How to fix ClipUp.exe - Bad Image error in Windows?

ClipUp.exe is a Windows activation and licensing tool in C:\Windows\System32. Its Bad Image window almost always names another file: in the reports we found, a hook DLL of a third-party security program that ClipUp refused to load. Check first whether Windows is activated anyway, then update or reinstall the program the window names.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What ClipUp.exe is, and why it runs during activation

ClipUp.exe is a small command line program that ships with Windows 10 and Windows 11. Posters on Microsoft Q&A describe it as the Client License Platform migration tool, and a Microsoft Q&A answer says it is related to the activation of Windows. It has no window of its own. Windows starts it in the background when licence data has to be converted or moved.

File

ClipUp.exe in C:\Windows\System32, with a copy in a C:\Windows\WinSxS\amd64_microsoft-cli... folder

Job

Licence and activation housekeeping (Client License Platform)

Publisher

Microsoft Corporation, part of Windows

Runs

In the background while Windows activates, takes a new key or changes edition

Can be removed

No. It is a Windows component, restored by Windows repair tools

Is a virus

Not by its name. A file called ClipUp.exe outside System32 and WinSxS is suspicious (Fix 6)

Because ClipUp.exe runs only at those moments, its error also appears only then: during activation, right after you type a product key, or during an edition upgrade. That timing is the best clue that the window has to do with licensing work and not with a program you just opened.

What the ClipUp.exe - Bad Image error means

A Bad Image window always has the same shape. The title names the program that was starting, here ClipUp.exe. The text names the file Windows refused to load into it, and the last words give a status code. So the title tells you who suffered, and the path tells you who caused it.

This is the full text one reader posted on Microsoft Q&A in 2019, while upgrading Windows 10 Home to Pro with a generic key:

The window as reported on Microsoft Q&A

ClipUp.exe - Bad Image

C:\WINDOWS\system32\tmumh\20019\AddOn\8.50.0.2065\TmUmEvt64.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support. Error status 0xc0000428.

• The file in the path is not ClipUp.exe. It is TmUmEvt64.dll in a tmumh folder, which belongs to Trend Micro security software, not to Windows.
• Error status 0xc0000428 is STATUS_INVALID_IMAGE_HASH in Microsoft's list of NTSTATUS values: the hash of that image cannot be found in the system catalogs. Windows could not match the DLL to a signature it accepts for this process.
• Another report, in Comodo's own forum, shows the same ClipUp.exe window naming C:\Windows\system32\guard64.dll, a file of Comodo Internet Security.

What causes the ClipUp.exe Bad Image error, from most to least common

Most often a security program loads its own DLL into every process that starts, ClipUp.exe included, and ClipUp refuses it. Less often a Windows file is damaged. Rarely the file is not the real ClipUp.exe, or an unofficial activation tool is involved.

How to fix ClipUp.exe - Bad Image error

Fix 1 tells you whether there is anything to fix. Fix 2 and Fix 3 deal with the security program behind most reports. Fixes 4 to 6 cover the rarer causes, and Fix 7 is a one-time test only.

Fix 1. Check whether Windows is activated and whether the window comes back

5 minutesNo riskEveryone, first. Especially if the window showed once while Windows activated.

On Microsoft Q&A, readers with this window report that Windows still activates and the window shows only once. If that is your case, ClipUp finished its licence work anyway and the refused DLL changed nothing.

1. Write down or photograph the path and the status code from the window, then select OK.
2. Windows 11: open Settings > System > Activation. Windows 10: open Settings > Update & Security > Activation.
3. Read Activation state. Active with a digital licence or product key means activation worked.
4. For a second check, type cmd in the search box, right-click Command Prompt and select Run as administrator.
5. Run this command. A box should say the machine is permanently activated.

   slmgr /xpr

6. Restart the PC and use it normally for a day. Note whether the ClipUp.exe window appears again.

If the state is Active and the window does not return, you can stop here. The DLL that ClipUp refused stays loaded in your other programs as before, so nothing is broken. If Windows is not activated, select Troubleshoot on the same Activation page, and keep the window's path for Fix 2.

Fix 2. Update the security program named in the window

10 to 20 minutesLow riskThe path in the window points into a third-party antivirus folder, such as Trend Micro's tmumh or Comodo's guard64.dll.

The refused file is the antivirus's own hook DLL, loaded into every new process. Status 0xc0000428 says Windows could not match its hash to a catalog it accepts. A newer build of that program brings a newer DLL, which is how such clashes are usually solved by the vendor.

1. Find the folder name in the path. tmumh and TmUmEvt64.dll belong to Trend Micro. guard64.dll belongs to Comodo. For any other name, search the folder name together with the word antivirus.
2. Open that security program from its icon in the notification area of the taskbar.
3. Use its own update option, often called Check for updates or Update now, for both the program and its detection files.
4. If the program offers a newer major version, install it. Old versions often keep old hook DLLs.
5. Restart the PC from Start > Power > Restart.
6. Repeat what showed the window: enter the key again, or open Settings > System > Activation.

Fix 3. Remove the security program, activate, then install its newest version

20 to 40 minutesLow riskFix 2 did not help, the program is no longer updated, or its update option fails.

An uninstall removes the hook DLL from every process. With it gone, ClipUp.exe can finish its licence work. A fresh install afterwards puts back a current, complete copy of the program and its DLLs.

1. Note your licence key or account login for the security program before you remove it.
2. Uninstall the program in Settings > Apps > Installed apps. Some vendors also offer their own removal tool, which removes leftovers.
3. Restart the PC. Microsoft Defender Antivirus turns itself on when no other antivirus is installed, so the PC stays protected.
4. Activate Windows or enter the key again, and check that no ClipUp.exe window appears.
5. Download the newest version from the vendor's own website, install it and restart.

Every way to remove a program, including Control Panel for old installers: Uninstall a program or app in Windows

Fix 4. Repair Windows system files with DISM and SFC

15 to 30 minutesLow riskThe path names a Windows DLL in System32, the window names ClipUp.exe itself, or Windows says ClipUp.exe is missing.

ClipUp.exe and its Windows DLLs are protected system files with a reference copy in WinSxS. DISM repairs that store from Windows Update, and SFC then replaces a damaged or missing ClipUp.exe or System32 DLL with a good copy.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.

   

2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

   

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

   

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

   

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

Fix 5. Find the program behind an unknown DLL with a clean boot

20 to 30 minutesLow riskThe path points into a folder you do not recognise, so you do not know which program loads the DLL.

A DLL that lands in ClipUp.exe is loaded by some program running in the background. A clean boot starts Windows with only Microsoft services, so if the window disappears, one of the turned off programs is the source.

1. Open System Configuration. Select Search on the taskbar, type msconfig and select System Configuration from the results.
2. Hide Microsoft services. On the Services tab, select the Hide all Microsoft services check box. Only services from other companies stay in the list.

   

3. Disable the remaining services. Select Disable all, then select Apply.
4. Open Task Manager. On the Startup tab of System Configuration, select Open Task Manager.

   

5. Disable the startup apps. On the Startup apps tab in Task Manager, select each item whose status is Enabled and select Disable. Write down or take a screenshot of the items you disable: you need the list to turn them back on.

   

6. Confirm the changes. Close Task Manager. On the Startup tab of System Configuration, select OK.
7. Restart and test. Restart the PC. Windows now starts in a clean boot environment: try again the thing that failed (run the app, install the update, uninstall the program).

These steps were written for Windows 11 25H2 and 26H2. The full page with the other versions and what each result means: How to perform a clean boot in Windows

In the clean boot state, activate Windows or enter the key again. If the window is gone, turn the services back on in halves until it returns. The last group you turned on holds the program. Then update or remove it as in Fix 2 and Fix 3, and switch back to a normal startup.

Fix 6. Scan for malware when ClipUp.exe or the DLL looks out of place

15 minutes to 2 hoursNo riskA ClipUp.exe sits outside System32 and WinSxS, the DLL path is in a Temp or user folder, or the window appears when you did nothing with activation.

Malware sometimes uses names of Windows files to hide, and some malware injects DLLs into every process. A full scan with Microsoft Defender checks both the file and the DLL in the window.

1. Open Windows Security. Select Start, type Windows Security and open the app.
2. Open Virus & threat protection. Select Virus & threat protection. Under Current threats you see when the last scan ran, how long it took and how many files it checked.
3. Run a quick scan. Select Quick scan. If Windows Security thinks a deeper scan is needed, it tells you when the quick scan is done.
4. Open Scan options. If the quick scan finds nothing and you still suspect an infection, select Scan options under Current threats.
5. Run a full scan. Select Full scan and start it. It checks every file and program on the device, so it takes much longer than a quick scan. Leave the PC on until it ends.
6. Or scan one folder. To check only a download or a USB drive, select Custom scan in Scan options and choose the folder. You can also right-click a file or folder in File Explorer and select Scan with Microsoft Defender. On Windows 11 you may have to select Show more options first.
7. Read Protection history. Go back to the first page of Windows Security and select Protection history. Select a card to expand it and see the details.

These steps were written for Windows 11 25H2 and 26H2, Windows 10 22H2. The full page with the other versions and what each result means: How to scan for malware with Microsoft Defender

To check the real ClipUp.exe, open C:\Windows\System32 in File Explorer, right-click ClipUp.exe and select Properties > Digital Signatures. The signer should be Microsoft Windows.

Fix 7. Pause the security program for one activation attempt

5 minutesLow riskYou must finish activation now, the window blocks it, and the security program cannot be updated or removed today.

With the program's protection paused, it may stop loading its hook DLL into new processes, so ClipUp.exe can run once. This proves the cause, but it is a test, not a fix.

1. Pause the protection of the program named in the path for the shortest time it offers, for example 10 minutes.
2. Activate Windows or enter the key again.
3. Turn the protection back on at once, even if activation failed.

How to pause safely, and how to check protection is back on: Turn off Microsoft Defender protection for a moment. Some programs keep their hook DLL loaded while paused. In that case only Fix 3 removes it.

When nothing helps: where the error is logged and what to send

Windows writes every Bad Image window into the event log, so you can read the exact path later even after you closed the window. Look in the System log for an entry from the source Application Popup.

1. Right-click Start and select Event Viewer.
2. Open Windows Logs > System.
3. Select Filter Current Log and type 26 in the event ID box.
4. Open the entries with ClipUp.exe - Bad Image in the text and copy the path and the status code.

• Send to the security vendor the full path, the status code, your Windows version from Settings > System > About, and the program version.
• Send to Microsoft support the same, plus the result of slmgr /dlv if activation fails.
• Repair install. If ClipUp.exe or Windows DLLs stay damaged after Fix 4, reinstall Windows over itself and keep your files and apps: Reinstall Windows without losing files

How to keep the ClipUp.exe window from coming back

• Keep the security program current. Its hook DLL is what ClipUp refused in the reported cases, and old versions keep old DLLs.
• Remove old security programs fully. Two antivirus programs, or the leftovers of an old one, mean more DLLs in every process. Use the vendor's removal tool.
• Activate with a genuine key or digital licence. Unofficial activation tools also run ClipUp.exe and change licence files, which can bring this and other licensing errors.
• Do not delete or replace Windows files by hand. If ClipUp.exe or a System32 DLL is damaged, let SFC or a repair install put the right copy back.

Frequently asked questions

What is ClipUp.exe?

ClipUp.exe is a Microsoft program in C:\Windows\System32 that handles licence and activation work for Windows. Posters on Microsoft Q&A describe it as the Client License Platform migration tool. It has no window, runs only for a moment while Windows activates, takes a new product key or changes edition, and then closes. A second copy sits in the WinSxS folder, which Windows uses to repair it. It is part of Windows 10 and Windows 11, so you cannot uninstall it, and you do not need to start it yourself.

Is ClipUp.exe a virus?

No, the real ClipUp.exe is a Windows file signed by Microsoft. It lives in C:\Windows\System32 and in a WinSxS folder. A file with the same name in Downloads, Temp, AppData or another user folder is not the Windows file, and should be scanned with Microsoft Defender (Fix 6). To check the real one, right-click it in System32, select Properties and open Digital Signatures: the signer should be Microsoft Windows. The Bad Image window itself is not a sign of malware either, because it usually names a security program's DLL.

Does the ClipUp.exe Bad Image error stop Windows from activating?

Usually not. Readers on Microsoft Q&A report that Windows still activates and that the window shows only once. ClipUp.exe does its licence work, and the DLL it refused is a helper from another program that ClipUp does not need. Check Settings > System > Activation on Windows 11, or Settings > Update & Security > Activation on Windows 10. If the state is Active and the window does not return, nothing else needs to be done. If Windows is not activated, follow Fix 2 and Fix 3.

What does it mean when the ClipUp.exe file is missing?

It means Windows could not find C:\Windows\System32\ClipUp.exe when activation or a key change tried to start it. The file can be removed by an aggressive cleaner, an antivirus that quarantined it by mistake, or damage to Windows files. Check the quarantine of your security program first and restore the file if it is listed there. Then run DISM and SFC (Fix 4), which put back the Windows copy from the component store. Do not download ClipUp.exe from a DLL or EXE download site.

Why does the window name a Trend Micro or Comodo file and not ClipUp.exe?

Because the title names the process that was starting and the text names the file that failed to load into it. Many security programs place a small DLL into every new process to watch what it does. Trend Micro's TmUmEvt64.dll in a tmumh folder and Comodo's guard64.dll have both been reported in this window. ClipUp.exe refused that DLL, and Windows showed the Bad Image message under ClipUp's name. Updating or reinstalling that security program is the fix (Fix 2 and Fix 3).

What is a Bad Image error in Windows?

A Bad Image error is Windows' message for a program file it will not load. The title shows the program that was starting, the text shows the file that failed, and the status code says why. Code 0xc000012f means the file does not begin like a program file. Code 0xc000007b means the format is wrong, and 0xc0000428 means its hash is not in the system catalogs. The same window appears for many programs, so the path in it matters more than the title. Our chooser above matches each path to a fix.

How do I fix a Bad Image error in general?

Read the path in the window and fix the file it names, not the program in the title. If the file belongs to an installed program, update or reinstall that program. If it is a Windows file in System32, run DISM and SFC to put back Microsoft's copy. If you do not recognise the folder, find the program with a clean boot and scan for malware. Avoid downloading single DLL files from websites, because the wrong version brings a new Bad Image error.

Can I delete or disable ClipUp.exe to stop the window?

No. ClipUp.exe is part of Windows activation, and Windows restores it during repairs and updates. Deleting it can leave Windows unable to change keys or activate, and the file is protected anyway. It also does not cause the window: the DLL named in the path does. Close the window with OK, check activation (Fix 1), and update or reinstall the security program the path points to.

The window appeared while I ran an activation script. What now?

Unofficial activation scripts and tools also call ClipUp.exe and change licence files, so they can cause this window and other licensing errors. uGetFix does not cover those tools. Remove the tool, run DISM and SFC (Fix 4) to restore Windows files, and activate with a genuine product key or a digital licence linked to your Microsoft account. Settings > System > Activation shows which licence Windows uses now.