Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What would happen if an ordinary .exe file is copied to explorer.exe? Will it be automatically running as long as explorer.exe is running? This seems like a major security whole...is it even possible? Does anti-virus protect against that sort of thing?

share|improve this question
add comment

5 Answers

  • It is not possible to replace an exe of the running process, as it is locked. As explorer.exe is usually running, it is protected by this fact. This protection is by no means complete, as it is easy to kill the process. More important are other protection mechanisms below:

  • There is special mechanism in Windows implemented against this type of attacks / mistakes: Windows File Protection. This mechanism will recover original explorer.exe from a backup any time it is replaced.

  • if you are running a limited account (which is default in Vista or Windows 7), you do not have privileges to modify system files at all, they are protected by access rights.

share|improve this answer
    
Slight correction. Explorer.exe is not running unless at least one user is logged into the machine. And even once it's running, it's running in the user's context, so the process can be killed. Your other points are valid though. –  Ryan Bolger Mar 11 '10 at 8:54
    
You can replace a running application by first renaming the executable and copying the new one over. –  Јοеу Mar 11 '10 at 20:05
add comment

You need to have an administrator level account to replace files in the Windows folder. If you already have an administrator account then you already 'own' the box anyway and can do what you want, this isn't a security hole.

share|improve this answer
add comment

You can't have two copies of explorer.exe in the windows folder at the same time. So, in short, no it's not possible. Now, someone could modify explorer to contain a virus, in which case yes that would be running. That would likely be detected by any competent antivirus software, as long as the virus in question is in the program's database.

share|improve this answer
    
What if an exe file is copied to the original explorer.exe? so there is still the original but has another exe copied to it. so there is only one explorer.exe. Is this possible even if explorer.exe is running? –  Phillip Mar 11 '10 at 6:01
1  
Not if explorer is actively running, no. What would happen is that then the regular explorer.exe would no longer be there, and you'd immediately notice when windows booted up into something other than explorer. Keep in mind that with Windows File Protection, critical system files like explorer cannot be replaced without going to lengthy, hackish extents which the system will alert you to. It will actually automatically put back the original explorer.exe if it can. –  nhinkle Mar 11 '10 at 7:05
add comment

I'm sure running a process lock any files being used by that process.

share|improve this answer
add comment

Yes, you can replace explorer.exe. It will be run instead of explorer.exe.

This is done for replacing default windows shell.

share|improve this answer
4  
...! There's a registry key that controls what shell starts at boot, you should never replace explorer.exe without a very good reason! –  Phoshi Mar 11 '10 at 9:13
    
@Phoshi I totally agree... –  egon Mar 11 '10 at 13:34
    
This is also done for running a system in Kiosk mode where you only want the user to be able to run a very specific set of software and is something I've often seen when the system needs to be protected against users running other software or installing things that might break the system. en.wikipedia.org/wiki/Kiosk_software –  Mokubai Apr 9 '10 at 17:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.