What is hkcmd.exe
Should it be deleted?
Some users have been reaching us with concerns regarding the hkcmd.exe process. Most users express concerns after noticing that the hkcmd.exe process is a constant presence in Task Manages and seems to auto-launch itself at every startup. Most of the time hkcmd.exe is a genuine Intel-signed process commonly referred to as the graphics hotkey interceptor.
Although the legitimate process is totally safe, we recommend investigating the executable as there are a lot of malware that is specifically targeting files located inside the System32 folder in order to avoid security scans.
What is hkcmd.exe?
The hkcmd.exe is Intel’s hotkey interpreter. HKCMD stands for “Hotkey Command“. This hotkey module is typically installed with the Intel 810 and 815 graphics driver chipsets. The executable is not a Windows system file and is scheduled to run at Windows startup with no visible window.
On Windows 7 and earlier versions, hkcmd.exe controls the video-related hotkeys as part of Intel’s Common User Interface. Keep in mind that you should longer encounter this process on Windows 8 and later since it has been replaced by Igfxhk.exe.
The only purpose of this process is to facilitate quick access to Intel’s customized graphics properties. For example, pressing Ctrl + Alt + F12 will take you to Intel’s Graphics and Media Control Panel. If the hkcmd.exe shortcut where to be disabled, this shortcut (and any other Intel shortcut) will no longer function.
Potential security threat?
As stated above, there is some malware capable of camouflaging as the hkcmd.exe executable. Although there might be more, we managed to identify three occurrences that are commonly pointed out by infected users: Virus:Win32 / Sality.AT, W32.Sality.AE and TrojanDownloader:Win32 / Unruy.C.
If you’re suspecting a virus infection, start by figuring out if you really have an Intel component that would install the hotkey module. And keep in mind that if you’re on Windows 8 or above, you shouldn’t be able to find hkcmd.exe in your Task Manager – the module has been replaced with Igfxhk.exe on the latest Windows versions.
If the facts point towards a virus infection, you should perform a thorough scan of your system with a powerful malware remover like Malwarebytes. If you’re having trouble using it, follow our in-depth article (here) on installing and using Malwarebytes to get rid of a virus infection.
Should I remove hkcmd.exe?
If you determined that the hkcmd.exe process is legitimate, you have a few ways forward if you want it removed from your Task Manager.
Note: Deleting the executable manually is not an acceptable solution since it might end up breaking your Intel Common User Interface.
If you want to prevent the hkcmd.exe process from being called at startup, you can disable it from the Intel Extreme Graphics interface. To do this, open Control Panel, go to Intel Extreme Graphics and disable the checkbox next to Hotkeys.
If you have the newest Intel software, you can press Ctrl + Alt + F12 to open Intel’s Graphics and Media Control Panel. Then, enter into the Basic mode, select the Options and Support tab and uncheck the box next to Hot Key Functionality.
If you wish to uninstall or reinstall the hkcmd.exe module along with its parent application, you’ll need to remove Intel(R) Graphics Media Accelerator. To do this, open a Run command (Windows key + R), type “appwiz.cpl” and hit Enter to open Programs and Features.
In Programs and Features, locate and uninstall Intel(R) Graphics Media Accelerator by right-clicking on it and choosing Uninstall. With the parent program removed, the hkcmd.exe should no longer be visible inside Task Manager (unless it’s malicious).
