Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What would happen if an ordinary .exe file is copied to explorer.exe? Will it be automatically running as long as explorer.exe is running? This seems like a major security hole... is it even possible? Do anti-virus products protect against these types of things?

share|improve this question
  • It is not possible to replace an exe of the running process, as it is locked. As explorer.exe is usually running, it is protected by this fact. This protection is by no means complete, as it is easy to kill the process. More important are other protection mechanisms below:

  • There is special mechanism in Windows implemented against this type of attacks / mistakes: Windows File Protection. This mechanism will recover original explorer.exe from a backup any time it is replaced.

  • if you are running a limited account (which is default in Vista or Windows 7), you do not have privileges to modify system files at all, they are protected by access rights.

share|improve this answer
Slight correction. Explorer.exe is not running unless at least one user is logged into the machine. And even once it's running, it's running in the user's context, so the process can be killed. Your other points are valid though. – Ryan Bolger Mar 11 '10 at 8:54
You can replace a running application by first renaming the executable and copying the new one over. – Joey Mar 11 '10 at 20:05
Maybe I'm wrong about this, but don't you need explorer.exe running to copy a file? Even if you performed the copy function remotely by using UNC paths, I'm still under the assumption that explorer would have to be running on the end PC to finish the copy process. Either way, if this type of attack was feasible, we'd see it out in the wild. I've been doing IT support for over a decade and never once saw an exploit that took advantage of replacing explorer.exe. – Geruta Jul 13 '15 at 13:25

You need to have an administrator level account to replace files in the Windows folder. If you already have an administrator account then you already 'own' the box anyway and can do what you want, this isn't a security hole.

share|improve this answer

You can't have two copies of explorer.exe in the windows folder at the same time. So, in short, no it's not possible. Now, someone could modify explorer to contain a virus, in which case yes that would be running. That would likely be detected by any competent antivirus software, as long as the virus in question is in the program's database.

share|improve this answer
What if an exe file is copied to the original explorer.exe? so there is still the original but has another exe copied to it. so there is only one explorer.exe. Is this possible even if explorer.exe is running? – Phillip Mar 11 '10 at 6:01
Not if explorer is actively running, no. What would happen is that then the regular explorer.exe would no longer be there, and you'd immediately notice when windows booted up into something other than explorer. Keep in mind that with Windows File Protection, critical system files like explorer cannot be replaced without going to lengthy, hackish extents which the system will alert you to. It will actually automatically put back the original explorer.exe if it can. – nhinkle Mar 11 '10 at 7:05

I'm sure running a process lock any files being used by that process.

share|improve this answer

Yes, you can replace explorer.exe. It will be run instead of explorer.exe.

This is done for replacing default windows shell.

share|improve this answer
...! There's a registry key that controls what shell starts at boot, you should never replace explorer.exe without a very good reason! – Phoshi Mar 11 '10 at 9:13
@Phoshi I totally agree... – Egon Mar 11 '10 at 13:34
This is also done for running a system in Kiosk mode where you only want the user to be able to run a very specific set of software and is something I've often seen when the system needs to be protected against users running other software or installing things that might break the system. – Mokubai Apr 9 '10 at 17:03

You must log in to answer this question.