Hidden Winstart.bat found in non-os drive


  1. BlackVen0m
    Posts : 472
    Windows 10 Pro x64
       New #1

    Hidden Winstart.bat found in non-os drive


    Hi all. I found this hidden file Winstart.bat on my H: drive. I think I've seen it on my C: drive as well some time ago. I deleted it immediately, dumb move or not, before knowing anything about it.

    Opened it with notepad, but nothing was there. What can this be? Never seen it before. I have pagefile.sys on the same drive because I turned off pagefile for every other drive and only use H: drive for pagefile. Does that have anything to do with it? Something tells me that it does not.

    Windows 10 Pro x64 22H2 up to date
      My Computer
    Quote Quote

  3. pepanee
    Posts : 3,037
    Windows 10 Pro for the Bro
       New #2

    You can open it in Notepad? Nothing saying anything about Permissions?

    Right click the file -> Properties. How big is it?



    (edit 11:08 am local time)
    That bat file has nothing to do with the PageFile.
    (btw, what is the bat file's Modification date / time?)
      My Computer
    Quote Quote

  4. Paul Black
    Posts : 18,034
    Win 10 Pro 64-bit v1909 - Build 18363 Custom ISO Install
       New #3

    Hello @BlackVen0m,

    I just searched my computer for it and it was NOT found, if that helps !
      My Computer
    Quote Quote

  6. NTN
    Posts : 969
    W10 19045.2546
       New #4

    I read:

    winstart.bat is a batch file that contains a set of system commands, which can be used by a particular parasite to manipulate files, corrupt installed software, alter system configuration or launch other pest components. winstart.bat is actually a specific text file that acts in a similar way to a regular executable. However, it contains no malicious code, but only commands and therefore cannot run own processes.
    The winstart.bat file is installed and used by worm Emmapeel PIF Worm. It is also related to other parasites such as worm IRC-Worm.Ceyda.6574, worm IRC-Worm.Ceyda.6953, worm IRC-Worm.Ceyda.6966, trojan BAT.Winstart and Memory Manager 2.6. These threats can use winstart.bat for different purposes, as the file’s functionality depends on a particular parasite it belongs to.

    I think you should engage Chuck Norris for the job...
    https://www.malwarebytes.com/adwcleaner
      My Computers
    Quote Quote

  7. BlackVen0m
    Posts : 472
    Windows 10 Pro x64
    Thread Starter
       New #5

    NTN said:
    I read:

    winstart.bat is a batch file that contains a set of system commands, which can be used by a particular parasite to manipulate files, corrupt installed software, alter system configuration or launch other pest components. winstart.bat is actually a specific text file that acts in a similar way to a regular executable. However, it contains no malicious code, but only commands and therefore cannot run own processes.
    The winstart.bat file is installed and used by worm Emmapeel PIF Worm. It is also related to other parasites such as worm IRC-Worm.Ceyda.6574, worm IRC-Worm.Ceyda.6953, worm IRC-Worm.Ceyda.6966, trojan BAT.Winstart and Memory Manager 2.6. These threats can use winstart.bat for different purposes, as the file’s functionality depends on a particular parasite it belongs to.

    I think you should engage Chuck Norris for the job...
    https://www.malwarebytes.com/adwcleaner
    I deleted it manually, I should have had saved it maybe? But I was scared to have it around. Do you think it will find anything when i deleted it?
      My Computer
    Quote Quote

  8. NTN
    Posts : 969
    W10 19045.2546
       New #6

    Have you tried to run AdwCleaner?

    Go for Hitman too...
    Download HitmanPro: Scan and Remove Malware
    I'm not sure, but you may get 30d free trial.
      My Computers
    Quote Quote

  9. BlackVen0m
    Posts : 472
    Windows 10 Pro x64
    Thread Starter
       New #7

    NTN said:
    Have you tried to run AdwCleaner?

    Go for Hitman too...
    Download HitmanPro: Scan and Remove Malware
    I'm not sure, but you may get 30d free trial.
    Yes and they did not find anything
      My Computer
    Quote Quote

  10. NTN
    Posts : 969
    W10 19045.2546
       New #8

      My Computers
    Quote Quote

 

  Related Discussions
Used Hard Drive, hidden Admin
in Drivers and Hardware

I have a home network consisting of four used/refurbed HP Small Form Factor computers with Windows 10 operating systems. I am running into a problem with the one (the other three do not manifest that problem) in my wife's office. When I go to...
Ordinary PC, Windows 10 Pro. This seems like one of those things that should be simple, but I think I’m making it hard. Or, maybe it really is a PITA... I have an SSD with several partitions. The “C” partition on this SSD is the O/S on an...
I recently upgraded to 20H2, but yesterday reverted back to 1909, because I found a hidden piece of software that showed itself when I sometimes go to various websites, and this software is adguard. I used to be able to go to some legit websites...
i formatted D Drive Completely and its empty. But when im using defraggler theres a files 117.9 MB files are still there. how to delete them? https://i.ibb.co/B48hs08/Capture.png
Although I can see other hidden files on this drive such as $RECYCLE.BIN, I have a file that does not appear in Windows Explorer. Using "USB Safely Remove" the following Process is displayed as preventing safe removal of this drive: System ...
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

 © Designer Media Ltd
All times are GMT -5. The time now is 00:50.
Find Us




Windows 10 Forums