Originally posted by: JCipriani
I struggled with this "worm" today as well.
I can definitely confirm that it was Kaspersky that deleted explorer.exe. If it gave you the "special procedures required to clean this file" message then rebooted your machine, then that's what happened. Those "special procedures" are deleting the infected file on startup.
I can't verify that it's a false positive, but I did make some observations that support it being an error on Kaspersky's part:
1) I did a routine system scan a few days ago and have not installed any new software or downloaded anything since. I then updated Kaspersky's signatures and did a new system scan today and that's when it found Huhk.c. Of course, this could just mean that something was installed without me knowing or that I've always had this worm and it was undetected until a recent signature update.
2) Kaspersky always found it in the explorer.exe in system memory. Killing the explorer process and then restarting the process still leaves an infected explorer.exe in memory. This would make sense if the explorer.exe file was infected, but scanning the explorer.exe file itself turned up clean -- or so I thought. Actually, if you set Kaspersky's security level to HIGH instead of NORMAL, it finds it in the explorer.exe file as well. In other words, NORMAL security level only finds it when running in memory, HIGH security level finds it in memory and the file. This inconsistency is a little strange and suggests that perhaps the heuristics scanner in Kaspersky is misidentifying harmless code in explorer.exe as this worm, and the image in memory is possibly different from the file itself. Not really evidence for it being a fake, but it's kind of weird.
3) I installed a windows XP system update via Windows Update today. Part of that update included a new explorer.exe. Kaspersky's background file scanner immediately flagged the explorer.exe downloaded as part of the critical update as having this worm (before it was installed). I find this very strange. The reason I find this very strange is this: After Kaspersky deleted my explorer.exe I restored a copy from a clean backup I had. Upon restarting my system I did a full system scan and Kaspersky found nothing at all (note that the explorer.exe I grabbed off my recovery disc was a different version than whatever one may be causing these false positives). So my system was completely clean. Then I got the Windows critical update, and then Kaspersky flagged the downloaded explorer.exe as having the worm. It would be very odd (although not impossible), on a clean system, for a newly created file to become infected as you'd think Kaspersky would have found -something- suspicious.
4) I've read reports where people observe that only files named explorer.exe are infected by this virus. I have observed that old versions of explorer.exe are not flagged as infected, and the newest versions are. I also know that it is not normally possible to modify explorer.exe while it is running, yet I did not have this virus and then suddenly I did. It would not make sense for my explorer.exe to have been modified while it was running. And like I said, the only thing that changed on my system between the time I didn't have the worm and the time I did was the Kaspersky signatures.
Edit: 5) This is a big one. Note that there are virtually no Google results for this virus. It isn't in the virus encyclopedia either. Nearly all forum posts regarding this virus are from today. I find it highly unlikely that this worm basically did not exist and then all of a sudden a whole bunch of people with very different system setups doing very different things got this weird worm all at the same time. The only thing in common between all these people is that they all seem to be Kaspersky users and they all have the latest signatures.
Edit: 6) Another suggestion of false positive can be found here:
http://forum.kaspersky.com/ind...id=503634&#entry503634
I am definitely leaning towards a false positive because it appeared out of nowhere, I can't get rid of it no matter how hard I try, and even the newly downloaded explorer.exe from the Microsoft Update thing is flagged as being infected. If you have somebody around you that you know has a clean system and has the latest Windows updates, one experiment is to grab there copy of explorer.exe, rename it (before copying it to your own machine just in case some virus is infecting files named explorer.exe when they are created), and scan it for viruses with your version of Kaspersky. If it detects the worm, then it's probably a false positive, because it wouldn't make any sense for a file coming off a clean system to be infected with this worm.
As for your BSOD, I wonder if it is just an unfortunate coincidence that all this happened at the same time.
I'll post any new info if I have it.
Jason
