2

Recently I notice that in Task Manager, I have an Explorer.EXE (capitalized excactly as shown) process, not the usual explorer.exe

Is this normal? Is it a virus? I have uploaded the file to VirusTotal but it's not positive.

Improve this question
2
  • 3
    Where is that Explorer.EXE located? (Use Process Hacker to find the actual path.)
    – u1686_grawity
    Oct 28, 2012 at 21:59
  • If you suspect and infection see this
    – Moab
    Oct 28, 2012 at 23:25

2 Answers 2

Reset to default
9

No, not necessarily. Windows is case-insensitive, so EXPLORER.EXE and explorer.exe are consider to be the same entity; provided they reside at the same path location. The correct location for Explorer is C:\Windows\explorer.exe. If you have an Explorer.exe at a different location, then I would be a little more concerned.

You should get Process Explorer, a tool that gives the information you wish TaskManger was showing you, from the SysInternals site. Microsoft bought SysInternals a few years ago because they, SysInternals, had a better grasp on the MS OSes than the MS developers did.

The reason that Explorer is shown in uppercase sometimes and lowercase others actually derives from the path that executed that instance of explorer.exe; for example, coming from a terminal services session, as is the case when using Remote Desktop to login, will show a capital explorer.exe (if I remember correctly.

Improve this answer
0

Strictly depends on location. Any instances of Explorer.exe outside **%root%\Windows** should be carefully analised and threated as probable malware.

You may also use the website "VirusTotal" to check this possibility.

VirusTotal

Also, how many instances of this process do you have?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .