up vote 2 down vote favorite
1
share [g+] share [fb]

What would happen if an ordinary .exe file is copied to explorer.exe? Will it be automatically running as long as explorer.exe is running? This seems like a major security whole...is it even possible? Does anti-virus protect against that sort of thing?

link|improve this question
feedback

5 Answers

up vote 2 down vote

  • It is not possible to replace an exe of the running process, as it is locked. As explorer.exe is usually running, it is protected by this fact. This protection is by no means complete, as it is easy to kill the process. More important are other protection mechanisms below:

  • There is special mechanism in Windows implemented against this type of attacks / mistakes: Windows File Protection. This mechanism will recover original explorer.exe from a backup any time it is replaced.

  • if you are running a limited account (which is default in Vista or Windows 7), you do not have privileges to modify system files at all, they are protected by access rights.

link|improve this answer
Slight correction. Explorer.exe is not running unless at least one user is logged into the machine. And even once it's running, it's running in the user's context, so the process can be killed. Your other points are valid though. – Ryan Mar 11 '10 at 8:54
You can replace a running application by first renaming the executable and copying the new one over. – Joey Mar 11 '10 at 20:05
feedback
up vote 0 down vote

You can't have two copies of explorer.exe in the windows folder at the same time. So, in short, no it's not possible. Now, someone could modify explorer to contain a virus, in which case yes that would be running. That would likely be detected by any competent antivirus software, as long as the virus in question is in the program's database.

link|improve this answer
What if an exe file is copied to the original explorer.exe? so there is still the original but has another exe copied to it. so there is only one explorer.exe. Is this possible even if explorer.exe is running? – Phillip Mar 11 '10 at 6:01
1  
Not if explorer is actively running, no. What would happen is that then the regular explorer.exe would no longer be there, and you'd immediately notice when windows booted up into something other than explorer. Keep in mind that with Windows File Protection, critical system files like explorer cannot be replaced without going to lengthy, hackish extents which the system will alert you to. It will actually automatically put back the original explorer.exe if it can. – nhinkle♦ Mar 11 '10 at 7:05
feedback
up vote 0 down vote

I'm sure running a process lock any files being used by that process.

link|improve this answer
feedback
up vote 0 down vote

Yes, you can replace explorer.exe. It will be run instead of explorer.exe.

This is done for replacing default windows shell.

link|improve this answer
4  
...! There's a registry key that controls what shell starts at boot, you should never replace explorer.exe without a very good reason! – Phoshi Mar 11 '10 at 9:13
@Phoshi I totally agree... – egon Mar 11 '10 at 13:34
This is also done for running a system in Kiosk mode where you only want the user to be able to run a very specific set of software and is something I've often seen when the system needs to be protected against users running other software or installing things that might break the system. en.wikipedia.org/wiki/Kiosk_software – Mokubai Apr 9 '10 at 17:03
feedback
up vote 0 down vote

You need to have an administrator level account to replace files in the Windows folder. If you already have an administrator account then you already 'own' the box anyway and can do what you want, this isn't a security hole.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown