Cannot remove old HWInfo driver which prevents audio from working

[HWlegend]

A friend of mine has a laptop which has "hwinfo64a.sys" sitting in c: \ windows \ syswow64 \ drivers. However, after a recent Windows update, it is now popping up as banned, as this has caused the speakers and microphone to fail. Clicking on Sound settings shows no speakers present, even though they are clearly showing as working in Device Manager.

We can see it banned at https://learn.microsoft.com/en-us/w...sign/microsoft-recommended-driver-block-rules

I can roll back the laptop via system restore to get it working again, but as the same Windows update would cause the issue to repeat, the user has deferred Windows Updates until we can get this resolved. I am not sure if I can delete the driver, as the audio devices currently need it to make it work.

The version of hwinfo64a.sys is quite old. It shows as version 8.98.0.0 and modified 11/09/2019. I am not sure if that is November 9th or September 11th.

I cannot uninstall the driver, as HWInfo is not showing in Programs, or Apps, or in Program Files. The hwinfo64a.sys file in this folder is the only mention of it I can find in any folder, as I did a file search of the whole machine for “hwinfo”.

Some instructions suggest modifying some settings in Core Isolation but there is no option to do that on this machine.

How do I remove this hwinfo driver, so that this laptop is no longer dependent on it, and make the audio devices work again? I do not wish to install the latest version in case that also causes problems.

We do not know how this software got onto this machine, and the user has no memory of it. It may have got sideloaded at the time but we can’t tell.

I attached pics of the driver details.

Thank you in advance.

 

[Martin]

There are multiple methods how to remove that driver but it depends which software has installed the driver.
Best would be to run the (old) HWiNFO that's installed on the system, go into main settings, Driver Management and click Remove.
But since you say you can't find HWiNFO installed there, it might be some other outdated software installed that's using the HWiNFO driver. So even if you proceed with the following steps, it can happen that it will try to install it again. In such case you need to find and uninstall that software.

Another alternative to remove the driver is to open the Windows Command Prompt as Administrator and type the following commands:
sc stop hwinfo
sc delete hwinfo

The last method is to open the Registry Editor (regedit), navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
and delete the HWiNFO key. Then reboot the machine.

 

[HWlegend]

Thank you for the quick and detailed reply, it is much appreciated.

If I run the command prompt commands, or make the registry changes, will that allow the audio devices to work properly again? That is, will effectively unassigning them pass hardware to o/s control back to the original drivers?

Thanks.

 

[Martin]

It's very unlikely that HWiNFO or its driver would be responsible for the loss of audio, so this is most likely a completely different problem.
I've once seen a similar problem with audio and it was completely unrelated to HWiNFO (it wasn't even installed there). On that system, the software audio drivers failed to load and none of the tricks to solve the problem worked. I ended up completely reinstalling Windows, that worked then.

 

[HWlegend]

Okay thanks, she also has Norton on there, perhaps that has been installing incorrect drivers, which would surprise me as well. Cheers.

 

[Nienna]

Hi Martin,

Just hopping on here as I am having the same problem, not with the audio, but the banned driver issue after Windows Update (10.0.22631.2115) (KB5028251)

I have no recollection of ever installing this driver, so I guess it came with whatever software and is no longer in use. So have searched my entire PC plus Registry and found only the below locations:

C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS
Created: 25 ‎August ‎2020
Modified: 25 ‎August ‎2020

Computer\HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\HWiNFO32
Display Name: HWiNFO32/64 Kernel Driver
Image Path: \??\C:\WINDOWS\SysWOW64\drivers\HWiNFO64A.SYS

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HWiNFO32
Display Name: HWiNFO32/64 Kernel Driver
Image Path: \??\C:\WINDOWS\SysWOW64\drivers\HWiNFO64A.SYS


I ran " sc delete hwinfo " and " sc delete hwinfo " in CMD and got following response for each:

[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.


So do you think I am good to go following your advise above, deleting the keys in the registry?

Thanks!

 

[Martin]

Hi Martin,

Just hopping on here as I am having the same problem, not with the audio, but the banned driver issue after Windows Update (10.0.22631.2115) (KB5028251)

I have no recollection of ever installing this driver, so I guess it came with whatever software and is no longer in use. So have searched my entire PC plus Registry and found only the below locations:

C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS
Created: 25 ‎August ‎2020
Modified: 25 ‎August ‎2020

Computer\HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\HWiNFO32
Display Name: HWiNFO32/64 Kernel Driver
Image Path: \??\C:\WINDOWS\SysWOW64\drivers\HWiNFO64A.SYS

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HWiNFO32
Display Name: HWiNFO32/64 Kernel Driver
Image Path: \??\C:\WINDOWS\SysWOW64\drivers\HWiNFO64A.SYS


I ran " sc delete hwinfo " and " sc delete hwinfo " in CMD and got following response for each:

[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.


So do you think I am good to go following your advise above, deleting the keys in the registry?

Thanks!

That's a newer driver which includes version in its name ("HWiNFO_nnn"), so that's why "hwinfo" in "sc" won't work as you need to specify the full name.
Yes, deleting the registry key should work. Or you can look in the registry for the exact driver name (it's the key name under Services) and then use it with sc to remove the driver.
If you run "sc delete" with the proper name, you'll notice that the key will disappear from registry.

 

[Nienna]

Thanks so much Martin, that has worked!

Memory integrity turned back on, and no longer getting the warning upon starting my PC.

Thanks!!!!

 

[HWlegend]

Hi, just to let you know, it proved to be Norton. My friend has two laptops, and the second also blue screened after installing and running a Norton driver update. She has since removed it and got her money back, after I was also to show her how to do a system restore on both machines.

Your response did help me, as it helped prove that HWInfo was not the cause at all. The fact the message popped up for the first time, when her audio had failed (due to the Norton driver update) was a completed coincidence.

So thanks Martin, and all the best.

 

[Martin]

Thanks for your feedback, might be helpful for others too.

 

[Pat Stewart]

I had a similar problem, more in line with what Nienna described.
The sc command in terminal gave no response, so I assume it did something, but it did not resolve the problem.
I searched the registry, and found the same keys as Nienna listed.
Deleting those keys seems to have eliminated the error on booting Windows.

Thank you, everyone