Windows Explorer identified as malware

Windows Explorer, one of the most crucial components of Microsoft's operating system, was quarantined last week after being falsely identified as malicious code by an antivirus company.

Users of Kaspersky Lab's antivirus products noticed the issue, which Kaspersky claimed lasted two hours, on last week.

Want to know more?

    For all the latest news, analysis and opinion on Windows, click here

The security company's systems had decided that a virus called Huhk-C was present in the explorer.exe file, leading to its confinement or, in some cases, deletion. As Windows Explorer is the graphical user interface for Windows' file system, this made it difficult to perform many common tasks within the operating system, such as finding files.

David Emm, a senior technology consultant at Kaspersky Lab, told ZDNet Australia sister site ZDNet UK on Friday that the company was still examining its checklist to find out why the false positive "slipped through the net".

"This is classic false alarm territory," Emm said. "We will check through our systems and see if we can tighten them up so we don't run into this problem in the future. No antivirus company, including ourselves, can say they have never had a false alarm, [but] on all fronts, we do what we can to minimise any potential risk for our customers."

The "offending signature" went out at around 7 pm on Wednesday, according to Emm, who claimed that it was pulled two hours later in a "makeshift" attempt to limit the damage while Kaspersky examined the signature.

"We proactively went out to our enterprise customers to make them aware there was this potential issue," Emm said. "Only one corporate customer [in the UK] encountered this problem, as well as a handful of home users." He added that users who have not changed their default settings would have found explorer.exe to be only quarantined, rather than deleted.

In March of this year, Kaspersky criticized Microsoft's consumer antivirus product, OneCare, for incorrectly quarantining and, in some cases, deleting Microsoft Outlook files.

Advertisement

Talkback 5 comments

    Windows Explorer Anonymous -- 25/12/07

    In an ideal world,everything would run smoothly but then,we don't live in an ideal world,do we?.To my own way of thinking,the day when we have a completely error-free,mistake-free operating system,one with no flaws or faults will never come.Have to expect the unexpected and deal with each item as it comes along.It is definitely a learning process and hopefully,we will never BE perfect.Microsoft seems to be the favorite target for everyone for a long time but other OS creators have their own problems too.Happy holidays to one and all.

    This happened to me with my computer. Anonymous -- 26/12/07

    I use Zone Alarm Anti Virus on one of my computers and it did this false action with it. I had to replace the file off the set up disk to satisfy the software. I thought it had found a real problem. It is VERY DISTURBING to know this was a false positive. We pay money to trust this software and it should not do this. I think the renewal they wish to have this month will be a new type of AV software.

    Well I Agree! Erickson Leon -- 26/12/07

    Actually I believe it´s not a false alarm at all. Internet Explorer is a real malware and is a good choice quarantine or delete it. A major malware found in Microsoft systems is called windows virus and we should avoid any contact with it, even touch an infested hardware is dangerous.

    explorer.exe... Rupert Lester -- 26/12/07 (in reply to #320092205)

    explorer.exe is the process that powers the windows GUI, the internet explorer process is IEexplorer.exe (or something like that, i have been using FireFox for years now :P ). True that Windows displays some classic virus/spyware behaviors... Phoning home, Gathering information, MASSIVE slowdowns...

    Explorer.exe disabled Gérard Francillon -- 26/12/07

    It happened to me too. I forgot when. One full week ago maybe.
    I could not find any replacement for "explorer" anywhere.
    So I had to hit F10 and start all over again from my original XP, 2 yo only.
    The main trouble is that lots of things have disappeared, my brand new Kaspersky 7 to begin with...

Add your opinion

Latest Videos

Blogs

  • Darren Greenwood Telecom NZ savings damage prospects
    If Telecom NZ wants to have any of the NZ$1.5 billion the government intends to spend on its new broadband network, it had better think long and hard before offshoring 1500 jobs.
  • Array iiNet: The whys and what nows
    Last week the Federal Court ruled that internet service providers are not responsible for copyright violation by their customers. This is an important decision not just for iiNet, which spent around $4 million defending the case, but for all ISPs in Australia and, indeed, globally.
  • Array Govt, hurry up with releasing data
    A programmer scraped data from the My School website to make some really cool heat maps showing regions of smart schools — no thanks to the government, which didn't supply the data in any useful kind of format.
  • More blogs »

Tags

Back to top

Featured