How to remove GoogleUpdate.exe

GoogleUpdate.exe

The module GoogleUpdate.exe has been detected as Trojan.Heur!

GoogleUpdate.exe

GoogleUpdate.exe is a Windows file recorded in the ThreatInfo database. It is associated with Google Updater (x64). The reported company name is Google LLC. The current detection status is Trojan.Heur!, based on the latest analysis from 2026-01-05 23:03:07 (4 months ago).

If GoogleUpdate.exe appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Trojan.Heur!.

Product Name: Google Updater (x64)
Company Name: Google LLC
MD5: 8ac4d15f14979bed1ecea58a303c2edc
Size: 7 MB
First Published: 2026-01-05 23:03:07 (4 months ago)
Latest Published: 2026-01-05 23:03:07 (4 months ago)
Status: Trojan.Heur! (on last analysis)
Analysis Date: 2026-01-05 23:03:07 (4 months ago)
%programfiles%\google

ThreatInfo has observed GoogleUpdate.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

100.0%

The strongest geographic signal for this file is Algeria with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

Windows 10 100.0%

The most common operating system signal for GoogleUpdate.exe is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

GoogleUpdate.exe is identified as pe for 64 systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Subsystem: Windows GUI
PE Type: pe
OS Bitness: 64
Image Base: 0x0000000140000000
Entry Address: 0x00309ad0

PE Sections:

Name Size of data MD5
.text 5163520 1b8789baba0493cd79cad65e7ffd35ff
.rdata 987136 a38c570fbeaeb40b6ff8ea5b4c3d6740
.data 75264 951718e0fc3ff14ed6ba0f40f9a73fda
.pdata 155648 5fbaac85aea6b8e33dc40846fbbc6439
.fptable 512 bf619eac0cdf3f68d496ea9344137e8b
.tls 1024 49522c72a491b694cd3c759290ecaa40
CPADinfo 512 60d3ea61d541c9be2e845d2787fb9574
LZMADEC 4608 05e9eab8428a551a281ab278073669fa
_RDATA 512 2ca45e060c5227d154647a7c80d79a73
malloc_h 512 8658703f95c30e34ca165b16bd9b9790
.rsrc 634880 9438ed5e3f3f08ce69caff765f7e5bac
.reloc 602112 3e785e5dfe8e12c9f7cbe86465d6018d

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

More information:

Download GridinSoft Anti-Malware - Removal tool for GoogleUpdate.exe