I should also add that malware have been known to create fake explorer.exe files. I didn’t think that to be a concern here but if anyone were to be concerned about this:
- The fake program will be more obvious because it will probably run all the time and access IP addresses that are not related to Microsoft.
- Check the VirusTotal scan in GlassWire (a feature I really like) or use another anti-virus to scan of the file.
- Confirm that explorer.exe runs from the Windows folder e.g. C:\windows\explorer.exe. The screenshot shows a check of the process properties for Windows Explorer in Task Manager:
