ExplorerPatcher and antivirus warnings
Antivirus programs have flagged ExplorerPatcher before because it injects code into Explorer, which is what malware also does. Upstream says Microsoft Defender has not flagged it since release 69.4 (3 Oct 2025). Our Defender scans of 71.1 found nothing on two machines. Before you add any exclusion, check that your file is the one GitHub serves.
Checked against ExplorerPatcher 71.1 (26100.9711.71.1) on Windows Server 2025 (24H2 shell) 26100.33674 and Windows 11 Enterprise 25H2 26200.9725 · Nov 6, 2026On this page
What we know in short
- Defender today: the 71.1 release notes (29 Oct 2026) say “Windows Defender no longer flags ExplorerPatcher”. We scanned the setup and the installed files with Microsoft Defender on 6 Nov 2026 and got no detections.
- Other antivirus: detections come and go. Upstream lists exclusion paths for third-party products and tells people not to use EP with SentinelOne.
- Smart App Control: upstream says to check that it is off before installing.
- Why it happens: upstream’s own explanation is that EP changes Explorer’s code and memory, and antivirus heuristics treat that as suspicious.
Timeline of detections
Dates come from GitHub release notes and issue pages (linked), plus a few outside reports. Issue titles are quoted as users wrote them. We did not reproduce any of the old detections, so read this as a history of reports, not as our own test results.
| Date | What happened | Source |
|---|---|---|
| 3 Nov 2021 | Issue “Windows Defender reports Trojan:Win32/Spursint.Q!cl in dxgi.dll” opened and closed two days later. The wiki page “Antivirus false positives” (last edited 19 Nov 2021) explains the detections as heuristic. | Issue 265 |
| Sep to Dec 2023 | Users report virus warnings for 22621.2283.57.2 and for ep_setup.exe. |
Issues 2155, 2610 |
| 15 Jan 2024 | “Bitdefender blocking ExplorerPatcher”. | Issue 2698 |
| 20 to 22 Feb 2024 | Defender flags 22621.3007.63.2 and 63.3. The 63.3 notes say Microsoft flagged it as HackTool:Win64/Patcher and advise turning off real-time protection and excluding the install folder. The 63.4 notes call such detections false positives. |
Issue 2873, 63.3 notes |
| 2 Mar 2024 | Born City reports Defender treating ExplorerPatcher as a potentially unwanted program. | Born City |
| 11 Apr 2024 | Issue “Not downloading due to Virus detected by Windows Defender” (closed 26 Apr 2024). | Issue 3125 |
| 3 to 4 May 2024 | More reports, including “Trojan:Win32/Vigorf.A”. A Microsoft Q&A post of 4 May 2024 names the detection HackTool:Win64/ExplorerPatcher!MTB. |
Issues 3225, 3229, Microsoft Q&A |
| 21 Jul 2024 | The 66.2 pre-release notes say the new taskbar DLL is no longer bundled in the setup “due to false positive antivirus detections”. Current installs include it again: our 71.1 footprint has ep_taskbar.ge.dll in the program folder. |
66.2 notes |
| 1 Sep 2024 | The 66.5 notes say the download is “flagged as malware by Microsoft and very likely by other major antivirus vendors” and list exclusions. | 66.5 notes |
| 10 to 13 Sep 2024 | Several threads: “Trojan Detected | Real or False Positive?” (126 comments), “How to uninstall ExplorerPatcher after virus detection?” and “New version is detected as a Virus on Windows 11”. | Issues 3670, 3682, 3691 |
| 20 May 2025 | The 68.2 notes say Defender does not flag that release but future updates may be flagged within days, because of machine-learning detection. | 68.2 notes |
| 3 Oct 2025 | The 69.4 notes: “Windows Defender no longer flags ExplorerPatcher. It is no longer needed to configure Defender exclusions.” | 69.4 notes |
| 19 May 2026 | The 70.1 notes add the Smart App Control and SentinelOne warnings. They are still in 71.1. | 70.1 notes |
| 20 May to 29 Jun 2026 | Three issues name detections on newer releases: Defender “Wacatac.h!ml” (open), “Trojan detected on lastes update” (open) and “Symantec reporting 26100.8457.70.3 as virus” (closed 2 Jul 2026). We did not verify these reports. | Issues 4965, 5040, 5089 |
Two things stand out. First, the Defender detections of 2024 stopped after upstream changed its code, but upstream itself warned in May 2025 that they could return. Second, the last row shows that “no longer flags” is a statement about one product at one time, not a promise about every antivirus.
Microsoft also acted against this kind of tool in other ways: in 2024 the Windows 11 24H2 setup blocked ExplorerPatcher with a “security or performance issues” message (reported by Neowin), and a comment in the setup source says ep_dwm.exe was renamed ep_dwm_svc.exe because of those upgrade blocks.
Our Defender scans (6 Nov 2026)
We ran a Microsoft Defender custom scan on the downloaded setup file (with a Mark of the Web added, as a browser download would carry) and again on the installed files after the install. The setup files were not code-signed (Authenticode status “NotSigned”).
| Windows 11 Enterprise 25H2, Arm64 (26200.9725) | Windows Server 2025, 24H2 shell, x64 (26100.33674) | |
|---|---|---|
| File scanned | ep_setup_arm64.exe 71.1, 12,013,056 bytes |
ep_setup.exe 71.1, 12,336,128 bytes |
| Detections in the setup file | 0 | 0 |
| Detections in the installed files | 0 | 0 |
| Defender real-time protection | On, tamper protection on | Off (the Windows Server image ships this way) |
| Defender signatures | 1.463.160.0 | 1.463.110.0 |
| Smart App Control | Off | Not reported by this server image |
What this does and does not show:
- It shows Defender, with those signatures, did not report the files in a scan. The install and the use of EP worked normally on both machines, including on the machine with real-time protection on.
- It does not cover other antivirus products. We did not test third-party antivirus, Smart App Control turned on, or SentinelOne.
- On the server image real-time protection was off, so that scan is a manual one. We also did not record Defender’s protection history during the run, only the scan results.
- Detections depend on signature versions and cloud lookups. A new release or a new signature can change the result. The next test run of a new release will update this page.
Smart App Control
Smart App Control is a Windows 11 feature that, when it is on, only lets apps run that Microsoft considers trusted, with code signing as one of the signals. The ExplorerPatcher notes say: “Please verify that Smart App Control is turned off before installing this software. Otherwise there is a risk where explorer.exe would not start up on new EP versions.”
- Our own reading: ExplorerPatcher’s setup is not code-signed (our check of every file we downloaded), so a signature-based allow-list has no reason to trust it. This is our inference. Upstream gives no explanation beyond the warning.
- Our machines had Smart App Control off or not present, so we have no screenshot of what happens when it is on.
- Where to look: Windows Security, App and browser control, Smart App Control settings. Check Microsoft’s current wording before you switch it off, because on some Windows versions turning it off cannot be undone without resetting Windows.
- If Explorer does not start, go to the black screen guide.
SentinelOne and managed security software
The release notes say: “Do not install this software on machines with SentinelOne installed. We have received reports that SentinelOne can hold EP’s files hostage, preventing uninstallation.”
We have not tested SentinelOne. Take the warning at face value, and extend the same caution to any endpoint protection that your employer or school manages. Upstream’s older notes (68.2) said that if your antivirus is managed by your company, they advise against using ExplorerPatcher. Upstream also advises against using its Windows 10 taskbar on work or mission-critical PCs.
Exclusion paths for third-party antivirus
The 71.1 release notes say that if you use third-party security software you might need to exclude these paths. Each one matches a place where our install test put EP files:
| Path | What lives there (from our install test) |
|---|---|
C:\Program Files\ExplorerPatcher |
EP’s main folder: ep_gui.dll, ep_taskbar.ge.dll, weather helper DLLs, ep_dwm_svc.exe, a copy of the setup |
%APPDATA%\ExplorerPatcher |
Microsoft symbol files EP downloads (65 to 92 MB in our runs) and weather data |
C:\Windows\dxgi.dll |
The loader. Upstream: “explorer.exe will not start if this file exists but is blocked from being loaded.” |
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy |
A second dxgi.dll, plus files for the Windows 10 Start menu |
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy |
A third dxgi.dll |
How the loader works is on how ExplorerPatcher works. The important point for antivirus is the dxgi.dll row: if your antivirus quarantines that file, Windows may be left without a working shell. Add the exclusion before installing, or restore the file before you restart Explorer.
Steps that keep you safe:
- Download only from GitHub.
- Check the hash with the Download Verifier.
- Add the exclusions in your antivirus, not in a script from a forum. Older release notes gave a PowerShell script for Defender; the current notes say Defender needs none, so we do not repeat it.
- After you uninstall ExplorerPatcher, remove the exclusions again. They cover system folders.
If your antivirus already deleted or quarantined something
- The setup file was deleted: the file never ran. Download it again from GitHub, check the hash, and decide whether to exclude it.
- EP is installed and the screen is black or the taskbar is missing: a quarantined
C:\Windows\dxgi.dllor a blocked load can do this. Follow the black screen guide. The first step is to start Explorer from Task Manager with Ctrl+Alt+Shift held. - You cannot uninstall: see the uninstall guide. SentinelOne and other products have been reported to block it.
- You have a detection name and want to know what it means: paste it into the Message Decoder on the troubleshooting page.
What we cannot tell you
- Whether your antivirus will flag a given release. That depends on your product and signatures.
- Whether detections will return. Upstream expects they may.
- How third-party products behave. We have not tested any.
If your antivirus flags a genuine file, report it to the antivirus vendor as a false positive. Upstream’s wiki says the developers cannot influence how other products flag a file, and the release notes say issues about antivirus detections will be closed immediately, so take the report to the vendor, not to the upstream issue tracker. For the wider question of safety, read Is ExplorerPatcher safe?.
Common questions
Is ExplorerPatcher a virus?
Not in any sense we could find. Antivirus tools have flagged it because it patches Explorer in memory, which looks like malware behaviour. The code is public under GPL-2.0 and our Defender scans of 71.1 found nothing. Always download from GitHub and check the hash first.
Should I add ExplorerPatcher to my antivirus exclusions?
Only if your antivirus actually blocks it, and only after you checked the file against the hashes on our download page. Upstream lists five paths for third-party antivirus. Upstream also says Defender needs no exclusions any more.
Do I need to turn off Smart App Control?
Upstream says to check that Smart App Control is off before installing, because otherwise explorer.exe may fail to start on new versions. We did not test with it on. Our setup files are not code-signed, which fits that warning.
Can I use ExplorerPatcher with SentinelOne?
Upstream says not to install it on machines with SentinelOne, because reports say SentinelOne can hold EP's files and block uninstalling. We have not tested SentinelOne. On a work PC with managed security software, do not install it.