Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

winstart.bat


  • Please log in to reply
13 replies to this topic

#1 jimvt

jimvt

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vermont
  • Local time:12:08 AM

Posted 13 November 2010 - 01:23 PM

Avast keeps telling me it can't open or find Winstart.bat.
What is it? Should delete it? How?

I'm using WinXP Home

Thanks,

JimVT

BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,995 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:12:08 AM

Posted 13 November 2010 - 06:35 PM

Hello,

Let's see what we can discover. First, does AVAST provide a file path for Winstart.bat?

Second, please download Malwarebytes Anti-Malware (v1.46) and save it to your desktop.Download Link 1
Download Link 2
MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
    For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.
Orange Blossom :cherry:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 jimvt

jimvt
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vermont
  • Local time:12:08 AM

Posted 14 November 2010 - 01:14 PM

Hello O.B., Thanks for the help. I'm using Windows XP Home

The Avast file info is "C:\Windows\winstart.bat" "Error: file is offline. It is currently not available. 420076".

Here's the MBAM Quick Scan log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5114

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

11/14/2010 11:49:25 AM
mbam-log-2010-11-14 (11-49-25).txt

Scan type: Quick scan
Objects scanned: 144089
Time elapsed: 10 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#4 jimvt

jimvt
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vermont
  • Local time:12:08 AM

Posted 14 November 2010 - 01:17 PM

Correction: that number is 42006

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,613 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:08 AM

Posted 14 November 2010 - 02:29 PM

When doing a Google Search for Avast C:\Windows\winstart.bat file is offline, it appears that avast is the only security vendor providing that message.

Virus Total report on winstart.bat as of 2010.04.30 <- no anti-virus vendor detected it as a threat to include avast.

If you have that file, then resubmit if for a more current analysis.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 jimvt

jimvt
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vermont
  • Local time:12:08 AM

Posted 14 November 2010 - 02:42 PM

Hello, Dick: Can't find the file winstart.bat file in C:\Windows.

"Search" checked Windows, Hidden and other files and couldn't find it?

#7 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,613 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:08 AM

Posted 14 November 2010 - 05:13 PM

Can you post the results of avast!'s Real-time Shield Scan Report?

Look in the C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\report\ for the aswBoot.txt file.

Please download SystemLook from one of the links below and save it to your Desktop.
Link 1: SystemLook (32-bit)
Link 2: SystemLook (32-bit)

Link 1: SystemLook (64-bit)
Link 2: SystemLook (64-bit)
  • Double-click SystemLook.exe to run it.
  • Vista/Windows 7 users right-click and select Run As Administrator.
  • Copy and paste everything in the codebox below into the main textfield:
    :filefind
    winstart.bat
    
  • Click the Look button to start the scan.
  • When finished, a Notepad window will open SystemLook.txt with the results of the search and save a copy on your Desktop.
  • Please copy and paste the contents of that log in your next reply.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#8 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,995 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:12:08 AM

Posted 14 November 2010 - 05:25 PM

My computer doesn't have that file either, so the fact that you couldn't find it isn't troubling.

What is odd is why AVAST is giving you that message. I've seen other discussions concerning that error message and the fact that the file just isn't there, but thus far no resolutions or explanations as to why it's happening.

You state that AVAST gives you that message. When does it do so? During what kind of scan?

What other security programs do you have installed?

Was this computer initially installed with Windows XP or was it upgraded from an earlier version?

Are you experiencing other issues with the computer?

Orange Blossom :cherry:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#9 jimvt

jimvt
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vermont
  • Local time:12:08 AM

Posted 15 November 2010 - 07:55 AM

DT: Here's the file.................
SystemLook 04.09.10 by jpshortstuff
Log created at 07:53 on 15/11/2010 by Owner
Administrator - Elevation successful

========== filefind ==========

Searching for "winstart.bat"
C:\WINDOWS\winstart.bat -rahs-- 2 bytes [12:22 27/09/2010] [12:23 27/09/2010] 81051BCC2CF1BEDF378224B0A93E2877

-= EOF =-

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,613 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:08 AM

Posted 15 November 2010 - 09:56 AM

Did you find the avast logs? Are you experiencing any other symptoms or signs of malware infection?

winstart.bat was found with the following attributes -rahs-:
R = Read-only files
A = Files ready for archiving
H = Hidden files
S = System files

Winstart.bat is a batch File which was used on older Windows Operating Systems like 9x and ME every time the computer was booted as described here.

However, I'm finding winstart.bat in many logs generated by security and investigative tools. In some (but not all) cases it appears to be related to malware issues as shown by these security vendors:
Please download OTM by OldTimer and save to your Desktop.
  • Double-click on OTM.exe to launch the program. Vista/Windows 7 users right-click and select Run As Administrator.
  • Copy the file(s)/folder(s) paths listed below - highlight everything in the code box and press CTRL+C or right-click and choose Copy.
:Processes
explorer.exe

:Files
c:\windows\winstart.bat

:Commands
[reboot]
  • Return to OTM, right-click in the open text box labeled "Paste Instructions for Items to be Moved" (under the yellow bar) and choose Paste.
  • Click the red MoveIt! button.
  • The list will be processed and the results will be displayed in the right-hand pane.
  • Highlight everything in the Results window (under the green bar), press CTRL+C or right-click, choose Copy, right-click again and Paste it in your next reply.
  • Click Exit when done.
  • A log of the results is automatically created and saved to C:\_OTM\MovedFiles \mmddyyyy_hhmmss.log <- the date/time the tool was run.
--Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose Yes. After the reboot, open Notepad, click File > Open, in the File Name box type *.log and press the Enter key. Navigate to the C:\_OTM\MovedFiles folder, open the newest .log file and copy/paste the contents in your next reply. If not asked, reboot anyway.

Caution: Be careful of what you copy and paste with this tool. OTM is a powerful program, designed to move highly persistent files and folders and is intended by the developer to be used under the guidance and supervision of a trained malware removal expert. Using it incorrectly could lead to serious problems with your operating system if removing a critical file or folder.


.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#11 jimvt

jimvt
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vermont
  • Local time:12:08 AM

Posted 15 November 2010 - 12:11 PM

DT: I'm sending two OTM files. The first moved the "winstart.bat". The senond couldn't find it. I trust that is a good thing.

Also sending the AVAST logs.

========== PROCESSES ==========
Process explorer.exe killed successfully!
========== FILES ==========
c:\windows\winstart.bat moved successfully.
========== COMMANDS ==========

OTM by OldTimer - Version 3.1.17.2 log created on 11152010_114547

========== PROCESSES ==========
Process explorer.exe killed successfully!
========== FILES ==========
File/Folder c:\windows\winstart.bat not found.
========== COMMANDS ==========

OTM by OldTimer - Version 3.1.17.2 log created on 11152010_115637

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Saturday, November 06, 2010 3:51:17 PM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Sunday, November 07, 2010 5:02:37 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Sunday, November 07, 2010 10:24:17 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Sunday, November 07, 2010 10:40:08 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Sunday, November 07, 2010 11:22:25 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Sunday, November 07, 2010 1:04:46 PM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Sunday, November 07, 2010 1:14:33 PM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Sunday, November 07, 2010 1:20:27 PM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Sunday, November 07, 2010 1:27:07 PM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Monday, November 08, 2010 6:50:52 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Tuesday, November 09, 2010 6:51:15 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Tuesday, November 09, 2010 4:10:29 PM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Wednesday, November 10, 2010 6:55:35 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Thursday, November 11, 2010 8:51:18 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Thursday, November 11, 2010 12:01:16 PM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Friday, November 12, 2010 9:15:25 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Saturday, November 13, 2010 8:56:22 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Sunday, November 14, 2010 6:34:21 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Monday, November 15, 2010 6:54:13 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Monday, November 15, 2010 9:56:28 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Monday, November 15, 2010 11:50:58 AM
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Monday, November 15, 2010 11:59:10 AM
*

One odd thing.....when the first OTM finished, my desktop had NO icons showing. After rebooting they came back up.

Scared the heck outta me!

#12 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,613 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:08 AM

Posted 15 November 2010 - 01:09 PM

I'm sending two OTM files. The first moved the "winstart.bat". The senond couldn't find it. I trust that is a good thing.

Yes. OTM found and moved the file the first time. The second time you ran it the file was no longer present so it was not found.

Any more messages from avast or other signs/symptoms of infection?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#13 jimvt

jimvt
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vermont
  • Local time:12:08 AM

Posted 15 November 2010 - 01:28 PM

Well, DT, I just ran an Avast Quickscan and it showed the winstart.bat file in C:\OTM etc but said it had been moved and AVAST couldn't scan it.

No other issues.....I'm just curious how this all came about.

Thanks to you and Orange Blossom for your interest and help.

Regards.

JimVT

#14 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,613 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:08 AM

Posted 15 November 2010 - 01:46 PM

Avast Quickscan and it showed the winstart.bat file in C:\OTM etc but said it had been moved and AVAST couldn't scan it.

Some final cleanup steps will take care of that.

Connect to the Internet and double-click on OTM.exe to launch the program again.
  • Click on the green CleanUp! button.
  • When you do this, a text file named cleanup.txt will be downloaded from the Internet.
  • If you get a warning from your firewall or other security programs regarding OTMoveIt attempting to contact the Internet, please allow the connection.
  • After the text file has been downloaded, you will be asked if you want to Begin cleanup process?
  • Select Yes.
-- Doing this will remove any specialized tools downloaded and used. If OTM does not delete itself, then delete the file manually when done.
-- Any leftover folders/files which OTM did not remove can be deleted manually (right-click on it and choose delete).

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users