die.bat?

Question

Hello, I recently found a program called die.bat in C:\Users[Name]\AppData\Roaming, it is really odd. It isn't a virus and when I opened it a CMD windows opens and closes instantly. I pressed edit and this is what it had:ping 192.0.2.2 -n 1 -w 1 > nul

del "G:\setup.exe"

I don't know how it got there it isn't an app folder so I still don't get it, if anyone has had this happen to before, so please tell me. (This is no joke)

Answer 1

It looks like something left over from the installation of some software.

The first command (ping 192.0.2.2 -n 1 -w 1 > nul) generates a very short delay (about 1 millisecond) before executing the second command.

The second command deletes a file named setup.exe that was located on your G: drive.  Most likely, G: is a removable drive, such as a USB flash drive or a card inserted into a card reader.

Although this file itself is not malware, it's entirely possible that whatever was installed when G:\setup.exe was run is malware and is still on your computer.  I suggest that you run each of the following free scans.

eset Online Virus scanner --> http://www.eset.com/us/online-scanner/

Download, install, update, and run these two free programs. 

MalwareBytes AntiMalware

SUPERAntiSpyware

Use the free versions, not the free trials of the "pro" versions.  Pay attention during installation to uncheck any prechecked boxes that would install some additional third-party program.

Don't run the scans simultaneously.  Each scan may take a long time.  Start one up and go do a non-computer chore.  When the scan complete, let the program deal with anything it finds.

When done, you may keep or uninstall either or both programs.  If you keep SAS, I suggest changing its default setting to NOT run automatically when Windows starts.

Answer 2

Good afternoon, thank you for the answer, I could uproot, and also thanks to its additional registration information.

I always liked remove viruses and Trojans that I like in computer security.

Greetings and Happy Holidays!

Answer 3

Thanks I seem to understand it better, even do the name is not common; "never judge a program for its extension"

Answer 4

Dear Nahuel.

Nope scanned it, it seems to be harmless but how did it get, why is it there? I've alays had Antivirus so ita really odd to me. After all it's said to be there since month of this year! No special attributes, just a plain dead batch file. I haven't deleted though if you ever need some info about it I'll have it

Answer 5

Surely it's too late to give an answer, but I had to that virus called Troyano.Tracer.E (die.bat) What delete passing the Malwarebytes' Anti-Malware, download it free. regards,

PS: sorry for my English is that I'm learning xD