cancel
Showing results for 
Search instead for 
Did you mean: 
  • ×
    Information
    Need Windows 11 help?
    Check documents and videos on compatibility, FAQs, upgrade information and available fixes.Windows 11 Support Center.
  • post a message
  • ×
    Information
    Need Windows 11 help?
    Check documents and videos on compatibility, FAQs, upgrade information and available fixes.Windows 11 Support Center.
  • post a message
Check out our WINDOWS 11 Support Center info about: OPTIMIZATION, KNOWN ISSUES, FAQs, VIDEOS AND MORE.
Braaaad
New member
1 0 0 0
Message 1 of 3
1,021
Flag Post

HPQWare

HP Recommended
All the HP's
Microsoft Windows 10 (64-bit)

Hi

 

Does anyone know what on earth HPQqware is.  Is this a malicious application masqueading as legitimate HP Software, or is it Legitimate HP software acting line malware/Spyware?

 

it is showing up in a hidden folder in C:\HP\.

 

The HPQWare folder is fulled with random junk and .exe's signed by HP Inc..

 

The only reason found the folder is from an installer that tried to run from C:\hpswsetup\sp114136\installer.exe was blocked by my AV.  When it was running it tried resetting the folder permissions on the C:\HP folder as well as quering a bunch or registy Keys and copying text files.

 

The Virus Total link can be found here https://www.virustotal.com/gui/file/ad18fcd479609dfa41d79225fb31021054b34e9961d23017bf142ee9af74a120....

 

This file is also signed by HP Inc.  Which I find very concerning.

 

Going through the EDR Events.  It appears to query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\HPIC000C.

 

This contains references to HPAnalyticsSoftwareKey, HP Device Health Service, FusionSoftwareKey and HP Application Enabling Services.  Again sounds Like HP Junkware, but there is not much information about what these are or what they do.

 

Any insight would be helpful as I don't want to be wiping every machine in the office to find out it is acutally just HP Junkware.

Kind Regards

Brad

 

2 REPLIES 2
Hemant_wagh
New member
1 1 0 0
Message 2 of 3
Flag Post
HP Recommended

for me also falcon block the IOC on path "C:\hpswsetup\sp114136\install.exe -s"

ad18fcd479609dfa41d79225fb31021054b34e9961d23017bf142ee9af74a120

 
 
 
 
Was this reply helpful? Yes No
Chriis
New member
1 1 0 0
Message 3 of 3
Flag Post
HP Recommended

Hi,

 

I logged a support ticket with CrowdStrike for this issue and they have confirmed that this is a false positive caused by an internal issue. This has been fixed at their end.

Was this reply helpful? Yes No
Warning Be alert for scammers posting fake support phone numbers and/or email addresses on the community. If you think you have received a fake HP Support message, please report it to us by clicking on "Flag Post".
† The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation