Can't copy or delete certain files and explorer.exe uses over 50% CPU

07
2014-07
  • user312343

    Not sure what to do. I can't copy, overwrite or delete certain files in certain locations, like the desktop. They look like they are copying or deleting but the get stuck at 0%. Also, explorer.exe sometimes uses upwards of 50% to 90% CPU. This makes the system pretty unusable.

    I ran SFC and it says "Windows Resource Protection did not find any integrity violations."

    I'm not sure how to proceed.

    • Answers
    Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

    Related Question

    windows - Copy .exe to Explorer.exe!
  • Questioner

    What would happen if an ordinary .exe file is copied to explorer.exe? Will it be automatically running as long as explorer.exe is running? This seems like a major security whole...is it even possible? Does anti-virus protect against that sort of thing?


    • Related Answers
  • Suma

    • It is not possible to replace an exe of the running process, as it is locked. As explorer.exe is usually running, it is protected by this fact. This protection is by no means complete, as it is easy to kill the process. More important are other protection mechanisms below:

    • There is special mechanism in Windows implemented against this type of attacks / mistakes: Windows File Protection. This mechanism will recover original explorer.exe from a backup any time it is replaced.

    • if you are running a limited account (which is default in Vista or Windows 7), you do not have privileges to modify system files at all, they are protected by access rights.

  • GAThrawn

    You need to have an administrator level account to replace files in the Windows folder. If you already have an administrator account then you already 'own' the box anyway and can do what you want, this isn't a security hole.

  • nhinkle

    You can't have two copies of explorer.exe in the windows folder at the same time. So, in short, no it's not possible. Now, someone could modify explorer to contain a virus, in which case yes that would be running. That would likely be detected by any competent antivirus software, as long as the virus in question is in the program's database.

  • RichN

    I'm sure running a process lock any files being used by that process.

  • egon

    Yes, you can replace explorer.exe. It will be run instead of explorer.exe.

    This is done for replacing default windows shell.