• It reaps unstable processes ASUS won’t.
• It resurrects systems they abandoned.
• Unlike ASUS, it leaves control in your hands.

If your ASUS ROG motherboard suddenly displays “Water Leak Detected” and shuts down your system—even when you're not using a water cooling loop—this script is for you. This open-source PowerShell tool disables false telemetry from WB_SENSOR headers that trigger unexpected shutdowns on Crosshair, Maximus, and other ROG boards.

• Repository: AsusService-Reaper
• Author: Osei Harper
• Documentation Assistance: ChatGPT (OpenAI)
• License: MIT
• Version: 1.1.1

Release Date: August 6, 2025

• Automatic UAC elevation
• Centralized timestamped logging with rotation
• Archive cleanup after 100+ logs
• Retry logic for stubborn ASUS services
• Improved error messaging and log clarity
• Silent background registration of the kill script

Cerulean Reaper is a PowerShell-based defensive utility designed to detect and disable telemetry services, drivers, and scheduled tasks with known CVEs that trigger false shutdowns. ASUS has not patched these.
It addresses recent ASUS driver vulnerabilities (CVE-2025-3462, CVE-2025-3463) by minimizing persistent background services that compromise system stability.

Built for creators, gamers, and professionals using ASUS motherboards—who deserve peace, not phantom processes.

The utility deploys a boot-time SYSTEM-level scheduled task that proactively disables:

• ASUS service processes (e.g., asus_framework, atkexComSvc)
• Fan and sensor control daemons (AsusFanControlService)
• Preloaded shutdown triggers initiated by wininit.exe
• ASUS-linked scheduled tasks and update trapshooks

Systems with ASUS motherboards—especially those involving custom water loops, AIOs, or heavy ASUS software integration—may experience automated shutdowns triggered by false leak, thermal, or pump alerts, often without user consent or visible cause.

Sudden shutdowns logged as:

• The process wininit.exe (127.0.0.1) has initiated the shutdown...
• Reason Code: 0x80070000 (Legacy API shutdown)
• Kernel Event ID 41 or 1074
• Event Log codes: 1074 or Kernel-Power 41
• No Windows Update, task, or user action responsible

Cerulean Reaper neutralizes these conditions before they can take effect.

ASUS' recent BIOS-level driver behavior has led to system instability, unexpected shutdowns, and elevated attack surfaces. This tool directly mitigates patterns related to:

• CVE-2025-3462: Vulnerability in Armoury Crate background service installation behavior
• CVE-2025-3463: ASUS DriverHub privilege escalation vector via persistent scheduled tasks and AsIO3.sys

Cerulean Reaper disables known ASUS system hooks and services that align with these CVEs, helping protect users who cannot afford to replace expensive hardware.

See official CVE entries:
CVE-2025-3462 – NVD
CVE-2025-3463 – NVD

• Researcher: Paul (“Mr Bruh”) -- ASUS DriverHub Threats -- ASUS RMA System Exploit

• Related CVEs: -- CVE-2025-3462 – Armoury Crate privilege escalation via AsusCertService -- CVE-2025-3463 – DLL sideloading vulnerability in ASUS system control stack

• Additional references: -- AsIO3.sys Driver Vulnerability (Talos) -- TALOS-2022-1485 – Armoury Crate LPE -- AyySSHush ASUS Router Exploit -- ASUS Stealth Botnet Vector

By proactively disabling these services at boot, Cerulean Reaper defends both system stability and local exploit resilience.

• 🔐 Auto-elevates with UAC prompt if not run as Administrator
• 📁 Rotates logs and archives older ones automatically
• 🔄 Retries failed service disables up to 5 times
• 🛠️ Registers self-running SYSTEM task with robust error handling
• 🛡️ Terminates ASUS background processes on boot
• ⛔ Disables services tied to thermal/leak shutdowns
• 🧹 Removes ASUS-related scheduled tasks
• 🔁 Persistent via SYSTEM-level scheduled task
• 📄 Logs all actions to C:\ProgramData\ASUS-Reaper\kill.log
• 🔓 Licensed under MIT for open sharing and modification

• git clone https://github.com/Raakaar/AsusService-Reaper.git

Open PowerShell as Administrator, then:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass .\Register-ReaperTask.ps1

This will:

• Copy Reaper-ASUS.ps1 into C:\ProgramData\ASUS-Reaper\
• Create a boot-triggered task named Cerulean-ASUS-Reaper
• Register it to run silently and immediately on every startup

The tool will now neutralize ASUS threats automatically at each boot.

To remove Cerulean Reaper:

Unregister-ScheduledTask -TaskName "Cerulean-ASUS-Reaper" -Confirm:$false

Remove-Item "C:\ProgramData\ASUS-Reaper" -Recurse -Force

• 🔔 Optional email or popup alert if ASUS services respawn
• ⛔ AppLocker / Defender policy to permanently block ASUS services
• 🧬 WMI/Registry watcher for ASUS reinstall attempts

Author: Osei Harper Documentation Assistance: ChatGPT (OpenAI) Proofreader: DeepSeek

MIT License

Copyright (c) 2025, Osei Harper

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Disclaimer: ASUS is a registered trademark of ASUSTeK Computer Inc. This project is not affiliated with ASUS. Use at your own risk.

• Politely decline NDAs.
• Redirect to public GitHub issues.
• Cite their silence: "No official patch exists as of {current date}."

If Cerulean Reaper saved your system, spared your sanity, or inspired your curiosity—consider supporting continued development and new features.

Every bit helps. Thank you 🙏

If this tool helped you stabilize your system or saved you time, consider ⭐ starring the repo to help others find it.

Feedback, forks, and pull requests are welcome—especially if you’ve got improvements to error handling, service detection, or OS compatibility.

• CHANGELOG.md for a full list of updates.
• Release Notes