Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using a program that allows for customizing the look of the Windows start button (orb) in Windows 7 (SP1). It's a fact that it does it by modifying the explorer.exe file in the C:\Windows folder. The program does work, and the Windows start button gets changed as expected, but the problem is that it holds on only till next reboot.

When I compare supposedly modified explorer.exe with the original one I made a backup of, they are identical, even though Windows start button has obviously changed. It appears that the explorer.exe gets reverted to the original file immediately after the modified one has been loaded into memory, but it's just a conjecture of mine.

Taking ownership of explorer.exe and granting full permissions on the file to all the kinds of users (myself, admins, system, trustedinstaller) didn't help. Disabling all third-party anti-malware software I've got on my PC didn't help either.

How can I make these modifications without them reverting on reboot?

share|improve this question

As I understand it, explorer.exe (and most of your Windows folder) is protected by Windows Resource Protection. When you reboot, Windows detects the replaced version of explorer.exe and restores it from the backup folder: %windir%\winsxs\Backup

This explains the symptoms you're experiencing. As to bypassing WRP, hopefully someone else here will be able to offer some assistance here. In the old days we used to simply replace explorer.exe in the Windows folder, and the DLLCache folder. However that doesn't seem to exist since Vista.

share|improve this answer
Hmm. Can't seem to find original explorer.exe among the files located in %windir%\winsxs\Backup. Was searching by the file size of the explorer.exe it keeps restoring to. Maybe I was wrong about my theory of Windows being overly protective... – Desmond Hume Feb 12 '13 at 0:48

If the program is patching explorer in place it is a very poorly written program. I suspect that it may be leaving the normal explorer alone (or making a copy of it) and modifying what program windows uses for your default shell.

Check the regestery key for HKEY_Current_User\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell and see if your program is replacing it, you could have some other program on your computer restoring that registery key back to the default value.

Here is some more information on how windows sets it's shell. The article says it is for XP embedded but it still applies to Windows 7.

share|improve this answer

Use the latest version of the Modifying tool which allows you to patch the Start Button in memory. It uses a dummy .exe as Shell which loads the Explroer.exe and modifies the Start-Orb in memory.

enter image description here

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.