hwdrv.sys - Information

What is hwdrv.sys? It is part of a rouge antivirus software known as System Security.

---

File Location

• C:\windows\system32\drivers\

File Behaviour

• Creates itself as a new Background Service.
  
• Creates itself as a process on.
  
• Loads and executes itself as a System Driver File.
  
• Disables certain processes.

File Size

• 4,096 bytes

File Type

• System File

Alias Names

• hide.SYS

FALSE POSITIVE WARNING: Just a FYI .... ABIT uGURU Utility has a legit system file named HWDRV.SYS with date stamp of 12/21/1998 and removing it will crash Windows. My motherboard is the ABIT Fatal1ty Socket 775 gaming motherboard which has a uGURU feature. This utility makes Windows boot dependent upon this HWDRV.SYS file. I made the mistake of installing Malwarebytes and running a scan and deleting this file which caused windows to crash. Upon clean rebuild on a different hard drive, I installed malwarebytes again and it detected this file again. I then went out in search to see if it is a False Positive. Link below from ABIT clearly shows that this is a False Positive, so systems running the uGURU motherboard utility need to ignore this false detection or risk crashing Windows.


http://file.abit.com.tw/pub/download/utilities/uguru/2.110/2_110_release_note.txt