ARGH!!!!!!
December 19th, 2007
I hate stupid people who think it’s funny to mess with people’s PC’s.
Why don’t they use that ingenuity to do something productive? I bet they’re the same people who vote for the likes of Hillary Clinton, and think that wealth should be redistributed because they refuse to get a real job using their superior technical skills to actually create things that people want, rather than things that we don’t ask for, and that just plain piss us off.
Anyway, I’ve just spent the last hour and a half googling “Worm.Win32.Huhk.c”, a “virus” that ZoneAlarm discovered, that apparently has invaded my precious system.
Come to find out, it’s a “false positive”. According to Kaspersky, it’s not a virus, but some other sort of malware that encourages you to delete the file “explorer.exe”:
If you are reading this right now, do not – I REPEAT! – DO NOT delete “explorer.exe”!!. This will wreak havoc on your system, and you won’t be able to use Internet Explorer. It may also shut your system down completely, causing it to reboot in safe mode. In some cases, it has even caused the dreaded BSOD (Blue Screen of Death).
Anyway, I’m waiting to hear back from ZoneAlarm, because as of right now, it keeps scanning and telling me that this is a dangerous virus that it cannot quarantine or delete.
I’ll let ya’ll know when I know more, but in the meantime, click on the Kaspersky forum above.
Grrrrrrr…
8 Responses to “ARGH!!!!!!”
Trackbacks/Pingbacks
- Ben Dawos is always running out of… - » Worm Attack!?!
- PheistyBlog » Blog Archive » The False Worm, Continued
December 19th, 2007 at 6:26 pm
Doing the same as you…googling and nowhere is a description of this, not even from K themselves. Hope they figure it out as we are seeing an entire realty office infected with this now…
December 19th, 2007 at 6:58 pm
answer here, had to propagate to Google a bit
http://forum.kaspersky.com/index.php?showtopic=55669
December 19th, 2007 at 7:09 pm
Thanks Angry. That’s the link I have above, but it doesn’t hurt to post it again!
Yeah, the googling was a little frustrating, with all of the German posts.
December 19th, 2007 at 7:47 pm
IF BY HAPS YOU DID DELETE THE “EXPLORER.EXE”:
So seeing a “worm” detected by ZoneAlarm I foolishly did what it wanted me to do, delete the explorer.exe on a computer reboot. So I rebooted, only to find a completely empty screen (ex. taskbar, start menu, desktop icons, etc.) with nothing but my wallpaper. So I did the following steps to get it back and temporarily fix the virus issue (the real issue will be fixed when Zonealarm fixes there $60 product):
1. At the “blank screen hit Ctrl+Alt+Del and bring up the task manager
2. Click the “Applications” tab then click on the “New Task” button down on the bottom of the dialog box
3. When asked what to open, browse to your Zonealarm installation folder (C:/Program Files/Zone Labs/ZoneAlarm by default) and launch “zlclient.exe”
4. This will bring up the normal ZoneAlarm main window
5. On the side click “Anti-virus/Anti-spyware” and disable the two services
6. Now click on the “Quarantine” tab and go to the “Virus” quarantine view.
7. You will see two “viruses” named Worm.Win32.Huhk.c restore both of them (they will not harm your computer as they are false-positives)
8. Restart the computer and you should boot up normally
NOTE: These instructions assume your ZoneAlarm is set to backup and quarantine viruses (it does this by default). I was running the most current version of ZoneAlarm Internet Security Suite when I did this.
December 19th, 2007 at 7:54 pm
Thanks so much, Matt! This will help the poor souls who deleted the file.
December 20th, 2007 at 3:21 am
It appears this worm defininately was a false-positive because (as I stated earlier) I just restored the “infected” explorer.exe and now, after a new anti-virus update from ZoneAlarm, the explorer.exe is not being called as unsafe. So, hopefully if everyone updates there virus definitions regularly, problem fixed!!!