Win32.Agent.bb

[Tehrasha]

Part of the 'Manual Removal of Win32.Agent.bb' page reads...

Delete the registry key ".qc" at "HKEY_CLASSES_ROOT\".

SB:S&D flags HKEY_CLASSES_ROOT\.qc as a trojan without regard to what the entry points to.

--- Search result list ---
Win32.Agent.bb: [SBI $717BDE7E] File extension (Registry key, nothing done)
HKEY_CLASSES_ROOT\.qc

Some game programmers, specifically 3D modellers deal with .qc files for compiling their models. So they will often associate .qc with some form of text-file editor for convenience.

In my case, the Reg key points to... qc_auto_file
Which in turn leads to... HKEY_CLASSES_ROOT\qc_auto_file\shell\open\command
where the 'command' is "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"


In the overall picture, probably a rare false positive, and the only ill effect of letting S&D remove it, would be the disassociation of the file type.

Just thought someone should know.

[Yodama]

Thank you for reporting this issue, this will be fixed with the next detection update scheduled for Wednesday 2011-09-07.