Verify Winlogon Shell Value in Regedit

The Shell registry value under the Winlogon key determines the default user interface loaded when a user logs into Windows, which is normally explorer.exe. Because malware frequently modifies this entry to establish persistence and run unauthorized executables at startup, auditing this value is a crucial step in system security and troubleshooting. This guide explains how to locate and verify the integrity of the Shell value using the Windows Registry Editor (regedit).

Steps to Verify the Shell Value

  1. Open Registry Editor
    • Press Win + R on your keyboard to open the Run dialog box.
    • Type regedit and press Enter or click OK.
    • When prompted by User Account Control (UAC), click Yes to grant administrative permissions.
  2. Navigate to the Winlogon Key
    • In the address bar at the top of the Registry Editor window, paste the following path and press Enter: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    • Alternatively, use the left-hand navigation tree to expand the folders manually.
  3. Locate and Inspect the Shell Value
    • In the right-hand pane, scroll down alphabetically and find the string value named Shell (Type: REG_SZ).
    • Observe the Data column associated with the Shell entry.
  4. Confirm Expected Values
    • Default/Legitimate Value: explorer.exe
    • Signs of Compromise: If the value data contains additional paths, script names, commas, or points to an unknown executable (e.g., explorer.exe, C:\Users\Public\malware.exe or just a custom file path), the value has been altered.
  5. Also Check Current User (Per-User Override)
    • Malicious software may create a user-specific shell override. Navigate to: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
    • Under standard Windows configurations, a Shell entry usually does not exist here. If present, it overrides the system-wide shell. Verify that its data is either legitimate or remove the entry if unauthorized.

How to Restore the Shell Value

If the Shell value under HKEY_LOCAL_MACHINE has been modified without authorization:

  1. Double-click the Shell string in the right pane.
  2. In the Value data field of the Edit String dialog, delete any existing text and enter exactly: explorer.exe
  3. Click OK to save the changes.
  4. Restart your computer to apply the standard shell configuration.