heysafe_drv.sys

heysafe_drv.sys is cataloged on the public LOLDrivers list under the "malicious" category as of October 2026, submitted after it was observed in the field. The reviewers describe it as a thin protection minifilter that exposes a caller-validated communication port whose message opcode 0x67 queues a process-tree termination through ZwTerminateProcess, with a hard-coded exclusion list for a handful of core Windows processes and the registered HeySafe PIDs. An object callback restricts handle access to the HeySafe process set.

The LOLDrivers catalog entry is unusually careful about what the review did and did not establish. It notes that the embedded code-signing certificate expired in 2013 and carries no signing timestamp. It also notes, in its own words, that "malicious intent, a trusted-caller authorization bypass, protected-process termination, stack spoofing and certificate theft were not established by this review," and that current Windows loading and HVCI behaviour remain unknown. The category label and the static capability are the two things the entry rests on.

The HeySafe-X name points at heysafex.com. The signing certificate state and the lack of a timestamp are what they are. On a gaming PC the file would be unusual, and the practical move is the same as for any kernel driver whose provenance is not accounted for: identify what installed it, treat its presence as information rather than a verdict, and remove it if nothing on the machine should be running it.

heysafe_drv.sys is listed as malicious on the public LOLDrivers project. One distinct binary hash matching this filename is on record.