What is the hkcmd.exe process and should it be removed?

by Tomas Statkus - -

There are some concerns regarding the hkcmd.exe executable which constant presence in Task Manager and auto-launches itself every time the system is started. Most of the time users should not worry, because the genuine hkcmd.exe executable is a genuine Intel-signed process which is responsible for the graphics hotkey interception.[1]

HKCMD process

The genuine hkcmd.exe process is safe and legitimate, in order to be sure users should analyze the executable because there are a lot of malware that targets files located in a System32 folder.

The hkcmd.exe process

The legitimate hkcmd.exe is Intel’s hotkey interpreter. The shortcut HKCMD means “Hotkey Command”. The module is commonly installed with the Intel 810 and 815 graphics driver chipsets but not the Windows system file. The process is scheduled to run at Windows startup and does not indicate any visible window.[2]

On earlier Windows versions, such as Windows 7, the process is responsible for the video-related hotkeys as a component of Intel’s User Interface. The process should not appear on Windows 8 or later because it has been replaced by lgfxhk.exe. 

This process is responsible for quick access to Intel’s customized graphics properties. For instance, if you press Ctrl + Alt +F12, you will launch Intel’s Graphics and Media Control Panel.[3] If you remove or disable the hkcmd.exe process the shortcut will no longer function. 

Can hkcmd.exe pose a security threat?

As it was mentioned before, the genuine executable is completely safe. However, some types of malware are capable of camouflaging as the hkcmd.exe process. There are three occurrences identified that commonly point out by compromised systems: Virus: Win32 / Sality.AT, W32.Sality.AE and TrojanDownloader: Win32 / Unruy.C. 

If you think that your system is infected by a virus, you should figure out if you actually have an Intel component that could install the hotkey module. In addition, keep in mind that you should not be able to locate hkcmd.exe in you have Windows 8 or later operating system, as the module has been replaced with lgfxhk.exe. 

If you are suspecting the virus infection, make sure to scan your system using a powerful antivirus software. 

Should you delete the hkcmd.exe executable?

If you consider the hkcmd.exe process as a legitimate, you can remove it from your Task Manager. However, keep in mind that removing the process is not an acceptable solution because it could break your Intel Common User Interface.[4]

If you want to prevent the hkcmd.exe executable from being called at startup, you can remove it from the Intel Extreme Graphics interface by launching Control Panel, then go to Intel Extreme Graphics and disable the Hotkeys checkbox. 

If your system runs the latest Intel, you can simply press Ctrl + Alt + F12 and launch Intel’s Graphics and Media Control Panel. Further, you have to enter into the Basic mode, and choose Options and Support tab, and then disable the Hot Key Functionality checkbox. 

In order to reinstall or uninstall the hkcmd.exe executable together with its parent app, the remove Intel® Graphics Media Accelerator. In order to do so, press Windows key + R to open Run command and type ‘appwix.cpl’, and open Programs and Features by pressing Enter. Further, locate and uninstall Intel® Graphics Media Accelerator and uninstall it. Once you uninstall the parent application, the executable should no longer appear in Task Manager, unless it is malicious. 

About the author

Tomas Statkus
Tomas Statkus - Team leader

Tomas Statkus is an IT specialist, the team leader, and the founder of Reviewedbypro.com. He has worked in the IT area for over 10 years.

Contact Tomas Statkus
About the company Esolutions


now online
Like us on Facebook