Home > Knowledge Base > McAfee detects trojan bat/qd313 when generating batch file (KBID# 28)
I.T. Mate Knowledge Base - KBID# 28
McAfee detects trojan bat/qd313 when generating batch file (KBID# 28)
McAfee detects trojan bat/qd313 and deletes the RunOnce registry entry and the generated batch file, which additionally causes a Runtime Error 75 message to occur.
This is a false positive within the McAfee engine and was originally thought to have been caused by the del and deltree commands used by the batch file. However, reports have confirmed this to be caused by the comments used within the batch file, in particular the line;
"echo This file will remove Index.dat"
An e-mail was sent to McAfee concerning this matter, however, no reply has been received as yet.
Until McAfee reply, there are 4 things you can do to rectify the issue;
1. Remove the lines beginning with "echo" from the batch file
2. Run Index.dat Suite in Safe Mode
3. Temporarily disable McAfee when generating the batch file
4. Use another antivirus.
An Index.dat Suite and McAfee user wrote to let us know;
"I've been tweaking the batch file and testing it with Mcafee. I've found that what really causes the false trojan detection is the following text within the batch file:
echo This file will remove Index.dat
if you make any change to this text string, Mcafee no longer gives out the false alarm. For example if the text reads like this,
echo This file will remove index.dat (notice the lowercase "i")
or like this,
echo This file will delete Index.dat ("delete" instead of "remove")
then Mcafee sees the batch file as clean."
Network Associates Inc - Bat/qd313
The information in this article applies to:
Published: 17/07/2005 03:30:40
- Index.dat Suite
Updated: 06/08/2005 14:13:07
Print this document
E-mail this document