viragt64.sys

VirIT antivirus agent driver (64-bit)

From TG Soft (VirIT)

Part of the VirIT family

Status

On a known-vulnerable list

Known variants

2 distinct hashes

Field notes

viragt64.sys is the 64-bit build of viragt.sys, the kernel driver from TG Soft's VirIT antivirus engine. Same vendor, same LOLDrivers listing: an IOCTL that allows termination of processes from kernel mode without adequate access checks.

Documented in published security research as a driver loaded onto already-compromised systems specifically to terminate hundreds of named security and system-utility processes before deploying a payload. The recurring BYOVD pattern: an antivirus driver weaponized to disable antivirus.

Typically present on systems running VirIT products.

What the record shows

viragt64.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 2 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.

What this means, plainly

Presence is not proof of misuse. Driver files on the LOLDrivers list commonly ship with legitimate hardware tools, gaming software, or vendor utilities. Their presence is recorded as evidence on a record. It is never treated as a verdict about a person.

Related drivers

Other drivers in the VirIT family. See the whole family →

viragt.sys

Source

Status data comes from the public LOLDrivers project, a community-curated registry of drivers known to be vulnerable or malicious. The snapshot Vera uses was refreshed July 10, 2026. CVE links go to the NIST National Vulnerability Database.

In plain words

Kernel driver BYOVD Ring 0 Code-signing certificate Certificate revocation The full glossary →

Cite this entry

Vera Project. “viragt64.sys.” Vera Field Guide (Driver). The Vera Project. https://www.veraproject.xyz/field-guide/drivers/viragt64-sys