What is Update.exe?

The genuine Update.exe file is a software component of Microsoft Windows Operating System by Microsoft Corporation.
Microsoft Windows does use "update.exe" as a process name, for its Package Installer, (formerly Service Pack Setup), which applies system patches and updates downloaded from Microsoft Update or Windows Update servers, but the name is widely used by other legitimate software products and for disguise by malware. It is downloaded within a Windows self-unpacking executable (".exe") cabinet file. By default it runs from the temporary folder into which this file unpacks itself, ("C:\<random-hash>\updates\update.exe"). If located in the system root folder or in "C:\Windows" or its subfolders, it is at least 50% dangerous. The features controlled by command-line parameters inherited from the parent cabinet file's execution, and the parameters it accepts, depend on the version used when packaging the update. The version of "update.exe" that runs when installing one update or system patch may differ from that supplied inside another. Some updates install using "hotfix.exe" or the Windows Installer ("msiexec.exe").

Update stands for Windows Package Installer

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the Update.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for Update.exe related errors

Update.exe file information

Windows Task Manager with Update — Update.exe process in Windows Task Manager

The process known as Microsoft Teams or Medal or com.squirrel.WhatsApp.WhatsApp or TeamsMachineUninstallerProgramData or FACEIT or 7z Console SFX or com.squirrel.slack.slack or TeamsMachineUninstallerLocalAppData or Firefox or com.squirrel.Teams.Teams or Product Updater or Intel® Computing Improvement Program or Mailspring or withSIX or Discord or firefox or Gonzales Update or System Mechanic or Trend Micro AirSupport or Microsoft Teams classic or Splashy or WhatsApp

belongs to software Discord or Microsoft Teams or Microsoft or Slack or WhatsApp or Flickr Uploadr for Windows or Mozilla or Intel® Computing Improvement Program or Avira Product Family or DoNotTrackMe Add-on or Trend Micro Troubleshooting Tool or Discord PTB or iolo technologies or Bitdefender Antivirus Free Edition or Userfeel or 7-Zip or Blitz or MightyText

by GitHub or Microsoft (www.microsoft.com) or Slack Technologies or WhatsApp or Ferox Games B.V or FACE IT LIMITED or Paul Betts or Igor Pavlov (www.7-zip.org) or Discord or Mozilla (www.mozilla.org) or Avira Operations GmbH & Co. KG or Intel (www.intel.com) or Teknum Systems AS (www.handybits.com) or Foundry (version 376, LLC).

Description: Update.exe is not essential for Windows and will often cause problems. The file Update.exe is located in a subfolder of the user's profile folder (common is C:\Users\USERNAME\AppData\Local\Discord\ or C:\Users\USERNAME\AppData\Local\Microsoft\Teams\). Known file sizes on Windows 10/11/7 are 1,512,760 bytes (20% of all occurrences), 1,525,016 bytes and 181 more variants.
The program has a visible window. It is not a Windows core file. The application starts upon Windows startup (see Registry key: Run, MACHINE\Run, TaskScheduler, User Shell Folders, MACHINE\User Shell Folders, DEFAULT\Runonce). The Update.exe file is certified by a trustworthy company. Update.exe is able to monitor applications. Therefore the technical security rating is 45% dangerous; however you should also read the user reviews.

Recommended: Identify Update.exe related errors

If Update.exe is located in a subfolder of "C:\Program Files", the security rating is 42% dangerous. The file size is 1,512,760 bytes (12% of all occurrences), 1,525,016 bytes and 130 more variants. It is not a Windows system file. The process starts when Windows starts (see Registry key: Run, MACHINE\Run, TaskScheduler, User Shell Folders, MACHINE\User Shell Folders, DEFAULT\Runonce). The program has a visible window. Update.exe is digitally signed. Update.exe is able to monitor applications.
If Update.exe is located in a subfolder of "C:\Program Files\Common Files", the security rating is 44% dangerous. The file size is 910,296 bytes (57% of all occurrences), 19,456 bytes or 912,344 bytes. The file is not a Windows system file. The program is not visible. The process is loaded during the Windows boot process (see Registry key: Run, MACHINE\Run, TaskScheduler, User Shell Folders, MACHINE\User Shell Folders, DEFAULT\Runonce). Update.exe appears to be a compressed file.
If Update.exe is located in a subfolder of C:\Windows, the security rating is 74% dangerous. The file size is 13,179,660 bytes (18% of all occurrences), 7,184,007 bytes and 8 more variants.
If Update.exe is located in a subfolder of C:\, the security rating is 46% dangerous. The file size is 2,103,888 bytes (33% of all occurrences), 87,040 bytes or 14,336 bytes.
If Update.exe is located in a subfolder of C:\Windows\System32, the security rating is 44% dangerous. The file size is 9,216 bytes (33% of all occurrences), 2,211,841 bytes or 450,560 bytes.
If Update.exe is located in the user's "Documents" folder, the security rating is 92% dangerous. The file size is 5,297,152 bytes (50% of all occurrences) or 409,088 bytes.
If Update.exe is located in a subfolder of Windows folder for temporary files, the security rating is 72% dangerous. The file size is 1,526,552 bytes (50% of all occurrences) or 8,113,386 bytes.
If Update.exe is located in the Windows folder for temporary files, the security rating is 64% dangerous. The file size is 175 bytes (50% of all occurrences) or 238,080 bytes.
If Update.exe is located in the C:\Windows folder, the security rating is 71% dangerous. The file size is 302,510 bytes (50% of all occurrences) or 331,697 bytes.
If Update.exe is located in the C:\Windows\System32 folder, the security rating is 76% dangerous. The file size is 1,141,248 bytes.
If Update.exe is located in a subfolder of the user's "Documents" folder, the security rating is 40% dangerous. The file size is 37,888 bytes.

External information from Paul Collins:
There are different files with the same name:

"Automatic Windows Updater" definitely not required. Added by the GAOBOT.AO WORM!
"OrbitUpdate" definitely not required. Xupiter OrbitExplorer toolbar, drive-by foistware
"System Update2" definitely not required. Added by the AUTOTROJ-C TROJAN!
"Update Service" must run at start up. Loaded by Handybits programs such as EasyCrypto. Re-instates itself every time the program is run so best to leave it enabled. Prevent it dialling out via a firewall
"Windows Update" definitely not required. Added by the DELF-FN TROJAN!

Important: Some malware also uses the file name Update.exe, for example Backdoor:Win32/Xtrat.A or VirTool:Win32/VBInject.DD (detected by Microsoft), and TROJ_SPNR.11L911 or TROJ_GEN.RCBCDA2 (detected by TrendMicro). Therefore, you should check the Update.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.

Score

User Comments

Is related to the application FACEIT, and may not be related to malware
TakingAGuess

Located in Desktop/(username)/AppData/Local/Microsoft/Teams. Not essential to me, as I don't use Teams.
James Jensen

what is it doing on my start up page every time Iuse my PC
TRICIA BEARDOW

The larger files aside, Discord (as well as the Discord Canary variant) has a file called Update.exe that's responsible for actually handling updates: when closing the updater screen, the process also terminated. File size for both of them is 1,488 kB. Please mind that you do NOT want to download anything from that site by the looks of it.
Max van Boven (further information)

one version that says Github and locates into Yahoo Messanger (new one), this one is legit mostly to update Yahoo Messanger...you can stop it by disabling on start up
John

Part of FlickrUploadrWindows and not flagged by MalwareBytes
Brian Abrahams

found with location c:\windows\syswow64\config\sysprofile\appdata with IP address 74.125.196.139 identified as Google Inc. Charter Security Suite as F-Secure identified it as a possible threat trying to make internet connection.

i have a updater exe trying to run from my internet cache nothing should be trying to update from that section of a computer or even running as a separate program outside of a browser
tom

More comments can be found here:
(further information)

Summary: Average user rating of Update.exe: based on 81 votes with 9 user comments. 24 users think Update.exe is essential for Windows or an installed application. 4 users think it's probably harmless. 16 users think it's neither essential nor dangerous. 8 users suspect danger. 29 users think Update.exe is dangerous and recommend removing it. 15 users don't grade Update.exe ("not sure about it").

Best practices for resolving Update issues

A clean and tidy computer is the key requirement for avoiding problems with Update. This means running a scan for malware, cleaning your hard drive using 1cleanmgr and 2sfc /scannow, 3uninstalling programs that you no longer need, checking for Autostart programs (using 4msconfig) and enabling Windows' 5Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the 6resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or executing the 7DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To get your computer running as fast as it did on day one, you can 8reset your PC. Your personal files will remain intact, but any programs you installed will need to be reinstalled.

To help you analyze the Update.exe process on your computer, the following programs have proven to be helpful: ASecurity Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. A good Bantivirus software detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

igfxcuiservice.exe igfxem.exe daodx.exe Update.exe googlecrashhandler64.exe mbamservice.exe hipatchservice.exe applemobiledeviceservice.exe spoolsv.exe isuspm.exe spyprotector.exe [all]

	Do you have additional information?
What do you know about Update.exe:
How would you rate it:
Link for more info:
Your Name: