Forum adverts like this one are shown to any user who is not logged in. Join us by filling out a tiny 3 field form and you will get your own, free, dakka user account which gives a good range of benefits to you: No adverts like this in the forums anymore. Times and dates in your local timezone. Full tracking of what you have read so you can skip to your first unread post, easily see what has changed since you last logged in, and easily see what is new at a glance. Email notifications for threads you want to watch closely. Being a part of the oldest wargaming community on the net. If you are already a member then feel free to login now.

Hi all,

I am trying to become more computer literate. In part of doing so I looked up all the running programs on task manager and researched them. WDC.exe has me a little worried as there is a divided opinion on it being a keylogger or a legitimate ASUS product (note: my computer is an ASUS). So, what do you say? I looked it up in the program files and I couldn't find its program path specifically but I found the ASUS ATK package. To be more helpful.....I got this computer in 2011 so maybe its newer and the ATK package includes WDC.exe in there? If this is not safe.....how do I remove it?


Automatically Appended Next Post:
..........Anyone?

http://lmgtfy.com/?q=WDC.exe

I looked at all those forums.......there is a divided consensus as I said.

The answer, unfortunately, is that it could be either. I've done a little digging and it seems that while the process may well be the valid ASUS one, it has been known to be spoofed by malware before, obviously in an attempt to look like a legitimate process. This isn't exactly anything new - some of the sneakier ones will masquerade as processes from popular antivirus packages like Norton or AVG.

You have a couple of options open to you. I'm assuming you're running on Windows - I'm not sure if all versions have this option, but certainly on 7, the easiest (though least thorough) test is to go into Task Manager, Processes tab, right-click the process and choose "Open File Location". That should give you a hint of whether it's coming from a valid installed program - if it's coming from a seemingly randomly named folder or some kind of temp folder like Temporary Internet Files then it's bad.

Another way - though I would consider this a last resort - would be to rebuild the PC completely by formatting and reinstalling the OS, and loading on all your drivers. Then check to see if the process is still there.

(added) ...seeing as you're already Googling for it, I can only suggest you register for a more tech-centric forum or two and post there as well. We do have some really smart technical people here but we can only help so far...!!

@SuperReady

Exactly my fear. When I tell it to "open file location" it doesn't do anything. And it won't let me end any processes or anything.

Never mind I opened the properties and its file location is as follows:

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey

Is there any option to go to service? (This might be greyed out if there isn't a related service.)
I would also suggest seeing if you can find it in the registry, if you're comfortable looking there. Unfortunately I don't seem to be able to find a confirmed location for registry entries for the legitimate process - only mentions of removing the keylogger versions. So this will largely be trial and error - I'd suggest looking under HKEY_CURRENT_USER and if not there, then HKEY_LOCAL_MACHINE.

I said to view all services by all users and found it after selecting properties. The tech related forum has the same file path so I think its legitimate and is from ASUS. Same dates and everything. Phew! Thanks Super Ready for your help!

 Krellnus wrote:
http://lmgtfy.com/?q=WDC.exe

That's unhelpful at best. This legitimately could be safe or not. The poster has clearly done his research to determine as such. If you're not going to lend a hand, don't get in the way.

Grndhog, I recommend seeing if you can find a place to obtain the package for the application from ASUS's website. Download it, extract the binary you're asking about, and then compare file sizes. That's something you can modify to mask, but it would take a lot of effort.

If that's not something you can handle, I recommend looking for help at a more technically minded website. For all the nerds present here, Dakka is not exactly renown for it's meaningful or helpful tech answers.

 daedalus wrote:

 Krellnus wrote:
http://lmgtfy.com/?q=WDC.exe

That's unhelpful at best. This legitimately could be safe or not. The poster has clearly done his research to determine as such. If you're not going to lend a hand, don't get in the way.

Grndhog, I recommend seeing if you can find a place to obtain the package for the application from ASUS's website. Download it, extract the binary you're asking about, and then compare file sizes. That's something you can modify to mask, but it would take a lot of effort.

If that's not something you can handle, I recommend looking for help at a more technically minded website. For all the nerds present here, Dakka is not exactly renown for it's meaningful or helpful tech answers.

Thank you for the kind advice. I was on a tech forum and they were talking about the files path. The path I found matched it. Hell even the date uploaded or whatever matched (12/22/08). Here is the corresponding thread:

http://forum.notebookreview.com/asus/466838-wdc-exe-does-belong-asus-keylogger.html


Addendum and Off-topic: I am very pleased and surprised by people's (mostly) amicable behavior here on dakka. Very nice change from Warseer.

Just checked your link. Try this:

Microsoft FCIV program to check MD5 sums
The FCIV utility runs on Microsoft Windows 2000, Windows XP, and Windows Server 2003.

fciv.exe c:\ -r
FCIV -md5 -sha1 path\filename.ext
FCIV -md5 -sha1 c:\windows\system32\shdocvw.dll

For further information please check out the “Availability and description of the File Checksum Integrity Verifier utility” Article 841290 at the Support.Microsoft.com site.

Source: http://www.linuxquestions.org/linux/answers/LQ_ISO/Checking_the_md5sum_in_Windows

Compare it with the MD5 posted in your link. If they match, I'd rest easy. If not, well, maybe you might want to ask ASUS how to prove your copy is legit. For what it's worth, I think you're probably safe, especially reading what the purpose of the software is and given you're using an ASUS laptop.


Automatically Appended Next Post:
Obviously, replace path\filename.ext with the wdc.exe path.

Thanks!

Just a suggestion, but couldn't you upload the application to Virus Total? (It's owned by Google)

It scans with 46 different anti viruses.

Grndhog89 wrote:

Addendum and Off-topic: I am very pleased and surprised by people's (mostly) amicable behavior here on dakka. Very nice change from Warseer.

We get the odd jackass here and there, but it's tons better than warseer, yes

Welcome to Dakka btw!