wcupdater.exe: what it is, is it a virus, and how to check and remove it
wcupdater.exe is not a Windows file, and a security-tool page calls it a trojan, but no one has published a hash, folder or behaviour that proves it. Check your own copy's folder, signature and start-up entry, and remove it only when it is not a program you use.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Fake wcupdater.exe files rarely come alone; an automatic scan looks for the rest of the infection.
Do it yourself · free Remove wcupdater.exe yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Wcupdater.exe: summary
| Type | Unverified file (wcupdater.exe) that start-up reports and a security vendor call a trojan; not a Windows file |
|---|---|
| Risk | Unknown. A trojan would be serious (extra malware, stolen passwords); nothing public proves it is one |
| Symptoms | A Windows prompt asking whether it may make changes (2018); an "unsupported 16-bit application" message at every start on Windows 7 (2018) |
| How to get rid of it | Check the folder and signature, disable the start-up entry, uninstall its program, delete the file, then run a full and an offline Microsoft Defender scan |
| Our check (6 October 2026) | No sample available; public reports only, no technical report found. Not cleared, not confirmed |
| First reported by us | 5 April 2021 (first public reports found: September 2018) |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 12 more facts
| Detection names | No Microsoft detection name is known. One vendor page lists TROJ.WCUPDATER.EXE, with no hash or behaviour |
|---|---|
| Name | Wcupdater.exe |
| Evidence | 3 reports from affected users and security sites; details still limited |
| File name | wcupdater.exe |
| Description | No description found in any source we read |
| What it is | Of unknown origin |
| Role | Unknown; the name suggests an updater of a program starting with W and C |
| Fake copies seen in | %AppData%, %Temp% or %ProgramData% |
| First seen | 5 April 2021 |
| Distribution | Left by an unwanted program or its uninstaller |
| Damage | Usually low; it can restart the unwanted program |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against public forum reports of 2018, Microsoft's documentation and a security vendor page. We had no sample of the file and ran no test.
What the wcupdater.exe file is
What wcupdater.exe is, and what is not known about it
wcupdater.exe is not a Windows file. Microsoft does not ship a program with that name, and we could not tie it to one named, signed program. That is why two things are true at once: the old claim that it is a trojan was never backed by a technical report, and no one has shown that it is harmless either.
- File
wcupdater.exe, usually written in capitals (WCUPDATER.EXE) in process lists and in antivirus alerts- Part of Windows
- No. Windows does not install it
- Name suggests
- An updater ("updater") for a program whose name starts with the letters W and C. We could not confirm which program, so treat this as a guess
- Public classification
- One security-tool vendor page lists it as a trojan named TROJ.WCUPDATER.EXE, with no file path, hash or behaviour, and a link to its own removal product
- Publisher and signature
- Not published in any source we read. You can read both on your own PC in a minute, as shown below
So the useful question is not "is wcupdater.exe a virus?" but "which file is it, who signed it, and what starts it?"
What we could check, and what we could not
We have no copy of the file and did not run it, so we claim no lab result. Each gap is named.
Public record · read on 6 October 2026
- A sample of the fileNone available to us. The reports we read name the file but give no hash, size or folder, so we could not test the exact file.
- VirusTotal result in a 2018 forum caseA Windows 7 user wrote that VirusTotal showed no detections for his copy. One person, one copy, 2018; detection lists change.
- The vendor "dangerous" labelThat page has no technical detail and promotes its own cleaner, so it is not evidence.
- What a helper found in the 2018 forum logThe scan log in the German case showed the Web Companion program (Lavasoft) starting with Windows. The thread does not say wcupdater.exe belonged to it, so we make no link.
- Our own test on a clean Windows PCNot done: without a sample there is nothing to run, and a quiet test would not clear it anyway.
- Who signed itUnknown. Check your copy: a valid signature from a known company is a strong sign of a real program.
Unproven either way Nothing we found proves it is malware or that it is safe. Treat your copy as unverified until you have checked its folder, signature and start-up entry.
Is wcupdater.exe safe or a virus?
What was reported about wcupdater.exe, in order
The file became a search topic in autumn 2018, when users on Windows 7 and Windows 10 began asking whether it was a virus. These are the reports that exist.
13 September 2018
A Windows prompt asks about wcupdater.exe
On Microsoft's support forum a user wrote that Windows asked whether a file called wcupdater.exe may make changes to the PC. The only answer, from a forum helper, was practical: find the file, upload it to VirusTotal, and run Malwarebytes AdwCleaner. It did not say what the file is.
22 November 2018
A Windows 7 PC shows an "unsupported 16-bit application" message
A user of Windows 7 Professional 64-bit told a German malware-help forum that this message appeared at every start, that wcupdater was named in it, and that VirusTotal did not confirm a virus. A helper asked for a Farbar Recovery Scan Tool log. The thread does not say what the file turned out to be.
3 December 2018
The same message in another forum
A second Windows 7 user reported the same start-up message. The reply: run AdwCleaner, which is free and needs no installation.
5 April 2021
Our first guide calls it a trojan
Our old guide described wcupdater.exe as a trojan horse that can overheat the CPU, make Windows slow and open the way for other malware. It named no sample, hash or folder.
The artwork of our 2021 guide: an illustration of a trojan horse and a warning sign, not a screenshot of the file or of a scan.
What the old trojan claims get right and wrong
A real trojan can do the things our 2021 guide listed. But the list described trojans in general, and nothing in it was observed with this file. Here is each claim, sorted by how much a reader can rely on it.
- High
A trojan can open the way for other malware
True of real trojans and loaders: one infection often installs the next. If your copy is malware, this is why to remove it fully, not just hide an error message.
- High
Passwords and bank details can be stolen
True of information stealers. If the file is malware, change the passwords saved in your browsers from a clean device afterwards.
- Medium
It runs at every start
This is the one symptom the 2018 reports actually share: a message at Windows start-up. Both unwanted software and leftovers of removed software behave this way.
- Low
CPU overheating and "unrepairable damage"
Not reported for this file by anyone. Software cannot burn out a processor: modern CPUs slow down or shut the PC off to protect themselves. A miner or stuck program can keep the fan loud and the PC slow until it is removed.
- Low
Windows windows slowly minimising and maximising
A general symptom of a busy PC with many other causes: a full disk, too many start-up programs, an old driver. None of the reports we read mention it.
Trojans usually show few symptoms, so a missing symptom clears nothing: check the file itself, not the PC's speed.
How to check the wcupdater.exe file
Do not delete anything yet. Find the file, read its signature, and see what starts it. These steps work in Windows 11 and Windows 10, and the answers decide which of the next sections you need.
- 1
Find where it runs from
Press Ctrl + Shift + Esc. If you see wcupdater.exe or a program with a similar name under Processes or Details, right-click it and choose Open file location. Write down the folder that opens. If it is not running, search C: for
wcupdater*, starting withProgram Files,%AppData%and%Temp%. - 2
Read the file's properties
Right-click the file > Properties. On Details read Product name, Company and File version. A real program names a company. Empty fields are a warning.
- 3
Check the signature
On the Digital Signatures tab, select the signer and click Details. A valid signature from a company you recognise means a real program. No Digital Signatures tab means the file is unsigned. Unsigned is not proof of malware, but with an odd folder it counts against the file.
- 4
Find what starts it
In Task Manager open Startup apps (Windows 11) or Startup (Windows 10) and look for the file or its folder. Then open Task Scheduler, Task Scheduler Library, and look for tasks pointing to the same folder. Microsoft's free Sysinternals Autoruns lists every start-up place at once.
- 5
Upload it to VirusTotal, and read the result honestly
Upload the file to virustotal.com. Several detections with one family name from known vendors are a strong sign. No detections means only that no engine recognised it today.
| What you find | What it most likely means | Do this |
|---|---|---|
A signed file from a company you know, in Program Files, and you installed that program | A real updater of an installed program | Keep it. Update or uninstall the program if you do not want it |
The file is in Program Files, but the company is blank and you do not know the program | A leftover of a program you removed, or a bundled extra | Go to "If the file is unwanted" below |
The file is in %AppData%, %Temp%, Downloads or a folder with a random name | Matches how malware hides | Go to "If the file is unwanted", then scan |
| The file does not exist, but an entry that points to it does | A start-up entry whose program was removed | Remove the entry: see the 16-bit message section |
Where wcupdater.exe comes from
We do not know how any copy reached the PCs in the 2018 reports. These are the routes trojans in general use, worth closing whatever the file turns out to be.
- High
E-mail attachments
A document or archive attached to a fake invoice or delivery notice. Opening it and allowing macros, or running what is inside, starts the payload. The old guide quoted the Virusai.lt site on this.
- High
Bundled downloads
Free programs and download-portal installers can add extra programs in their setup. Choose Custom setup and untick the offers.
- Medium
Rogue websites
Pages that push a fake update, a fake codec or a fake "your PC is infected" alert. The sign is a page that asks you to download something to see a video or fix your PC.
- Medium
Another infection
One malware downloads the next, so a scan may find more than this file.
What to do with wcupdater.exe
How to remove wcupdater.exe
It is usually a leftover of an unwanted program.
Uninstall the program, then delete what remains.
Step 1: Uninstall programs you did not mean to install
Wcupdater.exe rarely comes alone: it is usually installed by, or together with, a free program. In Windows 11 open Settings > Apps > Installed apps, in Windows 10 Settings > Apps > Apps & features, and sort by install date.
Uninstall every entry from the day the trouble began that you did not install on purpose, for example a download manager, a converter or a browser you never chose.
Keep drivers and entries from Microsoft, Intel, AMD, NVIDIA or your PC's maker unless you are sure.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 2: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after wcupdater.exe, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 3: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of wcupdater.exe that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
The "unsupported 16-bit application" message at start-up
This message is the one concrete symptom in the 2018 reports. A 64-bit Windows cannot run 16-bit programs at all. Microsoft states that x64 and ARM versions of Windows do not support 16-bit x86 code of any kind, including DOS programs. So the message means something at start-up tried to launch a file that Windows cannot run.
- 1
Read what Windows is trying to start
The message names the file and its folder. Write them down.
- 2
Look for the entry
Open Startup apps in Task Manager, then Task Scheduler, then Autoruns (Sysinternals). In Autoruns, a missing file shows in yellow with File not found.
- 3
Disable it first, delete it later
Untick the entry in Autoruns, or right-click it in Task Manager > Disable. Restart. If the message is gone and nothing else broke, delete the entry.
- 4
Then judge the file
The message cannot tell a damaged leftover from a fake or an old program. Run the five-minute check on the file it names.
Both 2018 reports were on Windows 7, which Microsoft stopped supporting in January 2020 and which gets no security updates now.
Before you delete: the order that keeps it from coming back
Remove what starts the file first, then the file, then scan. The other way round, the start-up entry can relaunch or recreate it. Do not use a System Restore point as the removal: a restore point can contain the very file you want gone.
Do
- Disable the start-up entry first, restart, and delete only when nothing broke.
- Run the offline scan if the file returns.
Don't
- Download "wcupdater.exe fixers", DLL packs or cleaners from the sites that rank for the name. They are the more likely infection.
- Delete files in
System32because a website says so. wcupdater.exe is not a Windows file. - Rely on Safe Mode or System Restore as the removal itself.
After the check: keep Windows clean
Do
- Open e-mail attachments only from senders you expect, and check the sender's address.
- Download programs from their makers' sites or the Microsoft Store, and pick Custom setup to untick extras.
- Keep Windows Security on with real-time protection, and Windows Update automatic. A reputable antivirus is a layer, not a guarantee.
- Back up your files after the clean-up and keep one copy offline.
- Use the checks above (folder, signature, start-up entry) on any file you doubt.
Don't
- Open attachments or click links in unexpected invoice, parcel or bank e-mails.
- Trust a PC as clean because it feels fast: trojans often show almost no symptoms.
- Skip the backup: a recent copy is the only dependable recovery.
Questions about wcupdater.exe
Is wcupdater.exe a virus?
Not proven either way. wcupdater.exe is not a Windows file, and one security-tool page calls it a trojan, but that page gives no hash, folder or behaviour, and a 2018 forum user found no VirusTotal detections for his copy. So the honest answer is that you have to check your own copy.
Look at the folder it runs from, read its Digital Signatures tab and see which start-up entry launches it. A signed file from a known company in Program Files is probably a real updater. An unsigned file in AppData or Temp, or one several engines detect, should be removed.
What is wcupdater.exe?
We could not confirm which program owns it. The name reads like an updater for a program starting with the letters W and C, but that is only a guess from the name, and no source we read names the publisher.
In 2018 users saw it in a Windows prompt asking whether it may make changes and in a start-up message about a 16-bit application. Since the file's identity is unknown, identify your copy: Task Manager > Open file location > Properties > Details shows the product name and company, if the file has any.
Is it safe to delete wcupdater.exe?
Yes, once you know it is not a program you use, because it is not part of Windows. Disable the start-up entry first (Task Manager > Startup apps, Task Scheduler or Autoruns), restart, and delete the file only if nothing broke.
If it belongs to a program you installed, uninstall that program instead, so it does not look for the file again.
Never delete files from System32 on the advice of a removal website, because wcupdater.exe is not stored there and the real files in that folder are needed by Windows. Note the file name and folder before you delete, in case you need to explain it to a helper.
Why does Windows ask if wcupdater.exe may make changes to my PC?
Because the file asked for administrator rights, and Windows shows the User Account Control prompt for that. The 2018 Microsoft forum case describes exactly this prompt. The prompt names the program and its verified publisher, or says Unknown publisher.
A company you recognise, right after you installed or updated its program, is normal, because installers and updaters often ask for administrator rights. An unknown publisher when you did nothing:
- choose No
- then check the file's folder
- signature before you let it run
What does "unsupported 16-bit application" mean?
It means something tried to start a file that Windows cannot run. Microsoft states that 64-bit (x64) and ARM versions of Windows do not support 16-bit x86 code of any kind, so a file that is old DOS or 16-bit code, or one that is damaged or not a valid program, triggers this message.
At start-up it usually comes from an entry that points to such a file. Open Startup apps, Task Scheduler or Autoruns, find the entry named in the message, disable it, and restart. Then judge the file it pointed to.
Will an antivirus or AdwCleaner remove wcupdater.exe?
A scanner removes it only if the scanner already knows the file. Both 2018 forum cases advised Malwarebytes AdwCleaner, a free tool that needs no installation. Microsoft Defender can do the same with a full scan, and its offline scan finds what hides while Windows runs.
If a scan finds nothing, that is not a clearance: unknown or rare files can pass, and some malware hides until a second scan. Check the folder, signature and start-up entry yourself, and scan again after a restart.
How did wcupdater.exe get onto my PC?
We do not know, and no source we read says. Trojans in general arrive through e-mail attachments, bundled installers from download sites, fake update pages and other malware. Think about what you installed or opened around the day the message first appeared: that is where the file most likely came from.
Check Installed apps for programs you do not remember, sorted by install date, and look in your Downloads folder for installers from that day. If nothing there fits, the file may have come with an e-mail attachment or another infection.
What should I do after removing it?
Run a full Microsoft Defender scan and then the offline scan, restart, and check that the start-up message and the file do not return. If the file was malware, change the passwords saved in your browsers and your e-mail from a different, clean device, turn on two-step verification, and watch your bank statements.
If the file returns after a restart, something is recreating it: look again in Task Scheduler and Autoruns for entries you missed, and run the offline scan once more. Keep your files backed up.
Will Fortect remove wcupdater.exe?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For wcupdater.exe, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Microsoft Learn: NTVDM and 16-bit app support (read October 6, 2026)
- Microsoft Q&A: wcupdater.exe (question of 13 September 2018) (read October 6, 2026)
- Trojaner-Board: Ich habe wcupdater.exe auf dem Rechner - Ein Virus? (November 2018) (read October 6, 2026)
- Dr. Windows forum: wcupdater.exe (3 December 2018) (read October 6, 2026)
- Greatis: WCUPDATER.EXE page (vendor classification, no technical detail) (read October 6, 2026)
- Microsoft Learn: Microsoft Defender offline scan (read October 6, 2026)
- Microsoft Learn: Sysinternals Autoruns (read October 6, 2026)