VGTray.exe: Riot Vanguard Tray or Malware? Safe Path Check

VGTray.exe is usually the tray notification component for Riot Vanguard, Riot Games’ anti-cheat software used by games such as VALORANT and League of Legends. On a normal PC, VGTray.exe is not a Windows system file, not a coin miner, and not an NVIDIA component. It is the user-facing Vanguard tray process that lets you see Vanguard status and turn Vanguard off from the system tray.

The reason people search for it is understandable: Vanguard starts with Windows, uses low-level anti-cheat components, and may remain installed even after you stop playing Riot games. Malware can also copy familiar process names. So the right question is not “is every VGTray.exe malware?” but “is this copy really Riot Vanguard, and is it behaving normally?”

What is VGTray.exe?

The legitimate VGTray.exe process belongs to Riot Vanguard. Riot describes Vanguard as its custom game security software built to protect competitive integrity. The tray component gives you the Vanguard icon in the Windows notification area and helps expose basic control/status actions to the user.

VGTray.exe is only one part of Vanguard. You may also see related Vanguard components such as the vgc service and the vgk driver/service. This distinction matters because disabling VGTray.exe in Startup may only hide or stop the tray application; it does not necessarily remove all Vanguard components from the computer.

Item	What it is	Normal context
VGTray.exe	Vanguard tray notification process	Riot Vanguard tray icon/status component
vgc	Vanguard service	Required by Riot games that use Vanguard
vgk	Vanguard kernel driver/service	Low-level anti-cheat component

Is VGTray.exe safe?

VGTray.exe is usually safe when it is the genuine Riot Games file. A typical legitimate location is:

C:Program FilesRiot VanguardVGTray.exe

It should be connected to Riot Vanguard, Riot Client, VALORANT, League of Legends, or another Riot title that currently requires Vanguard. It should also have a trusted Riot Games digital signature. If the file is in the expected folder, signed by Riot, and you installed a Riot game intentionally, it is probably legitimate.

A suspicious copy is different. Treat VGTray.exe as potentially malicious if it runs from AppData, Temp, Downloads, a random user-profile folder, C:Windows, C:WindowsSystem32, or a folder with a misspelled Riot/Vanguard name. Malware often uses trusted-looking filenames to blend into Task Manager.

Why users worry about VGTray.exe

There are three common reasons this process looks suspicious:

• It starts with Windows. Vanguard is designed to be active early enough for Riot games that require it.
• It is not a Windows file. VGTray.exe belongs to Riot software, so users who do not remember installing VALORANT or League may wonder why it exists.
• Old malware pages mislabel it. Some pages call VGTray.exe a miner by default. That is misleading. The legitimate Riot file is not a miner; only a fake copy or unrelated malicious file using the same name should be treated that way.

How to verify VGTray.exe in Task Manager

1. Press Ctrl + Shift + Esc to open Task Manager.
2. Find VGTray.exe or Riot Vanguard.
3. Right-click it and choose Open file location.
4. Confirm that the path points to C:Program FilesRiot Vanguard.
5. Right-click the file → Properties → Digital Signatures.
6. Check that the signer/publisher is Riot Games or Riot Games, Inc.
7. Review the file creation date. It should match a Riot/Vanguard install or update, not a random download event.

If the file location is not Riot Vanguard, do not rely on the process name. Investigate it as an unknown executable.

Safe vs suspicious VGTray.exe

Likely legitimate	Suspicious
Located in C:Program FilesRiot Vanguard	Located in AppData, Temp, Downloads, Startup, or a random folder
Digitally signed by Riot Games	Unsigned, unknown signer, or invalid signature
Appeared after installing VALORANT, League, or Riot Client	Appeared after a crack, fake installer, archive, or unknown download
Low resource usage while idle	High CPU/GPU/network usage while no Riot game is running
Uninstalls through Riot Vanguard / Windows Apps	Returns after deletion or creates unknown scheduled tasks

Should you disable VGTray.exe at startup?

You can disable the tray process, but that may not be the same as fully disabling Vanguard. Riot’s own documentation explains that Vanguard can be turned off from the system tray and uninstalled separately. If a Riot game requires Vanguard, you may need to restart the computer or reinstall/enable Vanguard before the game launches correctly.

If your goal is simply to reduce tray icons, disabling VGTray.exe may be enough. If your goal is to remove Vanguard from the machine, use the official uninstall path instead of deleting files by hand.

How to uninstall or disable Riot Vanguard safely

If you no longer play Riot games that require Vanguard, use the normal uninstall flow first:

1. Open Settings → Apps → Installed apps.
2. Find Riot Vanguard.
3. Choose Uninstall and follow the prompts.
4. Restart Windows.
5. Check whether C:Program FilesRiot Vanguard and the Startup entry are gone.

Riot also documents manual service removal commands for cases where normal uninstall does not work. Those commands should be run from an elevated Command Prompt and only when you are intentionally removing Vanguard:

sc delete vgc
sc delete vgk

After using service-removal commands, restart the PC before judging whether the cleanup worked. Do not delete random Vanguard files while the service is still running; that is how leftover entries and broken reinstalls often happen.

What if VGTray.exe uses high CPU or causes errors?

High CPU from the legitimate tray process is not typical for long periods. Short spikes around Riot Client updates or game launch can happen, but constant usage while no Riot game is open deserves investigation.

1. Restart the computer and check whether usage normalizes.
2. Update Riot Client and the game that uses Vanguard.
3. Check Windows Update, especially chipset, security, and driver updates.
4. Repair or reinstall Riot Vanguard through Riot Client.
5. If you do not need Vanguard, uninstall it normally and reboot.
6. If a non-Riot copy of VGTray.exe is using resources, treat it as suspicious and scan the system.

How to remove a suspicious fake VGTray.exe

If the path or signature does not match Riot Vanguard, do not use Riot uninstall instructions as the only cleanup. A fake VGTray.exe may be a separate malware loader or unwanted program.

1. Disconnect from risky networks if you suspect active malware.
2. Open the file location and copy the path for reference.
3. Check Startup apps, Task Scheduler, and services for entries launching that exact file.
4. Remove the suspicious startup/task entry.
5. Delete the original installer, archive, or download that introduced it.
6. Run a full antivirus scan.
7. Reboot and confirm the same path does not return.

FAQ

Is VGTray.exe a virus?

Usually no. The legitimate VGTray.exe belongs to Riot Vanguard. A copy outside the Riot Vanguard folder, without a Riot signature, or launched by a suspicious startup entry should be investigated.

Why is VGTray.exe in Startup?

Riot Vanguard is designed to be available when Riot games that require it are played. The tray process may appear in Startup so the Vanguard icon/status is available after Windows starts.

Can I delete VGTray.exe manually?

Do not delete it manually if it is the real Riot file. Use Riot Vanguard uninstall or Riot’s documented service-removal steps. Manual deletion can leave broken services and startup entries behind.

Will VALORANT or League work without Vanguard?

If the game currently requires Riot Vanguard, it will not launch or will ask you to restart/enable/reinstall Vanguard. Removing Vanguard is fine if you do not play those games.

Why does VGTray.exe still appear after uninstalling?

It may be a leftover Startup entry, a failed uninstall, or another Riot game reinstalling Vanguard. Reboot, check Installed apps, and confirm whether vgc and vgk services still exist.

Bottom line: VGTray.exe is normally Riot Vanguard, not malware. Verify the path and signature before panicking. If it is not in the Riot Vanguard folder or behaves like a fake copy, treat it as suspicious and remove the persistence that launches it.

Spanish Turkish