Should I block it?

No, this file is 100% safe to run.

Additional versions

4.6.0.2935	42.86%
4.6.0.1694	14.29%
4.5.0.1810	14.29%
4.5.0.1499	14.29%
4.0.0.1496	14.29%

Relationships

PE file structure

Show functions

Import table

advapi32.dll

RegOpenKeyExA, CloseServiceHandle, OpenSCManagerW, QueryServiceStatus, OpenServiceW, RegCloseKey, RegQueryValueExA

comctl32.dll

ImageList_Create, ImageList_ReplaceIcon, PropertySheetW

gdi32.dll

GetViewportOrgEx, SetViewportOrgEx, DPtoLP, GetStockObject, DeleteDC, CreateCompatibleBitmap, SetTextAlign, BitBlt, Rectangle, SetBkMode, SelectObject, CreateCompatibleDC, CreateSolidBrush, GetDeviceCaps, CreateBrushIndirect, SetTextColor, SetBkColor, DeleteObject

kernel32.dll

GetMailslotInfo, GetLocalTime, Sleep, WaitForMultipleObjects, ResetEvent, GetCurrentProcessId, DeleteCriticalSection, SetLastError, InterlockedExchange, InitializeCriticalSection, GetLastError, InterlockedIncrement, SizeofResource, LoadResource, SetProcessWorkingSetSize, CompareStringA, GetModuleHandleA, GetModuleFileNameA, GetWindowsDirectoryA, GetSystemDirectoryA, LoadLibraryA, GetProcAddress, GetACP, GetThreadLocale, GetVersionExA, FlushInstructionCache, GetCurrentProcess, InterlockedDecrement, lstrlenA, GetTimeFormatA, GetDateFormatA, SystemTimeToTzSpecificLocalTime, GetTimeZoneInformation, GetLocaleInfoA, IsValidLocale, GetUserDefaultLangID, RaiseException, CloseHandle, EnterCriticalSection, LeaveCriticalSection, WaitForSingleObject, SetEvent, FreeLibrary, WriteFile, GetCurrentThreadId, MulDiv, ReadFile, InterlockedCompareExchange, HeapFree, GetProcessHeap, HeapAlloc, IsProcessorFeaturePresent, VirtualFree, VirtualAlloc, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetUserDefaultLCID, GetSystemTimeAsFileTime, GetTickCount, QueryPerformanceCounter, IsDebuggerPresent, LocalFree, ExitProcess

msvcp71.dll

DllMain

msvcp80.dll

DllMain

msvcr71.dll

DllMain

msvcr80.dll

DllMain

nacmnlib3_71.dll

LoadResourceDLLW, GetResString

nailog3.dll

_naimcomn_SetSystem@4, _naimcomn_InitTracer@0, _naimcomn_SetLogToStdout@4, _naimcomn_StartFileLogging@4, naimcomn_LogInfoW, _naimcomn_EndFileLogging@0

ole32.dll

CreateStreamOnHGlobal, CoMarshalInterface, CoInitializeEx, CoInitializeSecurity, CoResumeClassObjects, CoTaskMemFree, CoRegisterClassObject, CoRevokeClassObject, CoTaskMemRealloc, CoTaskMemAlloc, StringFromGUID2, CoCreateInstance, CoUninitialize, CoInitialize

shell32.dll

SHGetFolderPathW

shlwapi.dll

PathFindExtensionW

user32.dll

ShowWindow, IsWindowVisible, IsWindow, SetCursor, InvalidateRect, RedrawWindow, KillTimer, SetTimer, TrackPopupMenu, SetActiveWindow, DestroyWindow, GetDesktopWindow, SetFocus, IsDlgButtonChecked, GetDlgItemInt, ScreenToClient, TranslateMessage, GetWindow, GetWindowRect, BeginPaint, FillRect, GetSysColor, OffsetRect, UpdateWindow, GetMessagePos, CheckDlgButton, GetDC, ReleaseDC, CreatePopupMenu, UnregisterClassA, GetClientRect, EndDialog, MapWindowPoints, SetWindowPos, GetDlgItem, GetParent, GetDlgCtrlID, IsIconic, GetForegroundWindow, PostQuitMessage, SetForegroundWindow, EndPaint, SetDlgItemInt, CheckRadioButton, CreateCursor, DestroyCursor, DestroyIcon, GetCursorPos, GetAsyncKeyState, DestroyMenu, GetSubMenu, GetActiveWindow, MsgWaitForMultipleObjects

udaterui.exe

McAfee Agent by McAfee (Signed)

Remove udaterui.exe

Version:	4.5.0.1499
MD5:	07f5f51bb1921e3385c877e4a6e126f2
SHA1:	ff8158c970f23fb1b4bd59e6359e34c67e6af8d0
SHA256:	f757bacb105e8aa0cbf6071a40683e82bdb656efce5bb68558f24720f11bca7b

What is udaterui.exe?

Common User Interface is part of McAfee Agent. The McAfee Agent is a process that runs in the taskbar when the McAfee Security Suite or McAfee Internet Security has been installed on a PC. The McAfee Agent offers access to specific functions instead of opening the full protection center program. Once the McAfee Agent has been installed, it will show up in the notifications area of the taskbar and will load on each reboot.

Overview

udaterui.exe executes as a process with the local user's privileges. It is set to be start when the PC boots and any user logs into Windows (added to the Run registry key for the all users under the local machine). The file is digitally signed by McAfee which was issued by the VeriSign certificate authority (CA).

Details

File name:	udaterui.exe
Publisher:	McAfee, Inc.
Product name:	McAfee Agent
Description:	Common User Interface
Typical file path:	C:\Program Files\mcafee\common framework\udaterui.exe
Original name:	UpdUI.exe
File version:	4.5.0.1499
Size:	137.31 KB (140,608 bytes)
Certificate
Issued to:	McAfee
Authority (CA):	VeriSign
Expiration date:	Monday, October 10, 2011
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
Code language:	Microsoft Visual C++ 8.0
.NET CLR:	No

More details

Behaviors

Startup files (all users) run

Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

'McAfeeUpdaterUI' → "C:\Program Files\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00006531%	0.028634%
Kernel CPU:	0.00003089%	0.013761%
User CPU:	0.00003442%	0.014873%
Kernel CPU time:	140 ms/min	100,923,805ms/min
CPU cycles:	1,557,351/sec	17,470,203/sec
Memory
Private memory:	4.66 MB	21.59 MB
Private (maximum):	4.75 MB
Private (minimum):	4.05 MB
Non-paged memory:	4.66 MB	21.59 MB
Virtual memory:	95.59 MB	140.96 MB
Virtual memory (peak):	109.92 MB	169.69 MB
Working set:	4.73 MB	18.61 MB
Working set (peak):	16.53 MB	37.95 MB
Page faults:	7,605/min	2,039/min
I/O
I/O read transfer:	1.17 KB/sec	1.02 MB/min
I/O read operations:	3/sec	343/min
I/O other transfer:	24.47 KB/sec	448.09 KB/min
I/O other operations:	1,046/sec	1,671/min
Resource allocations
Threads:	6	12
Handles:	143	600
GUI GDI count:	41	103
GUI GDI peak:	44	142
GUI USER count:	43	49
GUI USER peak:	46	71