Readers help support Windows Report. We may get a commission if you buy through our links.
Read our disclosure page to find out how can you help Windows Report sustain the editorial team. Read more
Many users have reported upfc.exe process running on their Windows computers and don’t know what it means. Also, some have noticed some issues with the executable. Hence, this article will discuss upfc.exe and how to disable it.
Also, you may be interested in our article about exe files deleting themselves on Windows 11 and ways to fix it.
What is upfc.exe?
Upfc.exe is an executable file associated with the Updateability From SCM process. It is part of the Microsoft Windows OS Software developed by Microsoft. This executable file does the following:
- Facilitates the update ability of software components through the software configuration management (SCM) system.
- Updateability from SCM is a core system component that can update or modify software components.
- It ensures updates are consistently applied in a controlled manner.
- Also, it minimizes the risk of introducing errors or conflicts.
Should I disable upfc.exe?
As said in the previous section, upfc.exe is a legitimate file developed by Microsoft for the Windows OS.
It is essential for system functionality because software systems often require updates to fix bugs, add new features, or address security vulnerabilities. So, the update from SCM software is not considered malicious.
However, a corrupt upfc.exe may threaten the system’s security or if it’s camouflaging as a virus. It can cause high CPU usage and result in a significant reduction in computer performance.
How to verify if upfc.exe is safe or a virus
We recommend you review some verification processes to determine whether upfc.exe is unsafe and should be disabled. Go through the steps below:
- Check the file location – Verify if the upfc.exe process on your PC is in the legitimate directory:
C:\Windows\System32 - Verify the file’s digital signature – The digital signature should be by Microsoft to ensure its legitimacy.
- Check the spelling – The original file name is upfc.exe. So any other name variations are not genuine.
How can I disable upfc.exe?
1. End task for upfc.exe
- Right-click the Start button and select Task Manager from the menu.
- Go to the Processes or Details tab. Select the upfc.exe from the list, right-click on it, then click End Task from the drop-down menu.
- Click OK to confirm that you want to end the task for the program.
- Restart your PC.
Ending the file process on your PC will stop its software activities and mitigate any threats it can cause the system. Check our article for more shortcuts to open Task Manager on your PC.
2. Remove the dashost.exe file via File Explorer
- Right-click the Start button and select Task Manager from the menu.
- Locate the upfc.exe in the Processes or Details tab. Right-click on it and click on Open File Location from the drop-down menu.
- Right-click on the upfc.exe file and delete it.
- Restart your computer and check if its process still runs.
Removing the executable file in File Explorer will disable the malicious software.
- How to Delete Windows 11 Saved Passwords
- How to Download DirectX 12 Agility SDK [Installation Guide]
- How to Open PPTX File in Windows 11? Use These 4 Ways
- How to Install Windows 7 Icons on Windows 11
In conclusion, you can check our detailed guide on why exe files are not opening on Windows PC and some fixes for the problem.
Also, you may be interested in antivirus software blocking .exe files on the PC and ways to resolve it.
Should you have further questions or suggestions, kindly drop them in the comments section.
Henderson Jayden Harper
Windows Software Expert
Passionate about technology, Crypto, software, Windows, and everything computer-related, he spends most of his time developing new skills and learning more about the tech world.
He also enjoys gaming, writing, walking his dog, and reading and learning about new cultures. He also enjoys spending private time connecting with nature.
Upfc.exe file information
The process known as Updateability From SCM belongs to software Microsoft Windows Operating System by (www.microsoft.com).
Description: Upfc.exe is an important part of Windows, but often causes problems. Upfc.exe is located in a not identifiable folder.
It is a Windows core system file. The program is not visible. Upfc.exe is certified by a trustworthy company. Upfc.exe is a trustworthy file from Microsoft.
Therefore the technical security rating is 2% dangerous, but you should also take into account the user reviews.
Uninstalling this variant:
You can also uninstall the associated program (Start > Control Panel > Uninstall a Program > Microsoft Windows) or consult Microsoft’s Customer Service.
Recommended: Identify upfc.exe related errors
Important: Some malware camouflages itself as upfc.exe. Therefore, you should check the upfc.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer’s security. This was one of the Top Download Picks of The Washington Post and PC World.
Best practices for resolving upfc issues
A clean and tidy computer is the key requirement for avoiding problems with upfc. This means running a scan for malware, cleaning your hard drive using 1cleanmgr and 2sfc /scannow, 3uninstalling programs that you no longer need, checking for Autostart programs (using 4msconfig) and enabling Windows’ 5Automatic Update. Always remember to perform periodic backups, or at least to set restore points.
Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the 6resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the 7DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.
To help you analyze the upfc.exe process on your computer, the following programs have proven to be helpful: ASecurity Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. BMalwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.
Other processes
airtostrong.exe fastan~1.dll iseekdeal.dll upfc.exe winwordc.exe registryreviver.exe ipmgui.exe cameramonitor.exe flvtoyoutubedownloader.redesign.exe pccnotifications.exe penwes.exe [all]
Every once in a while, I run procmon (Process Monitor) on boot, searching for new things that run as SYSTEM. This is a good technique to know what actually runs on your Windows computer and learn new stuff. Every time I do so, I run into something neat that lead me to discover a small new service in Windows. You can do the equivalent process using bootchart in Linux based systems.
This time, I found a small service, named upfc.exe. I discovered this process is part of the Windows Update self healing mechanism. In this post I will describe the service, it’s task and try to answer the question whether there exist any security issues in this service.
Discovery
Upon loading the procmon boot log, there is a huge deluge of data. To find interesting tidbits of information, I filter by username and process start time and get going. After a small bit of scrolling I see upfc.exe, and I think what the heck?
What the heck is that and what does “Updateability from SCM” even mean? This happens very early in the boot process.
When faced with an unknown binary, a good search engine should be your first port of call. However, there are less than 400 results and none of them answer precisely what the executable does. There are hints that upfc.exe is part of the Windows Update process, but no explanation for it’s role.
The next step, was running strings on the executable, hoping for some hints or a full answer.
Running strings on the executable file provided no clear answers. A single string provided a strong clue, “Microsoft-Windows-WaasMedic-Enable-Remediations”. From this string, we can assume that upfc.exe relates to “Windows Update Medic Service (WaaSMedicSVC)”.
This tells us what WaaSMedic relates to, Windows Update health check, but not what this executable actually does.
A few more strings give us pointers to related programs or services, such as sihclient.exe, or “antimalwareLight” that provide context on where upfc fits in in the grand scheme of Windows. Strings like “antimalwareLight” provide context, for example, that upfc happens early in the boot process (but we knew that..) but again nothing helpful for understanding upfc itself.
Onwards to observe what the executable actually does when running. We can do this directly through procmon.
Looking at registry keys, we see upfc.exe accesses Computer\HKEY_LOCAL_MACHINE\SYSTEM\WaaS and its sub keys Upfc and WaaSMedic. Upfc doesn’t seem to have interesting values, most seem related to when it runs.
UPFC registry values
But WaaSMedic sounds interesting. Without knowing anything about that particular service, the subkeys suggest there exists a mechanism for the WaaSMedic service.
Plugins implement different functionalities such as checking executable file health (signatures and metadata), correctness of background scheduled tasks and services.
But all this is can be talked about in a future blog post. Lets return to UPFC.
Opening up UPFC
At some point, we need to open up the program in a disassembler. The main function of upfc.exe is very readable in IDA.
The rough pseudo code is as follows (omitting error checking and logging)
- Check command line parameters
- Check if another instance is in progress through the registry
- If so, quit
- Mark that upfc is running through the registry
- Call Upfc::PerformDetectionAndRemediationIfNeeded
- Call Upfc::LaunchWaasMedicIfAllowed
- Call Upfc::LaunchSihIfAllowed
- Mark that upfc is not running
This is short and readable (besides the weird usage of the registry instead of a Mutex object) and the core function is clearly Upfc::PerformDetectionAndRemediationIfNeeded.
This function does a few things
- Check if the details of the windows service WaaSMedicSVC, match what’s listed in a configuration file.
The configuration file is stored at %windir%\WaaS\Services\ alongside a few additional files. The data is stored in XML and the data stored is unsurprising considering the context we have so far. Each file describes a specific service, specifying different settings such as service dependencies, description, run trigger, ACL and so forth.
Our service, upfc, compares each item in the XML file versus the matching registry value saved under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc, looking for values that don’t match. Keys checked include the name, the DLL to launch, the DACL covering the registry key, and so forth. A change in any of them can indicate a system malfunction or a security breach.
The other files also describe Windows services relating to Windows Update. For the curious, the services covered by the XML files are BITS, Delivery Optimisation,WaaSMedic, Windows Update Agent, Trusted Installer and the Update Session Orchestrator Service. But UPFC only checks the state of WaaSMedic.
- If the WaaSMedicSvc service is invalid for some reason, such as invalid registry settings, the upfc program recreates the service according to the XML file.
In addition, it updates a telemetry provider with the changes it performed.
After Upfc::PerformDetectionAndRemediationIfNeeded runs, the main function may launch WaaSMedic and SiH, both external binaries.
Can we do anything with this?
Now that we understand the binary, we can think about the context in which it runs
To check for trivial security problems, I examined the ACLs on the configuration files and folders. This is an important check because if anyone could change these files, they could override services that run with SYSTEM privileges in Windows.
ACL details for one of the files under C:\Windows\WaaS\services
Unsurprisingly, only TrustedInstaller and administrators can modify the configuration files describing the services. TrustedInstaller is a special built in service, used by Windows as a security feature to prevent Windows app folders and system files from being altered by users and malware.
These security settings mean that there are zero security concerns as anyone who can interfere with the ACLs guarding these files is already on the other side of the administration airlock.
However, if anyone changed these files, they’d have a nice persistent privilege escalation ability. Since upfc would consistently change the permissions and values for sensitive registry keys (such as what executable a system service would run), an attacker could modify one of the services to point at malicious binaries, allowing attackers to run code with SYSTEM permissions.
And that was a fun hour of playing around 
At this point, we now understand one more small piece of the Windows Update process.
In future posts, I’ll look into WaaSMedic and whether it truly has a plugin ability.
Upfc.exe executable file belongs to a malicious application that can properly be recognized as a coin miner trojan. That malware form utilizes your PC components to mine cryptocurrencies, generally – Monero or DarkCoin1. It makes your system pretty much unfunctional as a result of high CPU usage.
What is Upfc.exe process?
Upfc.exe is a malicious process created by coin miner virus
As I have actually mentioned in the introduction, Upfc.exe is a coin miner virus. The names of the .exe file may be different, however, the consequences are usually the identical. Since coin miners aim at cryptocurrency mining, they use all possible hardware capacity of your PC to run this process. This malware doesn’t pay attention to the fact that you probably want to use your desktop for other activities – it will always take over 80% of your CPU power.
Upfc.exe – Extremely high CPU as well as GPU usage
Besides CPU utilization, some of the coin miners also make use of GPU power for their tasks. In that case, you will probably struggle also to see the mouse arrow moving – GPU is usually utilized on 100%. It is not as critical as CPU for system work, so Upfc.exe coin miner viruses don’t waste time on trifles and use all of it. It often may result in sad effects.
Shortly about cryptocurrency mining
Crypto mining term means the activity of calculating the transaction block hash. That is a basic element of any project based on the blockchain technology. Since this action takes a lot of calculations, a very strong machine is needed. Exactly, the GPU is better for this purpose, because they have more cores available. Cryptocurrency mining farms usually consist of tens and hundreds of GPUs to complete their task efficiently. Such computer systems are not usable for “classic” purposes, like gaming or web browsing. Crooks who gain money via this coin miner use someones’ hardware instead, even if they are used for the regular activity.2
List of the typical coin miner symptoms
How dangerous is the Upfc.exe miner?
Coin miners does not deal damage to your files. However, they make a lot of unpleasant things with the whole system
Initially, Upfc.exe virus makes your computer overloaded. It is unable to run your applications now, as all CPU power is consumed by a malware. That malware does not care for your needs, all it focuses on is generating income on you. Even if you are patient, and you waited until web browser is open, you will likely struggle with exceptionally slow performance. Pages will open for years, any sort of logins will take about a minute – just a headache for a person that does a job online.
Upfc.exe Technical Summary.
“Visible” harm is not a single bad thing coin miners perform to your personal computer. Upfc.exe coin miner likewise deals damage to your OS. To execute all malevolent functions properly, it wrecks the protection features of your system. You will likely see your Microsoft Defender disabled – malware stops it to avoid detection. If you open the HOSTS file, you will likely see a lot of new entries – they are added by this coin miner to connect your system to a malicious mining network. All these adjustments are about to be gone back to the original in the process of system recovery.
Hardware effects of coin miner activity
Besides decreasing your system’s performance, performing at peak level for long times may trigger damage to your machine as well as increase power expenses. PC elements are designed to easily deal with high load, but they can do so only when they are in a good shape.
Tiny and covered processor cooling system is not very easy to damage. Meanwhile, graphic cards have big and easy-to-access rotors, which can be easily broke if affected while working, for instance, by the user much before the malware injection. Malfunctioning cooling system, together with the very high load caused by Upfc.exe can easily lead to GPU failure3. GPUs are also prone to have fast wearing when utilized for cryptocurrency mining. It is surely an undesirable case when your GPU’s performance decreases on 20-30% only after 1-2 weeks of being used in such a way.
How did I get Upfc.exe coin miner virus?
Coin miners are spread through different ways, but their main sources are malicious banners and programs from dubious sources
Coin miners are the most prevalent malicious programs through “severe” malware. Adware often functions as a carrier for Upfc.exe malware injection: it demonstrates you the banners, which contain a link to malware downloading. Sure, this abstract “malware” may belong to any type – another adware, spyware, rogue or backdoor. But the statistics say that approximately 30% of all malware spread with the malevolent banners are coin miners – and Upfc.exe is right one of them.4
The example of malicious banners you can see in the Internet
Another way you could get this item on your computer is by downloading it from the unreliable web page as a part of a program. People that spread hacked variants of well-known programs (which do not require the license key) have small chances to make money. For this reason, there is a very big temptation to add in malware to the final package of the hacked application and receive a coin for every installation. Prior to blaming these individuals for hacking and malware spreading, ask yourself – is it okay to avoid paying for the program in this manner? It is much cheaper to pay $20-$30 one time than to pay a much bigger figure for antivirus program as well as new parts for your PC.
How to remove the Upfc.exe miner from my PC?
The best way to get rid of this coin miner virus is to use anti-malware software
Getting rid of such a virus demands the use of specific app. Effective antivirus should have high performance at scanning and be lightweight – in order to create no problems with usage even on weak computers. Furthermore, it is recommended to have on-run protection in your protection solution – to prevent the virus even before it starts. Microsoft Defender lacks these elements for different factors. That’s why I’d advise you to use a third-party anti-malware program for that objective. GridinSoft Anti-Malware is a superb option that fits each of the specified characteristics.5
Before the malware removal, it is important to boot your system into Safe Mode with Networking. Since Upfc.exe miner consumes a lot of CPU capacity, it is required to stop it before launching the security program. Otherwise, your scan will last for years, even though the GridinSoft program is pretty lightweight.
Booting the PC into Safe Mode with Networking
Press the Start button, then choose Power, and click on Reboot while holding the Shift key on the keyboard.
Windows will reboot into recovery mode. In that mode, choose Troubleshoot→ Startup Settings→ Safe Mode with Networking. Press the corresponding button on your keyboard to choose that option.
When your PC is in Safe Mode, all third-party programs, along with the majority of non-critical operating system components, are not launched with the system start. That allows you to clean the system without dealing with high CPU usage of the coin miner.
Remove Upfc.exe coin miner virus with GridinSoft Anti-Malware
Download and install GridinSoft Anti-Malware. You can use this anti-malware program for free during its 6-day trial period. In that term, all functions are available, and it takes no payments to remove malware from your system.
After activating your free trial, start Full scan. It may last up to 10 minutes. You may use the PC as usual.
When the scan is finished, press the Clean Now button to remove all detected elements from your system. This procedure takes less than a minute.
Now, you are good to go. Reboot your PC into a normal Windows mode and use just as there was nothing malicious.
Remove Upfc.exe Virus ⛏️ Trojan Coin Miner
Name: Upfc.exe
Description: The Upfc.exe is a Trojan Coin Miner that uses the infected computer’s sources to mine electronic money without your authorization. This Upfc.exe will create your CPU to go for very warm temperatures for prolonged periods of time, which could reduce the life of the CPU.
Operating System: Windows
Application Category: Trojan
References
- Read about why Monero and DarkCoin are so popular amongst cybercriminals.
- Detailed explanation of how does cryptomining work.
- About unwanted effects for GPUs in the process of cryptomining.
- Read more about various malware type on Cybersecurity Glossary.
- Our review on GridinSoft Anti-Malware.
Spanish Turkish
Windows 10: The program or feature «\??\C:\Windows\System32\Upfc.exe» cannot start or run due to…
Discus and support The program or feature «\??\C:\Windows\System32\Upfc.exe» cannot start or run due to… in Windows 10 Installation and Upgrade to solve the problem; booted up my PC as usual Windows 10 22h2 after work and found this Information event in the Event Viewer; it lists exactly as the title describes «The…
Discussion in ‘Windows 10 Installation and Upgrade’ started by The Ham, Jul 13, 2023.
-
The program or feature «\??\C:\Windows\System32\Upfc.exe» cannot start or run due to…
booted up my PC as usual Windows 10 22h2 after work and found this Information event in the Event Viewer; it lists exactly as the title describes «The program or feature «\??\C:\Windows\System32\Upfc.exe» cannot start or run due to incompatibity with 64-bit versions of Windows. Please contact the software vendor to ask if a 64-bit Windows compatible version is available.»is this harmless or is something wrong…? I checked through Event Viewer,
-
Weird setup.exe popup on windows start
Incidently, in doing that my instant messanging program GAIM no longer works. I can probably just uninstall it and reinstall it. Heres new log, and you fixed the the start up window thing I was getting. Thanks!
-
Weird setup.exe popup on windows startAnything else?
-
The program or feature «\??\C:\Windows\System32\Upfc.exe» cannot start or run due to…
Windows cannot find C:\WINDOWS\system32\rundll32.exe
THANKS JOY KEMPRAI,
THE ERROR MESSAGE «87» FOR YOUR KIND ASSISTANCE PLEASE. THANK YOU.
Microsoft Windows [Version 10.0.10586]
(c) 2015 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>DISM.exe/online/cleanup-image/scanhealth
Deployment Image Servicing and Management toolVersion: 10.0.10586.0
Error: 87
The online/cleanup-image/scanhealth option is unknown.For more information, refer to the help by running DISM.exe /?.
The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.logC:\WINDOWS\system32>
Microsoft Windows [Version 10.0.10586]
(c) 2015 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>administrator:command promptThe filename, directory name, or volume label syntax is incorrect.
C:\WINDOWS\system32>c:
C:\WINDOWS\system32>DISM.exe/online/cleanup-image/scanhealth
Deployment Image Servicing and Management toolVersion: 10.0.10586.0
Error: 87
The online/cleanup-image/scanhealth option is unknown.For more information, refer to the help by running DISM.exe /?.
The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log
C:\WINDOWS\system32>DISM.exe/online/cleanup-image/restorehealth
Deployment Image Servicing and Management toolVersion: 10.0.10586.0
Error: 87
The online/cleanup-image/restorehealth option is unknown.For more information, refer to the help by running DISM.exe /?.
The DISM log file can be found at C:WINDOWS\Logs\DISM\dism.log
C:\WINDOWS\system32>
The program or feature «\??\C:\Windows\System32\Upfc.exe» cannot start or run due to…
-
The program or feature «\??\C:\Windows\System32\Upfc.exe» cannot start or run due to… — Similar Threads — program feature WindowsSystem32Upfc
-
Why two exe programs cannot be run at the same time?
in Windows 10 Gaming
Why two exe programs cannot be run at the same time?: The situation happens when running report view .exe program for generating pdf and excel which needs 30mins to complete, and then i start to run another .exe via Task Scheduler, and it fails to run.But the programs work normally when the report review program completed the… -
Why two exe programs cannot be run at the same time?
in Windows 10 Software and Apps
Why two exe programs cannot be run at the same time?: The situation happens when running report view .exe program for generating pdf and excel which needs 30mins to complete, and then i start to run another .exe via Task Scheduler, and it fails to run.But the programs work normally when the report review program completed the… -
Why two exe programs cannot be run at the same time?
in Windows 10 BSOD Crashes and Debugging
Why two exe programs cannot be run at the same time?: The situation happens when running report view .exe program for generating pdf and excel which needs 30mins to complete, and then i start to run another .exe via Task Scheduler, and it fails to run.But the programs work normally when the report review program completed the… -
The program or feature «\??\C:\Windows\System32\Upfc.exe» cannot start or run due to…
in Windows 10 Gaming
The program or feature «\??\C:\Windows\System32\Upfc.exe» cannot start or run due to…: booted up my PC as usual Windows 10 22h2 after work and found this Information event in the Event Viewer; it lists exactly as the title describes «The program or feature «\??\C:\Windows\System32\Upfc.exe» cannot start or run due to incompatibity with 64-bit versions of… -
The program or feature «\??\C:\Windows\System32\Upfc.exe» cannot start or run due to…
in Windows 10 Software and Apps
The program or feature «\??\C:\Windows\System32\Upfc.exe» cannot start or run due to…: booted up my PC as usual Windows 10 22h2 after work and found this Information event in the Event Viewer; it lists exactly as the title describes «The program or feature «\??\C:\Windows\System32\Upfc.exe» cannot start or run due to incompatibity with 64-bit versions of… -
«This Program Cannot be Run in DOS Mode» NOT a Windows exe
in Windows 10 Gaming
«This Program Cannot be Run in DOS Mode» NOT a Windows exe: I’m trying to run Rise of the Robots and many other DOS games using DOSBox for the first time in a long time, but it keeps telling me «This Program Cannot be Run in DOS Mode» why?! What’s pissing me off is that I was able to run them before but now for some reason I… -
«This Program Cannot be Run in DOS Mode» NOT a Windows exe
in Windows 10 Software and Apps
«This Program Cannot be Run in DOS Mode» NOT a Windows exe: I’m trying to run Rise of the Robots and many other DOS games using DOSBox for the first time in a long time, but it keeps telling me «This Program Cannot be Run in DOS Mode» why?! What’s pissing me off is that I was able to run them before but now for some reason I… -
Start an exe program in FreeDOS?
in Windows 10 Software and Apps
Start an exe program in FreeDOS?: Hello all together just trying to reinstall windows in FreeDos from my sticker.Is it even possible to start the setup.exe or do I have to look for another way?
Do I have to drag extra files onto the stick or is there a possibility?
Picture as attachment…
-
Cannot Run An .Exe file
in Windows 10 Support
Cannot Run An .Exe file: I’ve got maybe two problems:. I put the .exe file folder in the system path but still get a ‘file not found’ error when it is called from another prog.
and that should have been foolproof because I used the ‘browse’ thing.
So that’s maybe a problem with the path thing.
….