[Merged] False Positive...explorer.exe?, Worm.Win32.Huhk.c Options

[Guru63]

Please read this: http://support.kaspersky.com/viruses/computers?qid=208279581 on recovering from this false positive.

This post has been edited by Don Pelotas: 21.12.2007 21:30

Reason for edit: Added official press release containing the fix for this

[silentuser]

Update database =>

..... same problem....

cant find any support in the internet

[Lucian Bara]

send it for analysis: http://forum.kaspersky.com/index.php?showtopic=13881

[Malucarp]

Hi,

Running KIS 7.0.0.125. I just turned on my wife's PC and the automatic start-up scan produced a red popup saying that explorer.exe is infected with Worm.Win32.Huhk.c.

I did a full, routine scan on this PC yesterday and KIS said all was okay - and no Internet or email access since then.

I then did a manual startup scan on my PC, which was scanned yesterday and on all day, today, and I get the same error.

Has anyone seen this, today? Our PCs are not networked together and have not traded data in ages. I can only think that it's a false positive.

Dataase release date= 12/19/2007 19:57:55 (GMT)

Deleting through Kaspersky does not stop the error on the next scan.

Thanks,

Mike

Attached File(s)

 KIS_Warning.jpg ( 61.18K ) Number of downloads: 60

 

[ichtyp]

hey guys

i got the same message, but on c:\windows\explorer.exe
my main computer sais nothing, but here on the laptop kaspersky alterts !

hope this is not a virus .. deleting explorer.exe caused a 30 minute rescue for this laptop -.- ( my fault )

This post has been edited by ichtyp: 20.12.2007 00:25

[alanrew]

Hi,

Running KIS 7.0.0.125. I just turned on my wife's PC and the automatic start-up scan produced a red popup saying that explorer.exe is infected with Worm.Win32.Huhk.c.

I did a full, routine scan on this PC yesterday and KIS said all was okay - and no Internet or email access since then.

I then did a manual startup scan on my PC, which was scanned yesterday and on all day, today, and I get the same error.

Has anyone seen this, today? Our PCs are not networked together and have not traded data in ages. I can only think that it's a false positive.

Dataase release date= 12/19/2007 19:57:55 (GMT)

Deleting through Kaspersky does not stop the error on the next scan.

Thanks,

Mike

Yes, I've just had the same issue when turning on my PC.

detected: virus Worm.Win32.Huhk.c Running module: explorer.exe\Explorer.EXE

Product version 6.0.2.614, signatures published 19/12/2007 19:57:55

I've tried allowing Kaspersky to remove the infection, but when Windows restarts I get the same problem.

Is this a false positive???????????????

TIA

Alan (UK, Win XP SP2)

This post has been edited by alanrew: 20.12.2007 00:27

[__d_mode__]

i have same warning also i thought its false positive, are all explorer.exe s md5 hash same?if its ,my explorer.exe s md5 hash is: 16c9974928b0159bb2c4c4041426a49b

[deadlock32]

I dunno man, 51 guests (edit: and rising) are reading this topic, I have the same problem, we all have problems on the same day....

I hope its a false positive.

Win XP, chicago, IL
Kaspersky 6.0.0.308

This post has been edited by deadlock32: 20.12.2007 00:36

[moonshine]

I was trying to enter a web site and all of a sudden I received the "screech" and the following in a box

Running module contains virus and cannot be disinfected.

Virus:
Worm.Win32.Huhkc.

Running module
explorer.exe\Explorer.EXE

Delete

Skip

Apply to all

I AM TOTALLY FREAKED BY THESE TYPE OF MESSAGES AND DON'T KNOW WHAT TO DO. THE OTHER DAY I DENIED ONE AND IT HAD TO DO WITH THE DLL FILE AND MESSED UP MY COMPUTER. SO JUST DON'T KNOW WHAT TO TRUST AND WHAT NOT TO TRUST, OR WHAT TO DENY, SKIP OR ALLOW. THIS ONE IF I SKIP IT JUST KEEPS COMING UP.

SOMEONE PLEASE HELP.

[ichtyp]

hope so too
i'm from germany, but i think this little thing doesn't matter where we're from

[alanrew]

i have same warning also i thought its false positive, are all explorer.exe s md5 hash same?if its ,my explorer.exe s md5 hash is: 16c9974928b0159bb2c4c4041426a49b

What's the easiest way to get this? Is there a built-in MD5 hash program in Windows, or Kaspersky? If not, where do I get the utility?

TIA

Alan

[Baz^^]

Hi guys,

Will raise this with viruslab as a matter of urgency.... it would help if someone could grab a copy of explorer.exe, and send it to newvirus@kaspersky.com with "false positive" in the title.

Try to update, because my defs are not flagging.

This post has been edited by MAPKOBKA^^: 20.12.2007 00:38

[wtom]

I am getting the same thing on a brand-new dell laptop I took out of the box literally 45 minutes or so ago. I installed Office 2007, MS streets and trips 07, and connected to my encrypted wireless network. I installed Kaspersky for workstations 6.x, ran the updates, and then worm.win32.huhk.c was detected when I tried opening the browser for the first time (to msn.com).

This is almost certainly a false positive.

[commanderjbond]

got the same problem. i sent the file for analysis and it said "you are clean".

so does my kaspersky see a ghost??

[Baz^^]

Update now, the detection has been fixed.


Restore it from the kaspersky "backup" tab.

This post has been edited by MAPKOBKA^^: 20.12.2007 02:12

[alanrew]

Hi guys,

Will raise this with viruslab as a matter of urgency.... it would help if someone could grab a copy of explorer.exe, and send it to newvirus@kaspersky.com with "false positive" in the title.

Try to update, because my defs are not flagging.

I've just emailed a winzip file containing explorer.exe to you...

looking forward to your reply!!!!!

Alan

[Computer Redicar...]

Same thing on a newly formatted and installed XP machine. It has to be a false positive. I am sending the explorer.exe file in now.

[Fator Brasil]

And now? I delete.....

New Exloprer.exe in what folder???

[Heathcliff Huxta...]

I got hit with it too. Following Kaspersky's orders to restart (I wasn't paying close attention and thought it said the virus was in Internet Explorer, which I don't use), I now don't have Explorer running. I'm still trying to figure out how to get that back. If anybody knows how to do that quickly, I'd appreciate a pointer.

Thanks

[Baz^^]

Its a false positive. Roll back the databases until it is fixed.

Hello, it is a false alarm. Will be fixed in the next update.


--
Best regards, Shvetsov Dmitry
Virus analyst, Kaspersky Lab.

e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

This post has been edited by MAPKOBKA^^: 20.12.2007 00:48