52

I have reason to believe that I may have malware on my system in the form of an Explorer extension. I suspect this because Procmon shows that Explorer.exe keeps re-writing a certain Registry key that is intended to run a certain EXE at startup.

How do I find out what Explorer extensions are installed, and how do I remove them?

5 Answers 5

63

My personal favorite is Autoruns from Sysinternals (Microsoft). It goes well beyond just shell extensions and covers tons of areas where third party code can run.

Assuming you've done a virus scan and it didn't catch it, you might want to watch this excellent video from Mark Russinovich on advanced malware cleaning techniques.

1
  • Thanks for this! I had a problem where Explorer would hang for 10 seconds after a right-click on any file. I installed Autoruns, opened the "Explorer" tab and unchecked everything that didn't look useful. My freezes on right-click went away immediately!
    – Hunternif
    Dec 21, 2023 at 22:31
21

ShellMenuView is a small utility that display the list of static menu items that appeared in the context menu when you right-click a file/folder on Windows Explorer, and allows you to easily disable unwanted menu items

2

Shell Extensions are in-process COM objects which extends the abilities of Windows operating system. Most shell extensions are automatically installed by the operating system, but there are also many other applications that install additional shell extension components. For example: If you install WinZip on your computer, you'll see a special WinZip menu when you right-click on a Zip file. This menu is created by adding a shell extension to the system.

The ShellExView utility displays the details of shell extensions installed on your computer, and allows you to easily disable and enable each shell extension.

4

2
  • 4
    Interestingly, these tools finds a lot of things that Autoruns doesn't...
    – Zero3
    Jan 2, 2016 at 23:46
  • Why do we have to rely on potentially malicious third party code to do this?
    – John Glen
    Nov 15, 2023 at 3:17
6

CCleaner also has a feature to clean up the context menu.

It's found under Tools -> Startup -> Context Menu

1
  • +1 for an Excellent free tool for doing this. Found and removed an unwanted context menu item (in the right-click menu) that I couldn't find using ShellMenuView and ShellExView. Aug 18, 2016 at 9:42
3

Check this location in the registry and see if there is a sub-key called 'Blocked'. I found my sharing tabs disappeared because the CLSID was located there:

\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked

I suppose if you want to block a shell extension, that's a good place to do it since it's pretty darned effective and pretty unknown it seems. Only one of my machines had that sub-key and I had never heard of it before.

1
  1. Get Process Explorer.
  2. Use Process Explorer to suspend any suspect processes to stop them from writing to registery.
  3. Get Auto Runs.
  4. Use the Autoruns to look at everything that gets loaded at start up, into Explorer and Internet Explorer and shut down any suspect services (non-Microsoft).
  5. Find Google Updater, Adobe Updater and Flash Utils processes and rename and stop them from running.
2
  • 4
    Suspend the process instead of killing it. It keeps malware "buddies" from restarting each other.
    – Josh
    May 20, 2011 at 3:55
  • @Josh: But not from unsuspending each other... :)
    – Timwi
    May 20, 2011 at 15:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .