Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Recently I notice that in Task Manager, I have an Explorer.EXE (capitalized excactly as shown) process, not the usual explorer.exe

Is this normal? Is it a virus? I have uploaded the file to VirusTotal but it's not positive.

share|improve this question
3  
Where is that Explorer.EXE located? (Use Process Hacker to find the actual path.) –  grawity Oct 28 '12 at 21:59
    
If you suspect and infection see this –  Moab Oct 28 '12 at 23:25

2 Answers 2

up vote 7 down vote accepted

No, not necessarily. Windows is case-insensitive, so EXPLORER.EXE and explorer.exe are consider to be the same entity; provided they reside at the same path location. The correct location for Explorer is C:\Windows\explorer.exe. If you have an Explorer.exe at a different location, then I would be a little more concerned.

You should get Process Explorer, a tool that gives the information you wish TaskManger was showing you, from the SysInternals site. Microsoft bought SysInternals a few years ago because they, SysInternals, had a better grasp on the MS OSes than the MS developers did.


The reason that Explorer is shown in uppercase sometimes and lowercase others actually derives from the path that executed that instance of explorer.exe; for example, coming from a terminal services session, as is the case when using Remote Desktop to login, will show a capital explorer.exe (if I remember correctly.

share|improve this answer

Strictly depends on location. Any instances of Explorer.exe outside *%root%\Windows* should be carefully analised and threated as probable malware.

You may also use the website "VirusTotal" to check this possibility.

VirusTotal

Also, how many instances of this process do you have?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.