[SOLVED] Suspicious Explorer.exe

[Daweee]

Hi. Today i installed a free program but it was not from official site and i didnt recognize it first.. After the installation is completed suddenly 4 fake game icons appeared on desktop and when i go to where it belongs it says explorer.exe then without opening them downloaded malwarebytes it says 4 exes have wmihijacker. Removed them without problem but i realized something. Türe are more explorer.exe in C:/Windows. One is in the syswow64 others are in AMD driver or smth like that and last one (which is running in task manager) belongs in C:/Windows not in subfolder and their creation time is today, but earlier hours before installing that program. Also no anormal CPU or memory usage. Is there any problem? (Sorry for bad English)

 

[SteveRX4]

What is "Türe "?

See https://www.samlogic.net/articles/32-64-bit-windows-folder-x86-syswow64.htm
"Two different versions of the Program Files folder and the Windows System folder

A 64-bit Windows has two different versions of the program files folder and the Windows system folder (system directory). One version is intended for 32-bit files and other version is intended for 64-bit files. The name of these folders, and the bitness they are intended for, is shown in the table below:

Folder name	Bitness	Description
System32	64	Windows System folder (system directory) for 64-bit files
SysWOW64	32	Windows System folder (system directory) for 32-bit files
Program Files	64	Folder for 64-bit program files
Program Files (x86)	32	Folder for 32-bit program files

 

[Daweee]

Not türe its There* stupid auto correct. I understood the thing you explained but it says that explorer.exe is created and changed today.

 

[SteveRX4]

Not türe its There* stupid auto correct. I understood the thing you explained but it says that explorer.exe is created and changed today.

What says that?

"Today i installed a free program but it was not from official site and i didnt recognize it first "
What program?

 

[Deleted member 14196]

Time to format and reinstall. Also stop pirating games and you won’t have this problem

 

[SteveRX4]

Can you run Malwarebytes (free edition) and see if you have any vitrus/malware?

 

[Colif]

i can see one explorer.exe running. Its in C:/windows, this is the one running almost all the applications

Syswow is the folder for 32bit applications. Fun fact, even if you have an Intel PC you will have an AMD folder as it has something to do with how 64bit was introduced.

There are 2 versions of explorer.exe on PC, the 64bit version and the 32bit version.

Now if I run a search of C drive on my PC I find many many explorer.exe and almost all of them are in syswow. 19 of them in fact. But they aren't running, they are likely there to assist 32bit operations. Windows also might use it to install parts of itself.

It is perfectly normal. If you find 2 running, you are running a 32bit program at the time.