Is WinDivert Safe? Understand the Driver and Check It Yourself

If you opened Task Manager, looked through your driver list, or saw an antivirus warning and found the name WinDivert, this page is the answer. It exists because the question is a fair one: a gaming program loaded a driver into your Windows, and you have every right to want to know what it is.

The short answer: WinDivert is an open-source, digitally signed network component, made by a third party, that PingArmor uses only on OT servers (RubinOT, DeusOT, PokeXGames). The long answer is the rest of this page — including how to check every claim on your own, without having to take our word for it.

What is WinDivert?

It is a library that lets a program see and redirect network packets before they leave the machine. It is not something we invented, nor a PingArmor-exclusive component: it is a public project, used for over a decade by firewalls, network diagnostic tools and corporate monitoring software.

The source code is open and lives at github.com/basil00/WinDivert, under either the LGPL v3 or the GPL v2, at the user’s choice. PingArmor modifies nothing: it uses the library exactly as the project distributes it — and the “How to check” section below shows you how to prove that.

It has two parts: a regular library (WinDivert.dll) and a kernel driver (WinDivert64.sys). The driver is the part that needs a digital signature for Windows to agree to load it — and it is signed.

Why does PingArmor need it?

PingArmor protects your gaming session by keeping the traffic inside a tunnel, so that an outage on your main internet connection doesn’t drop your character. For that, the game traffic has to get into the tunnel.

The way this has always worked, and still works, is by route: an instruction in the Windows routing table saying that a given address goes out through the tunnel. PingArmor learns the server addresses across sessions and installs those routes before the game connects. When you join a node it already knows — which is most of the time — the connection is born inside the tunnel, and that is the condition for it to cross a connection switch without being recreated.

The limit of that method is well understood, and worth explaining, because it is exactly where WinDivert comes in: it depends on knowing the address in advance. When the server answers on a node the app hasn’t seen yet, the route lands a few seconds later — and Windows does not move a connection that is already open. That particular connection keeps going the outside way until it is remade.

That remainder is what WinDivert covers. With it, the decision becomes per packet, at the moment the packet leaves, without depending on a route installed beforehand — which also reaches addresses showing up for the first time.

One consequence worth understanding, because it shows up in practice: WinDivert moves the traffic, it does not move the connection. When it diverts a connection that was born outside the tunnel, the traffic goes protected, but the socket stays bound to your PC’s network address — and if that address disappears (cable pulled from the PC, network adapter disabled), Windows destroys the connection, and nothing can prevent that. In that case the client reconnects, and the new connection is born protected.

That is why the route installed up front still matters even with the engine running: a connection born inside the tunnel does not depend on the machine’s physical address. The two mechanisms add up — the route covers the address already known, the engine covers the rest. The difference between a real internet outage and pulling the cable from your PC is explained in the FAQ.

What it sees, and what it never sees

Three ports are outside the filter by construction: 80, 443 and 53 — websites, browsing and name resolution. The game login uses 443, so it stays out too. This is not a setting you could get wrong: it is the shape of the filter.

Within what is left, the scope depends on the game:

DeusOT and RubinOT are the wide cases, and it is worth explaining why. The servers of both run on a changing set of nodes, with no fixed port that could be listed. On DeusOT that became clear when we measured that the same executable serves two different launcher clients, each one talking on a port of its own. On PokeXGames the port is known, so the filter is narrow. On the other two there is nothing to enumerate: the filter takes the remainder, and the decision about who owns the packet happens afterwards.

That decision is per process. PingArmor looks at the packet header — where it is going, which port it leaves from — and which program owns that socket. If it isn’t the game, the packet is handed back byte for byte, unchanged. The content of what you transmit is not read, not recorded and not sent anywhere. What remains are counters — how many packets went through — which show up in the support report, if you choose to send one.

On the two wide cases this only exists while the game is open: close the game, the engine disarms and the filter ceases to exist. On PokeXGames, whose filter is four ports, it stays armed for as long as the tunnel is up — four ports reach nothing beyond the game itself, and arming ahead of time makes sure the first connection is born protected. If you only play Tibia Global, it never even gets loaded.

Why do some antivirus engines flag it as HackTool or Riskware?

Because engines classify by capability, not by observed behaviour. A component able to inspect and redirect packets has a capability that malicious software also finds useful — and that alone is enough to land it in a risk category, regardless of who is using it.

There is a second reason, more concrete and less known: piracy tools bundle WinDivert. Illegal Windows activators ship the same library, and heuristic association drags the clean file along with them. That is why a legitimate driver sometimes shows up under a detection name that talks about piracy.

It is worth quoting someone with no interest in defending us: Microsoft, documenting a malware campaign that used WinDivert, wrote that tools of this kind “are not malicious or vulnerable; they provide important capabilities for legitimate use”. The problem, when there is one, is the program carrying the tool — not the tool.

The labels that may appear, in text, so you can compare against what you saw on screen: RiskTool.Multi.WinDivert.gen (Kaspersky, which prefixes it with not-a-virus:), RiskWare.WinDivert.VulnDriver (Malwarebytes), Riskware/WinDivert (Fortinet), Windows.Rootkit.WinDivert (Elastic).

How to check it yourself

You don’t have to take our word for it. Three checks, all yours.

1. The file is the official one, unmodified

PingArmor ships WinDivert exactly as the project distributes it — no recompiling, no altering, no repackaging. You can prove this by comparing the hash of the installed file against the official package published on the project’s GitHub.

In PowerShell:

Get-FileHash "C:\Program Files\PingArmor\resources\WinDivert64.sys"

To find out which version you have, right-click the same file, go to Properties → Details and read the version number. Download the matching package from the official releases page, run the same command on the x64 file inside it, and compare. The two values have to be identical — and they are.

Download it only from there. It is the same search that leads to the “repair” pages mentioned above, and the difference between the official source and some random copy is exactly what this step exists to prove.

2. The driver is signed, and three details cause confusion

Right-click WinDivert64.sys, go to Properties → Digital Signatures. You will see the signature is valid. Three things usually raise doubts when checking, and all of them have an explanation:

• The certificate shows as expired. The signature is timestamped, which anchors it to the moment it was made. It stays valid after the certificate expires — that is how code signing works, and Windows itself validates it.
• The signer’s name is not the project author’s. WinDivert is published in variants that differ only in the driver signature; PingArmor ships one of them, intact.
• The WinDivert.dll library is not signed. Only kernel drivers require a signature. That is expected, and it does not apply to the .sys, which is signed.

3. What antivirus engines say today

Paste the hash from step 1 into VirusTotal and see dozens of engines at once, without uploading any file. It is the fastest way to tell “one engine classified it by category” apart from “there is a real problem”.

What if my antivirus blocks it?

It can happen, especially with products that flag network tools by category. The fix is to add the PingArmor folder to your antivirus exclusion list:

C:\Program Files\PingArmor

A single entry — it covers both files and keeps working after updates. Only do this if your antivirus is actually flagging something: an exclusion makes the antivirus stop watching that folder, and it is not something to do as a precaution.

The menu path changes with each product and each version, so instead of reproducing a walkthrough here that ages badly, go straight to the source: Windows Defender, Avast, AVG, Kaspersky, Norton, Bitdefender, Malwarebytes.

One exception that has to be said: on consumer McAfee, a folder exclusion does not apply to real-time scanning — only a file exclusion does. There, exclude WinDivert.dll and WinDivert64.sys individually, inside C:\Program Files\PingArmor\resources.

If your antivirus didn’t just block but deleted the file, creating the exclusion isn’t enough: you have to restore the file from quarantine first, and only then create the exclusion — otherwise it gets removed again.

What does PingArmor do while the file is blocked?

It tells you — and it stops promising protection it isn’t delivering.

When the engine can’t be activated, two things show up: a balloon in the notification area, next to the clock, and a message in the app window with a shortcut to this page. If you’re in full screen and miss the balloon, the message is still there when you switch back to the app.

The warning is about the session, not about one specific game. The app knows activation failed, but it can’t tell which of your open games ended up uncovered — so it warns broadly rather than narrowly: if you have two games open and the message appeared, treat both as unprotected until it’s sorted.

If you’re already connected and playing, the tunnel stays up and the game keeps running. What’s missing is the layer that covers connections to addresses the app hadn’t seen before. Nothing needs to be closed: take your character somewhere safe, allow the file in your antivirus using the steps above — restoring it from quarantine first, if it was deleted — and protection comes back on its own. The app keeps retrying in the background at growing intervals, and there’s no need to restart the game, the app or Windows.

If you disconnect and try to connect again after a failure, PingArmor won’t connect. It has already seen that the engine didn’t come up, and it would rather say so than raise a tunnel that doesn’t deliver the protection it promises. The screen explains what happened, with the same shortcut to this page; once you’ve allowed the file, the “I’ve allowed it — try again” button releases the connection.

One point worth being precise about: this block depends on the app having seen the failure. On a clean start — PC rebooted, app opened fresh — the connection goes through normally, and the failure only shows when you open the game. That’s when the failure becomes visible: the warning requires an OT game open, even when activation was attempted earlier — the app has no way of knowing which game you are going to open.

Does the driver stay installed on my PC?

Not permanently. The driver is loaded on demand when PingArmor needs it, and Windows unloads it on the machine’s next restart. The project’s documentation is explicit: it is “never permanently installed on your system, rather, it is only temporarily loaded on demand”.

While it is registered, you can find it in the services list under the name WinDivert. Being registered is not the same as intercepting: with no game open, the wide filter does not exist, and the narrow PokeXGames one reaches only its four ports.

If you want to remove it before the next boot, with PingArmor disconnected, two commands in an administrator prompt:

sc stop WinDivert
sc delete WinDivert

In short

Any questions about this? Check the FAQ or reach us at [email protected]. If you want to understand the rest of the architecture — why there is no DLL injection, hooking or access to the game process — the post Is PingArmor safe with BattlEye? covers that in detail. And if something still doesn’t work after allowing the folder, the log collection guide shows how to send us the evidence.