Windows Explorer identified as malware

Windows Explorer, one of the most crucial components of Microsoft's operating system, was quarantined last week after being falsely identified as malicious code by an antivirus company.

Users of Kaspersky Lab's antivirus products noticed the issue, which Kaspersky claimed lasted two hours, on last week.

Want to know more?

    For all the latest news, analysis and opinion on Windows, click here

The security company's systems had decided that a virus called Huhk-C was present in the explorer.exe file, leading to its confinement or, in some cases, deletion. As Windows Explorer is the graphical user interface for Windows' file system, this made it difficult to perform many common tasks within the operating system, such as finding files.

David Emm, a senior technology consultant at Kaspersky Lab, told ZDNet Australia sister site ZDNet UK on Friday that the company was still examining its checklist to find out why the false positive "slipped through the net".

"This is classic false alarm territory," Emm said. "We will check through our systems and see if we can tighten them up so we don't run into this problem in the future. No antivirus company, including ourselves, can say they have never had a false alarm, [but] on all fronts, we do what we can to minimise any potential risk for our customers."

The "offending signature" went out at around 7 pm on Wednesday, according to Emm, who claimed that it was pulled two hours later in a "makeshift" attempt to limit the damage while Kaspersky examined the signature.

"We proactively went out to our enterprise customers to make them aware there was this potential issue," Emm said. "Only one corporate customer [in the UK] encountered this problem, as well as a handful of home users." He added that users who have not changed their default settings would have found explorer.exe to be only quarantined, rather than deleted.

In March of this year, Kaspersky criticized Microsoft's consumer antivirus product, OneCare, for incorrectly quarantining and, in some cases, deleting Microsoft Outlook files.

Advertisement

Talkback 5 comments

    Windows ExplorerAnonymous -- 25/12/07

    In an ideal world,everything would run smoothly but then,we don't live in an ideal world,do we?.To my own way of thinking,the day when we have a completely error-free,mistake-free operating system,one with no flaws or faults will never come.Have to expect the unexpected and deal with each item as it comes along.It is definitely a learning process and hopefully,we will never BE perfect.Microsoft seems to be the favorite target for everyone for a long time but other OS creators have their own problems too.Happy holidays to one and all.

    This happened to me with my computer.Anonymous -- 26/12/07

    I use Zone Alarm Anti Virus on one of my computers and it did this false action with it. I had to replace the file off the set up disk to satisfy the software. I thought it had found a real problem. It is VERY DISTURBING to know this was a false positive. We pay money to trust this software and it should not do this. I think the renewal they wish to have this month will be a new type of AV software.

    Well I Agree!Erickson Leon -- 26/12/07

    Actually I believe it´s not a false alarm at all. Internet Explorer is a real malware and is a good choice quarantine or delete it. A major malware found in Microsoft systems is called windows virus and we should avoid any contact with it, even touch an infested hardware is dangerous.

    explorer.exe...Rupert Lester -- 26/12/07 (in reply to #320092205)

    explorer.exe is the process that powers the windows GUI, the internet explorer process is IEexplorer.exe (or something like that, i have been using FireFox for years now :P ). True that Windows displays some classic virus/spyware behaviors... Phoning home, Gathering information, MASSIVE slowdowns...

    Explorer.exe disabledGérard Francillon -- 26/12/07

    It happened to me too. I forgot when. One full week ago maybe.
    I could not find any replacement for "explorer" anywhere.
    So I had to hit F10 and start all over again from my original XP, 2 yo only.
    The main trouble is that lots of things have disappeared, my brand new Kaspersky 7 to begin with...

Add your opinion


Latest Videos

Blogs

  • Brad Howarth Doing for AV what VoIP did for telephony
    Sydney-based start-up Audinate is making traditional analog cabling obsolete in favour of TCP/IP-based networking technology. And it's doing a pretty good job so far, with its technology used by World Youth Day and the Sydney Opera House.
  • Array Carriers in a tether over iPhone capabilities
    One of the more curious aspects of the iPhone phenomenon has been the disconnect between the device's capabilities and carriers' willingness to support them.
  • Array WiMax in Australia: Part two
    WiMax could be the standard that drives the next phase of mobile broadband, it provides an opportunity for players wanting to establish a pure IP network to carry voice and data effectively — but is this what operators want?
  • More blogs »

Tags

Back to top

Featured