Explorer.exe file description |
Explorer.exe with description Windows Explorer is a process file from company Microsoft Corporation belonging to product Microsoft® Windows® Operating System.
In total there are 20 launchpoints for this file including "Running processes".
There are 15 different variations of the file in our database and the file is
digitally signed from Microsoft Corporation - Microsoft Timestamping Service
We do not recommend removing digitally signed files from Microsoft Corporation
What is explorer.exe?
Windows Explorer, or explorer.exe, is the default Windows user shell. This process is responsible for the file manager, desktop, and taskbar. As such, it is arguably the most readily apparent process in Windows. The following screenshot shows the taskbar and an Explorer window, both of which are part of Windows Explorer:
Despite its ubiquity, Explorer can be safely terminated. Doing so, however, will prevent you from launching any programs via the graphical user interface (as your taskbar, start menu, and icons will be gone). The screenshot below illustrates how explorer.exe should appear in the task manager:
Notice that this process always runs as the current user (in this case, Mike). An explorer.exe process running as a user such as SYSTEM may be indicative of malware; however, a copy of this process running as the current user does not necessarily mean that the process is legitimate.
Dangers of explorer
As this is a ubiquitous process that is running on any system on which one wishes to use the graphical user interface, it is extremely common for virus writers and spyware vendors to disguise their malware as the genuine Explorer.
Some malicious files will have the same name as this process but will be stored somewhere other than in %SystemRoot%. Other malware will use a name that appears similar to it but with slight differences in spelling or with appended digits. The following malware is known to disguise itself as Explorer:
- W32.MyDoom
- This is a common worm, some variants of which have a backdoor trojan component.
- W32.SCKeyLog
- A keylogger that installs itself in %SystemRoot%\System32
- explorer32.exe
- This process indicates the presence of one or more instances of a variety of viruses and/or spyware. Some common causes of explorer32.exe are W32.KWBot-A, StartPa-MN, and several keyloggers.
There will typically be only one copy of this process running at a given time for a given user. If multiple copies are running, one or more of the instances may be malware.
Common problems
- "Windows Explorer has encountered a problem and needs to close"
- If this only happens occasionally, it is not cause for concern.
- If Explorer crashes when browsing a folder that contains media items, a faulty codec could be to blame. Uninstall any additional codecs that you have installed and try again.
- If the problem persists, perform a repair installation of Windows.
- Explorer.exe uses 100% CPU time
- This can occur when Windows is looking for network folders. Try disabling "Automatically search for network printers and folders" by opening an Explorer window and going Tools -> Folder Options -> View
- As a workaround, open the Task Manager and kill explorer.exe. Click on File -> New Task (Run...) and type "explorer" (without quotes).
|
Automatic startup locations |
 |
001 Running Processes |
 |
002 Autorun registry entries local machine |
|
003 Autorun registry entries Current User |
 |
004 All users startup startmenu |
|
005 Current user startup startmenu |
|
006 Start Menu\Programs\Startup |
|
007 Roaming Start Menu\Programs\Startup |
|
008 Autorun registry entries Default user |
|
009 Autorun registry entries SYSTEM user |
 |
010 Installed services |
 |
033 Winlogon Userinit |
|
034 Winlogon Shell |
|
035 Active Setup Installed Components |
|
065 Image File Execution Options (debugger) |
|
073 %windir%\Tasks |
|
138 Local Machine RunonceEx (+subkeys) |
 |
146 AlternateShell |
|
162 HKLM Policies\System\Shell |
|
163 HKCU Policies\System\Shell |
|
166 HKCU Policies\Explorer\Run |
|
File versions in our database |
| |
Company |
Version |
Size |
 |
n/a |
n/a |
4294967295 |
|
Microsoft Corporation |
5.00.2920.0000 |
4294967295 |
|
Microsoft Corporation |
5.00.3700.6690 |
4294967295 |
|
Microsoft Corporation |
6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) |
4294967295 |
|
Microsoft Corporation |
6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) |
4294967295 |
|
Microsoft Corporation |
6.00.2900.5512 (xpsp.080413-2105) |
4294967295 |
|
Microsoft Corporation |
6.00.2900.5512 (xpsp.080413-2105) |
14189568 |
|
Microsoft Corporation |
6.00.2900.3156 (xpsp_sp2_qfe.070613-1311) |
5984768 |
|
Microsoft Corporation |
6.00.2900.5512 (xpsp.080413-2105) |
4923904 |
|
Microsoft Corporation |
6.00.2900.5512 (xpsp.080413-2105) |
4922880 |
|
Microsoft Corporation |
6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) |
4922368 |
|
Microsoft Corporation |
6.00.2900.5512 (xpsp.080413-2105) |
4922368 |
|
Microsoft Corporation |
6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) |
4921856 |
|
Microsoft Corporation |
6.00.2900.5512 (xpsp.080413-2105) |
4921856 |
|
Microsoft Corporation |
6.00.2900.5512 (xpsp.080413-2105) |
4920320 |
|
|
Digital signatures found for this file |
| |
Signer of certificate |
Issuer of certificate |
 |
Microsoft Corporation |
Microsoft Timestamping Service |
|
Microsoft Corporation |
VeriSign Time Stamping Services Signer |
|
Microsoft Windows |
GeoTrust TrustCenter Authenticode Timestamp I |
|
Microsoft Windows |
Microsoft Time-Stamp Service |
|
Microsoft Windows |
Microsoft Timestamping Service |
|
Microsoft Windows |
VeriSign Time Stamping Services Signer |
|
Microsoft Windows 2000 Publisher |
NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc. |
|
Microsoft Windows 2000 Publisher |
VeriSign Time Stamping Service |
|
Microsoft Windows 2000 Publisher |
VeriSign Time Stamping Services Signer |
|
Microsoft Windows 2000 Publisher (Europe) |
VeriSign Time Stamping Service |
|
Microsoft Windows 2000 Publisher (Europe) |
VeriSign Time Stamping Service CA SW1 |
|
Microsoft Windows Component Publisher |
Microsoft Timestamping Service |
|
Microsoft Windows Component Publisher |
VeriSign Time Stamping Services Signer |
|
Microsoft Windows Publisher |
VeriSign Time Stamping Service |
|
Microsoft Windows Publisher |
VeriSign Time Stamping Services Signer |
|
|
MD5 security rating in our database |
 |
 |
|
2723 |
files (Not yet rated
and
not
signed) |
|
|
4 |
files (Not yet rated
and
digitally
signed) |
 |
|
9 |
files (Safe
and
not
signed) |
|
|
385 |
files (Safe
and
digitally
signed) |
|
|
|
Some versions of this filename have not yet been checked for safety.
|
Fix explorer.exe application error: Run a free registry scan
Warning: Some malware might rename itself to explorer.exe. Always make sure that your file is from a verified publisher. |
|
| User comments for Explorer.exe |
There are no comments yet.
|
|
Database statistics
Top process list
