No—CreateExplorerShellUnelevatedTask is normally a legitimate Windows scheduled task, not a virus. Explorer creates it on demand when an elevated Explorer process needs to hand control back to a normal, non-elevated Explorer process. Microsoft’s Raymond Chen described the behavior as: The CreateExplorerShellUnelevatedTask is created on demand when Explorer is first launched elevated.
The name alone cannot authenticate a task. Check the configured action, its complete file path, the digital signature of the executable, and the task’s metadata before deciding whether anything is wrong.
As an Amazon Associate I earn from qualifying purchases.
What CreateExplorerShellUnelevatedTask does
Windows Explorer is the desktop shell: it provides File Explorer windows, the desktop, the taskbar, and other shell functions. Some applications must interact with Explorer from a normal user context even when an administrator has temporarily started Explorer with elevated rights.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →When Explorer detects that it is running elevated, it uses the scheduled-task mechanism to start a non-elevated Explorer instance and then lets the elevated instance exit. This preserves the normal privilege boundary instead of leaving the whole desktop shell running with administrator rights.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
That is why the task can appear after you have started Explorer with “Run as administrator” or another elevation path. It is created on demand rather than being required on every installation from the first boot. A computer that has never launched Explorer elevated may not show the task, while another computer may retain it after the elevated session has ended.
Raymond Chen’s Microsoft explanation identifies the purpose directly: Explorer creates the task when it is first launched elevated so it can relaunch itself without elevation. The task’s presence, absence, or creation time is therefore not an infection test.
Why the name is not proof of safety
Scheduled tasks are normal Windows infrastructure, but malware also uses scheduled tasks to obtain persistence. Microsoft Security Intelligence documents scheduled-task abuse as a behavioral technique. That means a suspicious task can imitate a familiar name, alter an existing task, or create a similarly named task whose action runs a script or an executable from a user-writable directory.
Recommended Free Tools
Consequently, “the name looks like a Windows task” is insufficient, and “the task exists” is not evidence of a virus. The configured action and the file it launches are the decisive checks.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Expected characteristics of a legitimate installation
| Item to inspect | Expected indication | Warning sign |
|---|---|---|
| Task action | Launches the Windows Explorer executable. | Runs a script, PowerShell, a command interpreter, an unfamiliar executable, or a command with unexplained arguments. |
| Executable path | Points to the normal Windows directory through the system Windows path, such as %WINDIR%explorer.exe. |
Points to a download directory, a temporary folder, an AppData subfolder, a removable drive, a network share, or another user-writable location. |
| Digital signature | The file has a valid Microsoft signature and the expected Microsoft publisher information. | The signature is missing, invalid, expired in a way Windows reports as untrusted, or belongs to an unrelated publisher. |
| Task metadata | Task path, author, triggers, and settings are consistent with a Windows shell task. | Recently added metadata, an unknown author, unusual triggers, hidden execution, or persistence settings that do not fit Explorer’s purpose. |
| Process relationship | The action corresponds to the installed Windows explorer.exe. |
The task launches a second binary with a similar name, such as an executable that only resembles Explorer. |
An AnalysePC entry associates the observed task with C:WINDOWSexplorer.exe, Microsoft Corporation, and a valid signature, and classifies that observation as legitimate or neutral. That report is useful as a reference pattern, not as a substitute for checking your own computer.
How to verify the task in Task Scheduler
- Open Task Scheduler. Press
Win+R, entertaskschd.msc, and press Enter. You can also search for “Task Scheduler” from the Start menu. - Locate the task. Browse the Task Scheduler Library and its subfolders, or use the task list’s name column to find
CreateExplorerShellUnelevatedTask. Select the entry rather than relying on a search result from a third-party utility. - Inspect the Actions tab. Open the task’s Properties and select Actions. Record the program or script, arguments, and “Start in” directory. The expected action is the Windows Explorer executable, not a script or an unrelated helper.
- Check the complete path. Follow the action to the file on disk. A normal Windows installation uses the system Windows directory, represented safely as
%WINDIR%explorer.exe. Do not assume that every file namedexplorer.exeis genuine; malware can use a copied name in another directory. - Review the General tab. Note the task path, author, description, security options, and whether the task is hidden. These fields are supporting evidence. A familiar name does not override an unexpected action.
- Review Triggers and Settings. The trigger pattern should make sense for a shell handoff. An unexplained schedule, logon trigger, repeated short interval, or “run whether user is logged on or not” setting warrants further investigation, especially when combined with an unusual executable path.
- Record the details before changing anything. Write down the task path, action, arguments, author, triggers, and file location. Keeping a copy makes it possible to restore a setting or explain the finding to a security professional.
How to check explorer.exe’s publisher and signature
After you have identified the file named in the task action, verify that exact file rather than checking a different copy of Explorer.
- In File Explorer, navigate to the path shown in the task action.
- Right-click the executable, choose Properties, and open Digital Signatures.
- Select the signature and choose Details. Windows should report that the digital signature is valid and identify Microsoft as the signer or publisher appropriate to that Windows installation.
- Use the General and Details tabs to compare the file description, product information, and location with the installed Windows system.
A missing or invalid signature is an investigation signal, not an automatic diagnosis. System corruption, an incomplete update, or a damaged certificate chain can also affect verification. If the signature is invalid and the file is outside the normal Windows directory, treat the combination as high risk and scan the file with your organization’s security tools.
Command-line checks for a precise comparison
Task Scheduler’s graphical view is usually enough, but command-line output helps when a task is hidden, duplicated, or difficult to locate.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download] | Includes Scam Protection, Advanced VPN, Dark Web Monitoring, & PC Cloud Backup](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
List the task and its verbose properties
schtasks /query /fo LIST /v | findstr /i "CreateExplorerShellUnelevatedTask"The output can reveal the task path, status, run-as account, triggers, and action details. If the filter returns more than one entry, examine each task path; a malicious copy may use a different folder while reusing the same display name.
Inspect the task with PowerShell
$tasks = Get-ScheduledTask | Where-Object TaskName -eq 'CreateExplorerShellUnelevatedTask'
$tasks | Format-List TaskName,TaskPath,Author,State,Actions,Triggers,PrincipalTo see recent execution information for a selected task, use:
$tasks | Get-ScheduledTaskInfo | Format-List *These commands do not prove that an action is safe; they make the configured command and metadata easier to read and document.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Check the exact file signature in PowerShell
Get-AuthenticodeSignature "$env:windirexplorer.exe" | Format-List *The result should identify a valid signature for the Windows Explorer file in the system Windows directory. If the scheduled task points somewhere else, run the same check against that exact path and compare the result.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
What to do when the task looks suspicious
Do not delete a task merely because its name is unfamiliar. First preserve the evidence and determine whether the action is genuinely different from the expected Explorer handoff.
Indicators that justify escalation
- The action launches a script, PowerShell, JavaScript, or a command interpreter.
- The executable is in a user-writable directory such as a download, temporary, or profile folder.
- The file has no valid Microsoft signature or is signed by an unrelated publisher.
- The task has a second, similarly named executable or a path containing deliberate spelling changes.
- The task runs at regular intervals, at every logon, or under an unexpected account without a clear shell-related reason.
- The task appeared at the same time as unexplained pop-ups, browser changes, new services, disabled security tools, or other compromise symptoms.
Disconnect a potentially compromised computer from sensitive networks if your incident-response procedures require it, then use an up-to-date security scanner or your organization’s malware-response process. Do not upload confidential files to an unknown online scanner. The task name alone cannot establish that malware is present, so the investigation should include the launched file, its parent process, and other persistence mechanisms.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Should you disable or delete CreateExplorerShellUnelevatedTask?
For a correctly configured task that launches the signed Windows Explorer executable, the normal choice is to leave it enabled. It supports Explorer’s transition from an elevated process to a normal one. Disabling it is a troubleshooting experiment, not a malware-removal requirement.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteTemporarily disable it through the interface
- Open the task’s Properties in Task Scheduler.
- Record the action, task path, and settings.
- Right-click the task and choose Disable, or use the Disable command in the Actions pane.
- Sign out and back in, or reproduce the Explorer-elevation scenario, to see whether the behavior changes.
- Re-enable the task if disabling it does not solve the problem or causes shell behavior to change.
Disable it with PowerShell
If you need a repeatable administrative change, identify the task first and then pass that object to the disable command:
Best Value
![Malwarebytes Standard, Premium Security| Amazon Exclusive | 18 Months, 2 Devices | Windows, Mac OS, Android, Apple iOS, Chrome [Online Code]](https://m.media-amazon.com/images/I/41LbYnawq9L._SL160_.jpg)
- AWARD WINNING Antivirus, anti-malware, anti-spyware & more
- 24/7 REAL TIME PROTECTION against emerging malware threats, including ransomware and viruses- without slowing you down.
- PROTECTS YOUR DEVICES ON MULTIPLE PLATFORMS: Get cyber protection for your computers, smartphones, or tablets- Compatible with Windows, Mac, Android, iOS
- DOWNLOAD AND INSTALL INSTANTLY
- UNMATCHED THREAT DETECTION: We found malware on 40 percent of devices that already had a third-party antivirus installed.
$task = Get-ScheduledTask | Where-Object TaskName -eq 'CreateExplorerShellUnelevatedTask'
$task | Disable-ScheduledTaskReview the output before acting if more than one task is returned. A duplicated name in different task paths should be investigated separately.
Why deletion is usually the wrong first step
Deleting the task removes the configuration that Explorer can use for its privilege transition. Windows or Explorer may recreate it when an elevated launch occurs, and deleting it does not repair a tampered executable or remove other persistence. If the action is malicious, capture the task XML and file details before removing anything so the evidence is not lost.
If the task is missing
Absence is normally harmless. Microsoft’s description says the task is created on demand when Explorer is first launched elevated, so a computer that has not used that path may not have it. A task can also disappear after cleanup, a system reset, or a change in Explorer behavior without indicating infection.
Free tools Windows power users keep installed
One-click scans. No signup required.
If elevated Explorer repeatedly fails to return to a normal shell, check the Windows Explorer file and system integrity, review recent security or policy changes, and consult Windows support or your administrator. Do not create a replacement task by copying an action from an untrusted website; the task’s security settings and trigger details matter as much as its name.
How to interpret the published prevalence figure
An AnalysePC report covering its stated 90-day observation window recorded the task on 320 of 977 analyzed computers, or 32.8 percent. That is an observation-set statistic from that service’s analyzed PCs, not a Windows-wide infection rate and not evidence that 32.8 percent of Windows computers are infected.
No authoritative population-wide infection statistic for this exact task establishes that the task itself is malicious. The meaningful question for an individual machine remains whether the action launches the expected, Microsoft-signed Explorer file from the normal Windows directory.
Quick Recap
Practical decision checklist
- Expected action and path: the task launches
%WINDIR%explorer.exe. - Valid publisher: the exact file has a valid Microsoft digital signature.
- Consistent metadata: task path, author, triggers, and settings fit an Explorer privilege transition.
- No extra payload: there is no script, command shell, second executable, or user-writable launch location.
- Document first: save the task details before disabling, deleting, or scanning.
- Escalate mismatches: investigate the file and related persistence if any of the checks fail.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
