What is UsoCoreWorker.exe? Is it Safe? What It Does?

Several Windows customers have contacted us with inquiries about UsoCoreWorker.exe, a mystery application. While some users noticed it after their PC was woken up from sleep or hibernation for no apparent cause, others claim to see it in Task Manager after their PC is woken up from sleep or hibernation for no apparent reason. The executable appears to be present on Windows 7, Windows 8.1, and Windows 10.

What is UsoCoreWorker.exe and What Does it Do?

USOCoreWorker.exe is a process that may appear in your Event Viewer’s list of events from time to time.

Windows 10 employs a process called USOCoreWorker.exe to look for updates.

Note: This technique is also used by the operating system to install the most recent updates and fixes on your machine.

USO is an acronym for Update Session Orchestrator. Instead of using the Windows Update client, the newer Windows 10 OS versions employ the Update Session Orchestrator. USOCoreWorker.exe is the new Windows Update client, in other words.

This is a legitimate system file that is naturally found among your system files and perfectly normal to spot inside Task manager. 

Is UsoCoreWorker.exe safe?

While the real USOCoreWorker.exe is not a security problem, users have reported that it behaves in a similar manner to adware applications. Still, until you investigate and discover that you’re dealing with malware in disguise, this isn’t a cause for alarm.

To enter computers as Windows versions became more secure, malware authors had no choice except to disguise their executables as genuine files with improved rights. That’s why double-checking to make sure you’re not dealing with a virus masquerading as the legal USOCoreWorker.exe is critical.

In order to completely prevent the potential of a virus infection, you must do a number of procedures.

First, you need to consider the location of the process that you see inside Task Manager. 

Press Ctrl + Shift + Esc to open up Task Manager and make sure you open the expert interface and not the simple one. Click on More Details if the simple interface is open by default. 

Once you’re finally inside Task Manager, expand the Processes tab from the menu at the top (or the side menu if you’re on Windows 11) and cycle through the active processes until you locate the UsoCoreWorker.exe process. 

The genuine location of the UsoCoreWorker.exe process is:

C:\Windows\System32

If your case is different and the process is located in a different location, you should seriously consider a scenario in which you’re actually dealing with a malicious executable.

If UsoCoreWorker.exe is located in a suspicious location, our recommendation is to upload the file (as it is) to a virus signature database like VirusTotal in order to verify if it’s malicious or not. 

To do this, simply visit the home page of VirusTotal, upload the suspicious UsoCoreWorker.exe file, and wait for the analysis to complete.

In case the analysis you’ve just deployed reveals evidence of a virus infection, continue with the next section below where we explore how to deal with a case of an infected UsoCoreWorker.exe file.

Dealing with an infected UsoCoreWorker.exe file

If the foregoing investigations indicated that the file is not in a valid place and the VirusTotal analysis has prompted suspicions of a virus infection, we strongly advise you to install a security scanner capable of recognizing and dealing with every infected file.

Keep in mind that you’re probably dealing with malware that has cloaking capabilities – these are famously difficult to detect because not all security suites are capable of detecting and quarantining them. If you’ve previously paid for a premium security scanner, you can use it to run a scan.

However, if you’re searching for a free option, Malwarebytes is a good choice.

Malwarebytes offers a free deep scan that will discover and eradicate the vast majority of malware that hides behind processes with elevated privileges. If you’re not sure how to accomplish it, read this article (here).

If the scan identified and quarantined malicious objects, restart your computer and check if UsoCoreWorker.exe is still listed in Task Managed with excessive resource usage in the following section below.

Should I remove UsoCoreWorker.exe?

If the foregoing examinations revealed no security concerns, you may be certain that the executable you’re dealing with is legitimate. Using Task Manager (Ctrl + Shift + Esc), see if the program is still demanding a lot of system resources.

If the same issues (high resource utilization or random waking up from hibernation) persist, bear in mind that you won’t be able to uninstall this program because it’s part of your operating system.

Instead, you can take the necessary actions to prevent UsoCoreWorker.exe from waking up your PC from its sleep mode.

To do so, use the following technique listed below.

How to Prevent UsoCoreWorker.exe from Waking up PC

The most plausible reason why the UsoCoreWorker.exe process is waking your PC from hibernation is that it’s unable to determine the update status.

This is most likely why it repeatedly wakes up the PC from sleep mode. It tries again and again but fails.

Note: It’s important to note that clicking the Check for Update button will start the USOCoreWorker.exe process in the background.

However, according to a lot of affected users, this problem can be addressed by forcing a powercfg request from an elevated CMD prompt – this will allow you to essentially restart the Windows Update Service without any previous requests that are perpetuated from startup to startup.

Here’s what you need to do:

1. Press Windows key + R to open up a Run dialog box. 
2. Next, type ‘cmd’ inside the text box, then press Ctrl + Shift + Enter to open up an elevated Command Prompt. 
   

   

3. When you’re prompted by the User Account Control (UAC), click Yes to grant admin access. 
4. Once you’re inside the elevated Command Prompt, type the following command and press Enter to execute it:

   powercfg /requests

5. Take a look at the listed services. If you see the UsoCoreWorker.exe listed anywhere on the CMD screen, it’s because the Windows Update is actively using it.
6. To rectify this temporarily, open Services (type ‘services.msc’ inside a Run dialog box), right-click on Windows Update, and click on Restart. 
7. Next, rerun the Power Config command above and check if the mention of UsoCoreWorker.exe is now removed.