2

What would happen if an ordinary .exe file is copied to explorer.exe? Will it be automatically running as long as explorer.exe is running? This seems like a major security hole... is it even possible? Do anti-virus products protect against these types of things?

5 Answers 5

3
  • It is not possible to replace an exe of the running process, as it is locked. As explorer.exe is usually running, it is protected by this fact. This protection is by no means complete, as it is easy to kill the process. More important are other protection mechanisms below:

  • There is special mechanism in Windows implemented against this type of attacks / mistakes: Windows File Protection. This mechanism will recover original explorer.exe from a backup any time it is replaced.

  • if you are running a limited account (which is default in Vista or Windows 7), you do not have privileges to modify system files at all, they are protected by access rights.

3
  • 1
    Slight correction. Explorer.exe is not running unless at least one user is logged into the machine. And even once it's running, it's running in the user's context, so the process can be killed. Your other points are valid though. Mar 11, 2010 at 8:54
  • You can replace a running application by first renaming the executable and copying the new one over.
    – Joey
    Mar 11, 2010 at 20:05
  • Maybe I'm wrong about this, but don't you need explorer.exe running to copy a file? Even if you performed the copy function remotely by using UNC paths, I'm still under the assumption that explorer would have to be running on the end PC to finish the copy process. Either way, if this type of attack was feasible, we'd see it out in the wild. I've been doing IT support for over a decade and never once saw an exploit that took advantage of replacing explorer.exe.
    – Geruta
    Jul 13, 2015 at 13:25
1

You need to have an administrator level account to replace files in the Windows folder. If you already have an administrator account then you already 'own' the box anyway and can do what you want, this isn't a security hole.

0

You can't have two copies of explorer.exe in the windows folder at the same time. So, in short, no it's not possible. Now, someone could modify explorer to contain a virus, in which case yes that would be running. That would likely be detected by any competent antivirus software, as long as the virus in question is in the program's database.

2
  • What if an exe file is copied to the original explorer.exe? so there is still the original but has another exe copied to it. so there is only one explorer.exe. Is this possible even if explorer.exe is running?
    – Phillip
    Mar 11, 2010 at 6:01
  • 1
    Not if explorer is actively running, no. What would happen is that then the regular explorer.exe would no longer be there, and you'd immediately notice when windows booted up into something other than explorer. Keep in mind that with Windows File Protection, critical system files like explorer cannot be replaced without going to lengthy, hackish extents which the system will alert you to. It will actually automatically put back the original explorer.exe if it can.
    – nhinkle
    Mar 11, 2010 at 7:05
0

I'm sure running a process lock any files being used by that process.

0

Yes, you can replace explorer.exe. It will be run instead of explorer.exe.

This is done for replacing default windows shell.

3
  • 4
    ...! There's a registry key that controls what shell starts at boot, you should never replace explorer.exe without a very good reason!
    – Phoshi
    Mar 11, 2010 at 9:13
  • @Phoshi I totally agree...
    – Egon
    Mar 11, 2010 at 13:34
  • This is also done for running a system in Kiosk mode where you only want the user to be able to run a very specific set of software and is something I've often seen when the system needs to be protected against users running other software or installing things that might break the system. en.wikipedia.org/wiki/Kiosk_software
    – Mokubai
    Apr 9, 2010 at 17:03

You must log in to answer this question.