO, or booting into Safe Mode and uninstalling from there.
4. Put your BIOS fan settings back. The developer recommends setting a fixed fan speed in the BIOS while Fan Control is in charge. Once Fan Control is gone, return the BIOS fan settings to the profile you want.

What Fan Control does not do

• It does not make a laptop’s fans controllable. On an ASUS laptop, G-Helper or ASUS’s own software is the route, and the Armoury Crate uninstall guide covers switching between them.
• It does not add hardware support by itself. The developer says compatibility depends on LibreHardwareMonitor and closes hardware-support requests on the Fan Control repository.
• It does not publish its source code, so you cannot audit Fan Control itself. The signature and the hash are what tie a file to the developer.

Questions

Is Fan Control a virus?

No. The detections were aimed at the WinRing0 driver in versions 237 and older. That driver has a real published vulnerability, so update rather than ignore the alert.

What is Trojan:Win32/Vigorf.A in Fan Control?

It is the name Windows Defender began using on September 4, 2025 for FanControl.sys, the WinRing0 driver shipped in V237 and earlier. The developer called it another WinRing0 detection. V238 and later do not include that driver.

Is getfancontrol.com the official site?

Yes. The developer’s GitHub README links to it, and the site links back to the GitHub releases. It can lag behind GitHub, so check the version number.

Should I add a Defender exclusion for Fan Control?

Not for the old WinRing0 driver. Microsoft warns that the exclusion may make your PC more vulnerable. Update to a PawnIO-based version instead.

Do I have to install PawnIO?

No, but without it Fan Control cannot read motherboard sensors. GPU and plugin sensors still work.

Will PawnIO get me banned in games?

We found no statement from Fan Control or PawnIO about bans. The README says an earlier conflict with FACEIT was fixed in PawnIO 2.1.0. If an anti-cheat blocks it, close Fan Control before playing or contact that game’s support.

Which is better, the installer or the ZIP?

They contain the same program. The installer registers an uninstaller in Windows. The ZIP runs from any folder and is removed by deleting it.

Does Fan Control work on Windows 11?

Yes. The developer lists Windows 10 and Windows 11.

Is Fan Control free?

Yes. It is free to use. The developer accepts optional donations through PayPal and Stripe links in the README.

Sources

• Rem0o/FanControl.Releases README, GitHub
• Fan Control V279 release, V238 release and V251 release, GitHub
• Issue #3410: “Trojan detected”, GitHub (September 4, 2025)
• Issue #3952 on removing PawnIO, GitHub (developer reply July 14, 2026)
• getfancontrol.com, the developer’s site
• PawnIO, namazso
• Microsoft Defender Antivirus alert: VulnerableDriver:WinNT/Winring0, Microsoft Support
• CVE-2020-14979, NIST National Vulnerability Database
• If Windows Defender flags WinRing0 on your gaming PC, pay attention, PCWorld, Mark Hachman
• .NET Framework and Windows OS versions, Microsoft Learn
• Get-FileHash, Microsoft Learn