English | Deutsch


Is explorer.exe safe?

Explorer.exe is a executable file (a program) within Windows. The filename extension .exe denotes an executable file. You should only run executable files from publishers you trust, because executable files can potentially change your computer settings or harm your computer. The free file information forum can help you determine if explorer.exe is a virus, trojan, spyware, or adware that you can remove, or a file belonging to a Windows system or to an application you can trust.


Explorer.exe file information

The process known as Windows Explorer or Win or Explorador de Windows or Windows Verkenner or ams60_launch or AutoPlay Application or Security Key Relauncher or Install

belongs to software Microsoft Windows Operating System or Windows Updater or Project1 or Sistema operativo Microsoft Windows or Win or Betriebssystem Microsoft Windows or Projekt_Neu or Projekt1

by Microsoft (www.microsoft.com) or xxxx or PRIVAT or Cybersamurai INC or Dritek System (www.dritek.com.tw) or aaaa or Home or air.

Description: The original explorer.exe from Microsoft is an important part of Windows, but often causes problems. explorer.exe is located in the folder C:\Windows. Known file sizes on Windows 7/XP are 1,032,192 bytes (30% of all occurrences), 1,035,264 bytes and 334 more variants. http://www.file.net/process/explorer.exe.html 
Explorer.exe is a Windows core system file. The program has a visible window. Explorer.exe is a Microsoft signed file. Explorer.exe is able to record inputs. Therefore the technical security rating is 2% dangerous, however also read the users reviews.

Recommended: Identify explorer.exe related errors

Viruses with the same file name

Is explorer.exe a virus? No, it is not. The true explorer.exe file is a safe Microsoft Windows system process, called "Windows Explorer". However, writers of malware programs, such as viruses, worms, and trojans deliberately give their processes the same file name to escape detection. Viruses with the same file name are for example TSPY_ARDAMAX.CM or TROJ_GEN.R72C3LI (detected by TrendMicro), and MonitoringTool:Win32/Ardamax or Trojan:Win32/Malagent (detected by Microsoft).
To ensure that no rogue explorer.exe is running on your PC, click here to run a Free Malware Scan.

How to recognize suspicious variants? If explorer.exe is located in the folder C:\Windows\System32, the security rating is 78% dangerous. The file size is 36,864 bytes (15% of all occurrences), 302,080 bytes and 113 more variants. The file is not a Windows core file. The explorer.exe file is located in the Windows folder, but it is not a Windows core file. The program has no visible window. There is no file information. The program starts upon Windows startup (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\open\command, HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile\shell\open\command, HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, C:\Windows\win.ini, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce). Explorer.exe is able to monitor applications, hide itself and record inputs.

If explorer.exe is located in a subfolder of C:\Windows\System32, the security rating is 75% dangerous. The file size is 1,478,612 bytes (29% of all occurrences), 470,528 bytes and 42 more variants. It is not a Windows core file. It is a file without information about the developer of this file. The program is not visible. It is located in the Windows folder, but it is not a Windows core file. The process starts when Windows starts (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\open\command, HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile\shell\open\command, HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, C:\Windows\win.ini, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce). Explorer.exe is able to record inputs, monitor applications and hide itself.

If explorer.exe is located in a subfolder of C:\Windows, the security rating is 83% dangerous. The file size is 64,000 bytes (28% of all occurrences), 58,880 bytes and 34 more variants.

If explorer.exe is located in a subfolder of "C:\Documents and Settings", the security rating is 54% dangerous. The file size is 59,392 bytes (5% of all occurrences), 102,912 bytes and 32 more variants.

If explorer.exe is located in a subfolder of "C:\Program Files", the security rating is 57% dangerous. The file size is 45,056 bytes (16% of all occurrences), 337,920 bytes and 18 more variants.

If explorer.exe is located in a subfolder of "C:\Program Files\Common Files", the security rating is 71% dangerous. The file size is 651,264 bytes (14% of all occurrences), 118,784 bytes and 5 more variants.

If explorer.exe is located in a subfolder of C:\, the security rating is 20% dangerous. The file size is 1,032,704 bytes (25% of all occurrences), 1,032,192 bytes, 1,050,624 bytes or 180,284 bytes.

If explorer.exe is located in the folder "C:\Program Files", the security rating is 88% dangerous. The file size is 13,179,660 bytes (50% of all occurrences), 99,840 bytes or 216,064 bytes.

If explorer.exe is located in a subfolder of the "My Files" folder, the security rating is 37% dangerous. The file size is 167,936 bytes (50% of all occurrences) or 40,960 bytes.

If explorer.exe is located in C:\, the security rating is 65% dangerous. The file size is 19,794 bytes (50% of all occurrences) or 392,704 bytes.

If explorer.exe is located in the Windows Temp folder, the security rating is 70% dangerous. The file size is 159,744 bytes.

If explorer.exe is located in the folder C:\Windows\System32\drivers, the security rating is 82% dangerous. The file size is 724,992 bytes.

External information from Paul Collins:
There are different files with the same name:

  • "ccreg" definitely not required. Added by the ZCREW TROJAN! Note - the valid "explorer.exe" is located in C:\Windows or C:\Winnt whereas this one is located in a C:\Windows\System or C:\Winnt\System subdirectory
  • "Explore" definitely not required. Added by the IRC.FLOOD.G TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would only be in startups if you added it manually
  • "explorer" can run at start up. Starts Windows Explorer. Unless this has been manually added to startups or added by another program it could be a virus such as PE_BISTRO or DVLDR or MYDOOM.C. Note that it is also not the explorer.exe task/service you'll see when via CTRL+ALT+DEL
  • "Explorer lptt01" definitely not required. Variant of the RapidBlaster parasite (in an "explorer" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here. Note - this is not the legitimate Windows Explorer (explorer.exe) which would only be in startups if you added it manually!
  • "loadMecq0" definitely not required. Added by the MUMUBOU.C TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would only be in startups if you added it manually
  • "smsys" definitely not required. Added by the CLICKER-C TROJAN! Note - the valid "explorer.exe" is located in C:\Windows or C:\Winnt whereas this one is located in a C:\Windows\Template or C:\Winnt\Template subdirectory
  • "Sustem" definitely not required. Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would only be in startups if you added it manually
  • "system" definitely not required. Added by the GRAYBIRD TROJAN! Note - this is located in this is located in C:\Windows\System (Win9x/Me), C:\Winnt\System32 (WinNT/2K), or C:\Windows\System32 (WinXP) rather than the valid Windows Explorer which is located in C:\Windows or C:\Winnt
  • "System Update2" definitely not required. Added by the AUTOTROJ-C TROJAN!
  • "Windowz Update V2.0" definitely not required. Added by the YODO WORM! Note - the valid "explorer.exe" is located in C:\Windows or C:\Winnt whereas this one is located in the System32 sub-directory

Important: Some malware disguises itself as explorer.exe, particularly when not located in the C:\Windows folder. Therefore, you should check the explorer.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.



Score

User Comments

I got it when i downloaded a File from the internet... My virus scanner said it was the famous FBI Moneypak virus!!! The money pak virus asks for money and locks your computer!
  AlexO  
Strange, When I log off (or shutdown) the computer, there is a non-responding that says "End Program: explorer.exe" something is very suspicious.
  experienced_computer  
It's rather irritating when trying to open Windows Explorer and I'm told I don't have permission because of explorer.exe
  Austin  
this is a system program to display icon and other stuff if u do not believe then go to taskbar and end the process explorer.exc and then see it randi ko chora
  puti  
It's ESSENTIAL to showing the task bar, and is included in the installation package of every Windows OS I know of (Windows XP, Vista, and 7).
  AlekTheNerd  
Just a microsoft process. Killing it is fine, you just have to re-launch it by starting new task "explorer.exe". Re-launching it will reload your taskbar.
  B  
I went to task manager and saw this file was using almost 90,000 K of memory, did a google search and ended up here. I did a "search" on my computer and 5 files, 4 were similar to each other and last modified in 2008. ONE was modified on 4/1/2013 at 3:53 pm. That's really close to the time I lost access to the internet for 2 days! I was on the phone with Internet provider for 1 hour Monday evening and 45 minutes Tues. morning, they couldn't figure it out, so sent a tech. When he got here this morning it was working fine. Weird. Oh, also, as I was running a search for files containing explorer.exe the memory usage kept going down. It's now at 8,840K.
  Tami  
Never kill or end the "explorer.exe" process in windows. Because after that you cannot recover the task bar and Desktop icons and you will be screwd. Fortunately, I had a KVM console attached to my server and had to reboot the server to retrieve my desktop :-)
  katalina  
More comments can be found here:
    (further information)

Rating chart

Summary: Average user rating of explorer.exe: based on 360 votes with 9 reviews.
186 users think explorer.exe is essential for Windows or an installed application. 14 users think it's probably harmless. 75 users think it's neither essential nor dangerous. 24 users suspect danger. 61 users think explorer.exe is dangerous and recommend removing it. 55 users don't grade explorer.exe ("not sure about it").


Do you have additional information?
What do you know about explorer.exe: 
How do you rate it: 
Link for more info's: 
Your Name: 


Explorer scanner


Security Task Manager shows all running Windows tasks including embedded hidden functions (e.g. keyboard or browser monitoring, autostart entry). A unique security risk rating indicates the likelihood of the process being potential spyware, malware, keylogger or a Trojan.

Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, trojans, keyloggers, malware and tracking threats from your hard disk. Ideal supplement to Security Task Manager.

SpeedUpMyPC scans, cleans, repairs and optimizes your computer.


Other processes


explorer.exe [all]