Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Avast: C:\Windows\winstart.bat - Error: File is offline


  • Please log in to reply
5 replies to this topic

#1 Denis07

Denis07

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:32 AM

Posted 08 December 2013 - 09:40 AM

Hi,

 

Some time ago, Avast started to show the following message after every single scan (Win7 64 bit):

"Some files could not be scanned"

In the "Warnings" section, it shows this:

"C:\Windows\winstart.bat                  Error: File is offline - it is currently not available.(42006)"

 

 

When I look at winstart.bat, I see that it was modified recently. The file size is 1KB, but when I edit this file with notepad, it seems to be empty.

Is my computer infected? I read on different sites that winstart.bat could be related to some spywares.

 

Thanks in advance.



BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,591 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:32 PM

Posted 08 December 2013 - 10:47 AM

The error message you received is common among avast! users. When doing a Google Search for Avast C:\Windows\winstart.bat file is offline, it appears that avast is the only security vendor providing that message and has been doing so for several years.

Winstart.bat is a batch File (text file) which contains commands that can be used to run other processes or tasks when you execute it and is usually located in the C:\Windows folder. Winstart.bat was used on older Windows Operating Systems like Windows 95, 98 and ME and was executed every time Windows starts just like AUTOEXEC.BAT as described here. Winstart.bat was also used to load memory-resident utilities in Windows applications in order to run DOS applications under Microsoft Windows version 3.00 as described in Microsoft Article ID: 69186 but in could be misused for malicious purposes.

This file can be opened in Notepad for inspection of its contents by right-clicking on it and choosing edit...and any text line can be suspended by typing REM followed by a space in front of the line. I have read the file is sometimes used to speed up the boot process so its not required and can be removed. However, if left on the machine, some anti-virus programs may detect it as the file is not able to be scanned properly.

Virus Total report on winstart.bat as of 2010.04.30 <- no anti-virus vendor detected it as a threat to include avast.

The fact that the file is unavailable doe not mean it is malware, as the above analysis appears to confirm. Usually when a computer is infected with malware there will be indications (signs of infection) something is wrong.

You can resubmit the file for a more current analysis. Go to one of the following online services that analyzes suspicious files:--In the "File to Scan" (Upload or Submit) box, browse to the location of the file(s) in question and submit (upload) it for scanning/analysis. If you get a message saying "File has already been analyzed", click Reanalyze or Scan again.

Note: When searching for malware removal assistance on the Internet, it is not unusual to find numerous hits from untrustworthy and scam sites which mis-classify detections or provide misleading information. This is deliberately done more as a scam to entice folks into buying an advertised fix or removal tool. In some cases if the fix is a free download, users may be enticed to download a malicious file or be redirected to a malicious web site.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 Denis07

Denis07
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:32 AM

Posted 08 December 2013 - 11:20 AM

Thank you.

VirusTotal reports a detection ration of 1/47 (Kapersky - UDS:DangerousObject.Multi.Generic). Jotti's virusscan and VirScan did not report anything.

 

Out of curioisity, I am wondering

1/ Why did Avast start to show this message only recently (I had this computer for a long time)?

2/ Why - when I edit the file using notepad - does it show an empty content when the file size is 1KB?

 

I'd like to remove it, but as I can't check its content, I don't know if it is safe to remove it.



#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,591 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:32 PM

Posted 08 December 2013 - 12:44 PM


A lot of folks who reported this at avast, when asked to checked, reported empty content. If you feel uncomfortable deleting it, you can rename it by right-clicking on it and adding .vir after the file's extension (i.e. badfile.dll.vir). If you receive an alert from Windows about renaming, just ignore it. I prefer renaming instead of deleting as deletion leaves you with no option to restore if the file is later found to be legitimate or needed. After renaming the file, move it to another location on your drive (i.e. C:\Hold) for a few days. If there are no adverse affects from taking such action, then you can delete it.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 Denis07

Denis07
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:32 AM

Posted 08 December 2013 - 12:50 PM

Thank you quiteman7.



#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,591 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:32 PM

Posted 08 December 2013 - 12:51 PM

You're welcome.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users