Program file
aupdate.exe: the Symantec LiveUpdate process
aupdate.exe is the Automatic LiveUpdate module of Symantec software. It connects to the Internet, checks for updates and installs them for Symantec antivirus, system and security products. The genuine file is safe and sits in a subfolder of C:\Program Files. Do not delete it by hand.
Prefer to check it yourself? The manual checks follow.
aupdate.exe in a Symantec folder under C:\Program Files is part of LiveUpdate, the tool most Symantec antivirus, system and security programs need to stay up to date. It is safe and you should keep it while you use that software.
A file with this name in C:\Windows, System32 or a user profile is not where LiveUpdate installs. Malware is known to copy the names of trusted updaters, so check the folder and the signature of a copy you do not expect.
- Publisher
- Symantec
- Program
- LiveUpdate, required by most Symantec antivirus, system and security software (listed by file.net also under TMAgent for one variant)
- Function
- Connects to the Internet, checks for available updates, then downloads and installs them
- Process name
- Automatic LiveUpdate Module; the name stands for Automatic Live Update
- Genuine folder
- A subfolder of C:\Program Files, the folder of the Symantec program
- Known file sizes
- 308,600 bytes is the most common; file.net also lists 243,392, 623,984, 624,248 and 226,504 bytes
- Window and signature
- No visible window; the genuine builds listed by file.net are digitally signed
- Windows file
- No, it is not essential for Windows; it is essential for keeping Symantec software current
What aupdate.exe does
aupdate.exe is an essential component of the LiveUpdate tool, which most Symantec antivirus, system and security programs require. LiveUpdate uses aupdate.exe to connect to the Internet, check for available updates, and download and install them.
The file keeps Symantec software up to date, so that it has the most recent functions and does not suffer instability or other serious problems. It is not a Windows component and Windows runs without it, but the Symantec program that depends on it stops receiving updates if the file is removed.
About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.
How to check it
The file is trusted when it is in the folder of a Symantec program you installed and is signed.
- Find the process in Task Manager. Press Ctrl+Shift+Esc and look for aupdate.exe or Automatic LiveUpdate Module on the Processes or Details tab. It has no window and runs only while LiveUpdate works.
- Open the file location. Right-click the process and choose Open file location. The genuine file is in a subfolder of C:\Program Files that belongs to the Symantec product. C:\Windows and C:\Windows\System32 are folders where malware is known to hide under this name.
- Check the digital signature. Right-click the file, choose Properties, then Digital Signatures. The signer should be the publisher of your Symantec product. In PowerShell, using the path from the previous step:
Get-AuthenticodeSignature "<path to aupdate.exe>" | Format-List Status, SignerCertificate - Confirm you use Symantec software. Open Settings > Apps > Installed apps and look for LiveUpdate or a Symantec security product. If none is installed, nothing should be running aupdate.exe.
- Scan the PC. Run a full scan and an offline scan with Microsoft Defender (Windows Security > Virus & threat protection > Scan options).
A signed file in the right folder is the genuine updater. It cannot show that the rest of the PC is clean, so scan as well.
Do you need aupdate.exe?
Yes, as long as you use Symantec software. Do not, under any circumstances, delete aupdate.exe by hand. If you no longer use Symantec software, remove the program the proper way.
- Keep it while Symantec software is installed. Without aupdate.exe, LiveUpdate cannot fetch updates, and the security program may become out of date or unstable.
- Do not delete the file. Deleting it by hand breaks LiveUpdate. If an update fails, repair or reinstall the Symantec program instead.
- Uninstall the program, not the file. If you no longer want Symantec software, open Settings > Apps > Installed apps, select LiveUpdate or the Symantec product and choose Uninstall. file.net says the file can be removed safely this way if it causes problems.
- If the file is not Symantec's. If the checks show an aupdate.exe outside a Symantec folder, or on a PC with no Symantec software, run a full scan and an offline scan with Microsoft Defender and let it remove the threat.
Warning signs
| What you see | What it means |
|---|---|
| aupdate.exe in C:\Windows, System32 or a user profile | Not a LiveUpdate location. file.net warns that malware camouflages itself as aupdate.exe in the Windows folders. |
| No Symantec software on the PC | Nothing should need this updater, so a copy is suspect. |
| No digital signature or no publisher information | The genuine builds are signed. file.net rates an unsigned variant under C:\Program Files\Common Files with no author information as more dangerous. |
| aupdate.exe running all the time, or sending data constantly | LiveUpdate checks run in short bursts. A permanent process with network activity is not that pattern. |
| Several copies of aupdate.exe at once | A single updater is expected. Several copies point to an imitation. |
Questions people ask
Is aupdate.exe a virus?
Not when it is in a Symantec folder under C:\Program Files and signed. It is the Automatic LiveUpdate module, a component of Symantec software. A copy in the Windows folders, or on a PC without Symantec software, should be checked, because malware can use the name of a trusted updater.
What does aupdate.exe do?
It lets LiveUpdate connect to the Internet, check for available updates, then download and install them. Most Symantec antivirus, system and security programs depend on it, so that they keep their latest functions and avoid instability or other serious problems.
Can I delete or disable aupdate.exe?
Do not delete it, as the old page says, because LiveUpdate would stop working and the Symantec program would fall behind on updates. If you no longer use the Symantec software, uninstall it in Settings > Apps instead of deleting the file by hand.
Where is aupdate.exe located?
In a subfolder of C:\Program Files that belongs to the Symantec product. A variant that file.net lists under C:\Program Files\Common Files, without author information, is rated more suspicious than the others. Anything in C:\Windows or C:\Windows\System32 is not where LiveUpdate installs.
Why does aupdate.exe connect to the Internet?
Because that is its job: it checks for updates and downloads them for the Symantec product. The connection should be short and go with a LiveUpdate run. A copy that connects all the time, or exists without Symantec software, should be checked and scanned.
Do I still need it if I switched to another antivirus?
No. If you removed the Symantec software, nothing needs LiveUpdate any more, and leftover files can be removed by uninstalling LiveUpdate in Settings > Apps. Do not delete files by hand. Run a full Microsoft Defender scan if a copy remains in another folder.
Sources
- file.net: aupdate.exe Windows process
- Glarysoft: AUPDATE.EXE Windows process
- Microsoft Learn: Microsoft Defender Offline
Version data read on Oct 5, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…