Windows Explorer identified as malware

Windows Explorer, one of the most crucial components of Microsoft's operating system, was quarantined last week after being falsely identified as malicious code by an antivirus company.

Users of Kaspersky Lab's antivirus products noticed the issue, which Kaspersky claimed lasted two hours, on last week.

Want to know more?

    For all the latest news, analysis and opinion on Windows, click here

The security company's systems had decided that a virus called Huhk-C was present in the explorer.exe file, leading to its confinement or, in some cases, deletion. As Windows Explorer is the graphical user interface for Windows' file system, this made it difficult to perform many common tasks within the operating system, such as finding files.

David Emm, a senior technology consultant at Kaspersky Lab, told ZDNet Australia sister site ZDNet UK on Friday that the company was still examining its checklist to find out why the false positive "slipped through the net".

"This is classic false alarm territory," Emm said. "We will check through our systems and see if we can tighten them up so we don't run into this problem in the future. No antivirus company, including ourselves, can say they have never had a false alarm, [but] on all fronts, we do what we can to minimise any potential risk for our customers."

The "offending signature" went out at around 7 pm on Wednesday, according to Emm, who claimed that it was pulled two hours later in a "makeshift" attempt to limit the damage while Kaspersky examined the signature.

"We proactively went out to our enterprise customers to make them aware there was this potential issue," Emm said. "Only one corporate customer [in the UK] encountered this problem, as well as a handful of home users." He added that users who have not changed their default settings would have found explorer.exe to be only quarantined, rather than deleted.

In March of this year, Kaspersky criticized Microsoft's consumer antivirus product, OneCare, for incorrectly quarantining and, in some cases, deleting Microsoft Outlook files.

Talkback 5 comments

  1. Windows Explorer Anonymous -- 25/12/07

    In an ideal world,everything would run smoothly but then,we don't live in an ideal world,do we?.To my own way of thinking,the day when we have a completely error-free,mistake-free operating system,one with no flaws or faults will never come.Have to expect the unexpected and deal with each item as it comes along.It is definitely a learning process and hopefully,we will never BE perfect.Microsoft seems to be the favorite target for everyone for a long time but other OS creators have their own problems too.Happy holidays to one and all.

  2. This happened to me with my computer. Anonymous -- 26/12/07

    I use Zone Alarm Anti Virus on one of my computers and it did this false action with it. I had to replace the file off the set up disk to satisfy the software. I thought it had found a real problem. It is VERY DISTURBING to know this was a false positive. We pay money to trust this software and it should not do this. I think the renewal they wish to have this month will be a new type of AV software.

  3. Well I Agree! Erickson Leon -- 26/12/07

    Actually I believe it´s not a false alarm at all. Internet Explorer is a real malware and is a good choice quarantine or delete it. A major malware found in Microsoft systems is called windows virus and we should avoid any contact with it, even touch an infested hardware is dangerous.

    1. explorer.exe... Rupert Lester -- 26/12/07

      explorer.exe is the process that powers the windows GUI, the internet explorer process is IEexplorer.exe (or something like that, i have been using FireFox for years now :P ). True that Windows displays some classic virus/spyware behaviors... Phoning home, Gathering information, MASSIVE slowdowns...

  4. Explorer.exe disabled Gérard Francillon -- 26/12/07

    It happened to me too. I forgot when. One full week ago maybe.
    I could not find any replacement for "explorer" anywhere.
    So I had to hit F10 and start all over again from my original XP, 2 yo only.
    The main trouble is that lots of things have disappeared, my brand new Kaspersky 7 to begin with...

Add your opinion


ZDNet Video

Interview with C3PO from Star Wars
The Green Enterprise: Intel
Nvidia chip with Java allows 3D modeling on cell phones

Watch more videos on ZDNet Australia

ZDNet's CIO Vision Series

Department of Defence | Greg Farr, CIO (part two)

In the second part of his interview, Defence CIO Greg Farr talks about outsourcing, the skills crisis and reveals his most urgent IT priority.

Sponsored content

Power Centre - Content from our premier sponsors

Blogs

  • Angus Kidman Many mail make managers manic
    E-mail is frequently blamed for creating storage bloat, but is the most effective means of dealing with the problem increasing storage capacity, imposing quotas, enforcing archive rules, or just driving the help desk nuts with questions?
  • Array Gold star for the ATO
    If Australia is going to take information security seriously, we need more people like the ATO's CIO, Bill Gibson.
  • Array It seemed like a good idea at the time
    Last week, I lamented the growing tendency to slam perfectly valid technologies as unsuitable for new uses, just because they prove to be unsuited for applications for which they are inherently unsuited.
  • More blogs »

Tags

Back to top

Featured