AsusUpdateCheck.exe reappears after reboot

[Ken429]

I stumbled into the AsusUpdateCheck.exe issue when I was uninstalling AI Suite 3. This program appears in the Windows/System32 folder after each reboot. No matter what I do - stop the service and delete the file - it reappears again after each reboot of the system. I'm sure I'm not the only one that has this situation. In one of the many misleading threads discussing this "program" and all the potential virus infections etc., etc. I did find one thread in Ten Forums that concluded the ASUS BIOS maybe plugging this program into the System32 folder when the system is booted. I am not aware of any problems with my system when this program/service is running but am curious to get a rational explanation of what the the heck is going on and why I'm the only one chasing this mystery.

[fwiler]

You aren't the only one. I can't get rid of it.

[R5Eandme]

fwiler wrote:
You aren't the only one. I can't get rid of it.

So you guys don't see any BIOS setting that enables/disables ASUS LiveUpdate or Armoury Crate?

[Ken429]

Not that i could find after chasing smoke for a couple of hours!

[R5Eandme]

Ken429 wrote:
Not that i could find after chasing smoke for a couple of hours!

That's interesting. The article in TechPowerUp describes the exact symptom of the ASUSUpdateCheck.exe file reappearing in C;\Windows\System32 folder at every reboot no matter what you do.

https://www.techpowerup.com/248827/asus-z390-motherboards-automatically-push-software-into-your-wind...

Quote: 'The ASUS UEFI firmware exposes an ACPI table to Windows 10, called "WPBT" or "Windows Platform Binary Table". WPBT is used in the pre-built OEM industry, and is referred to as "the Vendor's Rootkit." Put simply, it is a script that makes Windows copy data from the BIOS to the System32 folder on the machine and execute it during Windows startup - every single time the system is booted.'

The article explains this is how ASUSUpdateCheck.exe reappears in the C:\Windows\System32 folder. It may be a legitimate ASUS feature but it is very intrusive to copy and execute files in System32 without user knowledge or permission. It also could be that some ASUS UEFI BIOS do not let the user disable the feature and that is why you can't find a disable option in your UEFI BIOS.

[Ken429]

Great detective work! That explains what is going on. I probably looked at this article and once I saw the reference to "Armor Plate" in the BIOS I ignored the rest of it. Looks like ASUS cleaned up their interface on the ROG Hero VII MB and made the whole exercise invisible. The guy on the Ten Forums guessed right! What is really confusing is all the stuff out there in the various forums etc., indicating that this magic from ASUS is some sort of terrible virus. But then again, maybe it's the Chinese government using ASUS to plant a spy in every Windows 10 system using an ASUS MB? Just joking, I think.

[bnpredator]

Ken429 wrote:
I stumbled into the AsusUpdateCheck.exe issue when I was uninstalling AI Suite 3. This program appears in the Windows/System32 folder after each reboot. No matter what I do - stop the service and delete the file - it reappears again after each reboot of the system. I'm sure I'm not the only one that has this situation. In one of the many misleading threads discussing this "program" and all the potential virus infections etc., etc. I did find one thread in Ten Forums that concluded the ASUS BIOS maybe plugging this program into the System32 folder when the system is booted. I am not aware of any problems with my system when this program/service is running but am curious to get a rational explanation of what the the heck is going on and why I'm the only one chasing this mystery.

I found out that in BIOS, You can disable Armory Crate, this will allow you to stop the service, delete the fil from the "system32" folder and the service will not be started again. As a bonus, I found that the AsusUpdateCheck.exe service was making my system take forever to reboot or shut down, that has been fixed by disabling this service. Hope it helps You all

[Ken429]

What motherboard are you using? What BIOS version? Where is this magic BIOS option located? As I said above, I cannot find anywhere in the BIOS to turn the option off on my ROG Crosshair Hero VII. The last time I looked for the option was a few BIOS versions ago.

[MrAgapiGC]

i find these all ready and send the report to HQ. Now from my side, and still need to check these, but is a windows side issue more than the app. i need to check these more but so far is a windows issue. since there is more info on the event viewer that i need to learn. Example i find out that nvidia drivers are together with how aura respond. example. when the update is made, lights react and when the driver stop working with the Event ID 14 from source nvlddmkm automatic the lights goes crazy. etc. Some little issues that can be fix but windows has most of the fault part

[Jaime59]

For me, on my Crosshair Hero 7 (wifi) I had to disable "ASUS Grid Install Service" in the BIOS in order to stop/remove AsusUpdateCheck.exe.

Hope that helps 🙂