HWAPI.exe using excessive cpu.

[snerdly]

Can someone help me understand what HWAPI.exe is? Sometimes when I come out
of standby this bugger takes up around 80% of my processor for 5 to 10 mins.
I thought I had a link for a site that explained what all Programs under XP
were but the link must not be there any more. Is there a site that has a
list of XP programs, what they do & if they can be removed?

 

[PA Bear [MS MVP]]

HWAPI.EXE = McAfee HackerWatch Service, part of many McAfee security
applications.

 

[snerdly]

Thanks PA Bear. After I posted this thread I
Found the link I was looking for from Ken Blake (also an MVP) =
http://castlecops.com/StartupList.html
When I used this to identify HWAPI.exe this is what it said:
*******************************************
Added by a variant of the RBOT WORM! Note - this is not the McAfee
HackerWatch process which has the same filename
*********************************************
variant of the Rbot Worm! Should I be worried about this!?

 

[PA Bear [MS MVP]]

Do you have a McAfee application installed? If not and HWAPI.EXE is located
in C:\Windows\System32 <=this folder, it's was dropped by an RBot-variant.

 

[snerdly]

Yes I do have McAfee installed & the ONLY place I could find HWAPI was in
C:\Program Files\Common Files\ McAfee\HackerWatch. (NOT in
Windows\system32)
I just spent the 20 mins on chat with McAfee support & when they realized
that HWAPI was in caps they agreed that is was probably a virus & told me to
run virus scan to get rid of it. If that doesn't work to then contact the
Virus Removal Support Team @ McAfee.
I'm beggining to think HWAPI.exe is legit, what do you think?

 

[PA Bear [MS MVP]]

That McAfee tech doesn't know s*** from shinola. If it's located in
C:\Program Files\Common Files\ McAfee <=this folder, it's not a BadGuy.

What McAfee app is it? Did you upgrade to this app from an earlier McAfee
app?

 

[snerdly]

Yeah, I got an uneasy feeling from them as well. This is the McAfee Security
Center that is provided for Comcast customers (they say it's a $120 value) &
last year they did upgrade from an older version. The current Security Center
Version 7.2, Build Version 7.2.151.
I thought maybe I could turn off HackerWatch (like Windows Defender allows
the option to not participate in the gathering of stats) but I could not find
any options under HackerWatch to turn it off.
I wonder why my other PC doesn't have HWAPI.exe running? McAfee on the
other PC is from a Brokerage company. Seems like everybody is offering free
McAfee.
Thanks for the help
-
Regards snerdly

 

[PA Bear [MS MVP]]

Try this:

1. Uninstall McAfee Security Center via Add/Remove Programs & reboot.

2. Download/run this removal tool & reboot again:
http://service.mcafee.com/FAQDocument.aspx?id=107083&lc=4105&partner=McAfee&type=TS&ia=1

[If you want to see the "leftovers" that uninstalling didn't remove, examine
the log file generated by the tool before rebooting; save to your HDD, if
interested.]

3. Delete the downloaded removal tool (folder)..

4. Reinstall McAfee Security Center via Comcast's link.

5. Manually & repeatedly update the McAfee application until you get a "no
more updates available" prompt.

Hacker Watch can be disabled as follows: Start | Run | (type in)
services.msc | OK | Double-click on the list entry for HackerWatch | In
Status, select STOP | In Startup Type, select DISABLED | OK your way out &
reboot.

McAfee Support Forums
http://forums.mcafeehelp.com

 

[dlech]

I have the exact same problem. I am also using the McAfee software supplied
by Comcast. I had not used my PC in two days. Two days ago I had no problem.
Today first thing Microsoft hotfix KB951376 installed and also a McAfee
update (no reboot required - so I doubt executable software changed). Then I
noticed HWAPI.exe was hogging a constant 88% of CPU.

Contacted McAfee twice. First guy instructed me on how to disable the Hacker
Watch service. That at least bypassed the problem at the cost of Hacker Watch
being down (no great loss, at least according to what I read about what
Hacker Watch does). Second guy told me the standard " I have no idea what to
do" answer (that is, reinstall McAfee software). For now I ignored him. He
was able to verify that my HWAPI.exe file was the correct version and size.

To me their are three possibilities. 1) Microsoft's hotfix messed something
up (fix had something to do with bluetooth stack - so I doubt it's the
problem). 2) The Hacker Watch server HWAPI.exe communicates with it screwed
up. 3) McAfee did in fact change something requiring a new software version
(but why would they not issue and update ?).

So, I will be interested in what you and others have to say about all this.
Somehow I doubt we are the only two who noticed their PC dragging to a crawl.

 

[PA Bear [MS MVP]]

Feel free to read replies to this thread.

I have the exact same problem. I am also using the McAfee software
supplied
by Comcast. I had not used my PC in two days. Two days ago I had no
problem.
Today first thing Microsoft hotfix KB951376 installed and also a McAfee
update (no reboot required - so I doubt executable software changed). Then
I
noticed HWAPI.exe was hogging a constant 88% of CPU.

Contacted McAfee twice. First guy instructed me on how to disable the
Hacker
Watch service. That at least bypassed the problem at the cost of Hacker
Watch being down (no great loss, at least according to what I read about
what Hacker Watch does). Second guy told me the standard " I have no idea
what to do" answer (that is, reinstall McAfee software). For now I ignored
him. He was able to verify that my HWAPI.exe file was the correct version
and size.

To me their are three possibilities. 1) Microsoft's hotfix messed
something
up (fix had something to do with bluetooth stack - so I doubt it's the
problem). 2) The Hacker Watch server HWAPI.exe communicates with it
screwed
up. 3) McAfee did in fact change something requiring a new software
version
(but why would they not issue and update ?).

So, I will be interested in what you and others have to say about all
this.
Somehow I doubt we are the only two who noticed their PC dragging to a
crawl.

 

[SS]

Feel free to read replies to this thread.

 

[SS]

I noticed something similar the day after Microsoft installed a security fix.
I have McAfee on my laptop, and HWAPI began hogging most of the CPU slices.
This behavior survived two reboots of the laptop, including one in which I
removed the laptop battery, but finally stopped after I let it run for 15-20
minutes. My conjecture is that, at least on my system, HWAPI needed a
sizeable block of time for some reason to convince itself that the security
fix was not dangerous, but then settled down afterwards.

 

[Slick]

Same deal here for me. 2 days ago my laptop with Comcast supplied McAffee is
now having the HWAPI.exe file consume 80% of my CPU. I suspect it's a bad
update from McAffee (as the program autoupdates all the time.).

For now, I just go into task manager and end the process. I will research
this further to see if I can just shut everything off for that process.

 

[dlech]

Thanks folks.

I re-read the chat log from my communications with McAfee to note two
things. First guy mentioned that the only way to shutdown Hacker Watch
(besides killing the task or disabling service startup) was during
installation. The second guy was sure he saw files on my PC from an "previous
installation of McAfee". Well, I keep super detailed notes on what I do to
this PC since it is vital to my work and I've learned a lot of hard lessons
programming the past 30 years. I am almost obsessive compulsive on my control
of this PC. I knew I installed McAfee Nov 17, 2007 for the first and only
time. Previously I always used Norton.

I thought that if what he said might be true, how did it happen. Only the
people in charge of McAfee Update Manager can answer that question. I also
thought it was too co-incidental that other people were having the exact same
problem on the exact same day. Especially the same day or week that
Microsoft issued fixes and some of the fixes modified remote procedure calls
(RPC is the only dependent service for HWAPI.exe).

The "old version" possibility convinced me that if I reloaded McAfee
software I might not be reloading what I already had loaded. I considered
that a waste of time and a shot in the dark solution. The "reinstall the
same software" answer rarely solves anything unless you really have something
nasty going on (i.e. virus, spyware, etc). So I cleared all evidence of the
old version off and downloaded a new version. While installing I also
unchecked the "Send security, firewall (etc) data to Mcafee" check box. That
is what Hacker Watch does.

The result was a new version that was in fact different from the old and the
best part, no HWAPI.exe installed as a service. Fact is, you end up with
probably 3 or 4 services less then before and seriously less CPU and memory
burden. So it might be worth the reinstall just for that, even if later they
fix the HWAPI.exe issue in the old version. Which I suspect they will have to
since quite a few people are going to be very annoyed very soon.

Reinstall instructions previously posted here and also on McAfee's web site
work perfect, if you choose that route. Good luck.

 

[PA Bear [MS MVP]]

...So I cleared all

evidence of the old version off and downloaded a new version.

Did you run the removal tool before installing the new version?