A faulty signature update from Kaspersky Lab on Wednesday flagged up Windows Explorer (explorer.exe) as infected with a low-risk virus, Huhk-C. As a result the core Windows component was quarantined or worse.

Kaspersky released a revised update alongside advice on how to recover legitimate system and application files from quarantine (the default setting) within two hours. But that's not much consolation for users that had set their software to auto-delete infected files, who found themselves with hosed systems.

Postings to Kaspersky's forum reveal Carl was far from alone in experiencing problems as a result of the issue. The false alert flap follows just days after earlier problems in updating Kaspersky Lab anti-virus software led to some machines locking up. The close proximity of the two events has raised questions about the reliability of the Russian anti-virus firm's testing regime.

Faulty anti-virus signature updates are not uncommon across the industry. However, the latest Kaspersky SNAFU affects a core Windows component.

David Emm, senior technology consultant at Kaspersky Lab UK, said one UK enterprise customer and three end-users had reported problems with the false alert. "False alarms occasionally happen, and we take the issue seriously when it does," he told El Reg. "We have test systems in place to minimise the risk of this happening, but this seemed to have slipped through the net."

He added that Kaspersky would review the false alert, alongside last week's glitch, to see what improvements might be made to its internal testing system in order to minimise the risk of any similar errors in future. ®

Related stories

• Dodgy McAfee update slaps viral warning on Spotify (22 May 2009)
• Multiple security scanner bugs give users a headache (7 April 2009)
• Eset false alarm puts system files on remand (10 March 2009)
• Kaspersky breach exposes sensitive database, says hacker (8 February 2009)
• AVG slaps Trojan label on core Windows file (11 November 2008)
• AVG tags ZoneAlarm as Trojan (16 October 2008)
• Trend virus update freezes some PCs (8 September 2008)
• McAfee slaps Trojan warning on MS Office Live (6 August 2008)
• Yahoo! Messenger! Trojan! false alarm! (13 June 2008)
• Update Symantec Endpoint Security throws out error bugs (20 February 2008)
• Camouflaged code threatens security apps (4 January 2008)
• McAfee spies malware in legit JavaScript apps (4 January 2008)
• Updated CA issues false warning on JavaScript apps (31 December 2007)
• Update 2 Update glitch derails Kaspersky (14 December 2007)
• Win 2000 anti-virus products fail independent tests (4 December 2007)
• Security researchers plot revamped anti-virus tests (10 October 2007)
• False positives run amok in Vista anti-virus tests (3 August 2007)
• Dodgy anti-virus update bunfight goes to court (9 July 2007)
• Botnets punt Russian dog-barking translation spam (1 March 2007)