December 21, 2007 6:04 AM PST
Kaspersky inadvertently quarantines Windows Explorer
- Related Stories
-
Microsoft flags Gmail as a virus
November 13, 2006 -
AOL offers free antivirus software
August 7, 2006 -
Flaw found in Kaspersky antivirus
October 3, 2005 -
McAfee's Trojan horse error gets developer's goat
September 10, 2004 - Related Blogs
-
Kaspersky's secret to success
August 21, 2007 -
Antiviral marketing: Kaspersky and me
October 10, 2007 -
Antiviral marketing: Kaspersky and me
October 10, 2007
Users of Kaspersky Lab's antivirus products noticed the issue, which Kaspersky claimed lasted two hours, on Wednesday night.
The security company's systems had decided that a virus called Huhk-C was present in the explorer.exe file, leading to its confinement or, in some cases, deletion. As Windows Explorer is the graphical user interface (GUI) for Windows' file system, this made it difficult to perform many common tasks within the operating system, such as finding files.
David Emm, a senior technology consultant at Kaspersky Lab, told ZDNet UK on Friday that the company was still examining its checklist to find out why the false positive "slipped through the net."
"This is classic false-alarm territory," Emm said. "We will check through our systems and see if we can tighten them up so we don't run into this problem in the future. No antivirus company, including ourselves, can say they have never had a false alarm, (but) on all fronts, we do what we can to minimize any potential risk for our customers."
Emm pointed out that Kaspersky adds about 3,000 records per week to its database, demonstrating the "scale of the issue, in terms of testing procedures."
The "offending signature" went out at around 7 p.m. on Wednesday, according to Emm, who claimed that it was pulled two hours later in a "makeshift" attempt to limit the damage while Kaspersky examined the signature.
"We proactively went out to our enterprise customers to make them aware there was this potential issue," Emm said. "Only one corporate customer (in the U.K.) encountered this problem, as well as a handful of home users." He added that users who have not changed their default settings would have found explorer.exe to be only quarantined, rather than deleted.
In March of this year, Kaspersky criticized Microsoft's consumer antivirus product, OneCare, for incorrectly quarantining and, in some cases, deleting Microsoft Outlook files.
David Meyer of ZDNet UK reported from London.
See more CNET content tagged:
Kaspersky Lab,
Microsoft Windows Explorer,
antivirus,
antivirus company,
Microsoft Corp.
directly into the Windows Explorer memory space, Kaspersky's
deetction is neither invalid or a false positive. At that point
Windows Explorer is a malicious process that needs to be
mitigated. Note that it is not replacing explorer.exe as many
previous virii have attempted. It is mangling the legitimate copy
as it is running to achieve it's ends.
One example:
http://www.symantec.com/enterprise/security_response/weblog
/2007/08/the_new_peacomm_infection_tech.html
"iexplore.exe" is the bug-ridden, standards-hating, lock-in-generating web broswer thingy.
/P
That lead line just about sums up a whole bunch of Microsoft's security problems!
If IE is one of the most crucial components of Microsoft's OS, then they're doomed to fail one of these days.
IE is the most insecure browser in the world... and Microsoft freely opens it's OS innards up to IE in a way that no other manufacturer's application could do because they use so many secret built-in holes to get IE to do the insecure things the way it does!
If Microsoft ever opened up all their secrets about IE, you'd find 90% or more of Microsoft security woes wrapped up in this one nutshell!
Walt