1

My friend's computer was having a lot of viruses so he wanted me to download an operating system for him. So he gave me a flash memory. When I opened the flash my antivirus (Kaspersky Total Security) kept removing it saying it was Trojan.bat.runner.bv. I have restored it a lot of times but it kept deleting it. So I renamed it from 1.bat to 1.txt and all I found was this:

cd .Trashes
start wscript "459\vrdve.js"
exit

My question is how is that a virus? It won't harm my computer in any way it just starts a program.

Anders
  • 64,406
  • 24
  • 178
  • 215
Qeaxe
  • 11
  • 2

2 Answers2

3

It would be detected as a virus because it is an executable (.bat) calling a Javascript file. A recipe for a bad infection.

schroeder
  • 123,438
  • 55
  • 284
  • 319
  • 1
    And by the way, running Javascript with Windows Script Host (wscript) is far more dangerous than running it in a web browser. The Javascript API available in the WSH can do pretty much anything on the system. – Philipp Feb 11 '17 at 12:28
2

It depends on the content of 459\vrdve.js. If the file is a benign file, it may be a false alarm. Check if there is a 459 subdirectory on the flash drive. If there is, immediately use the Windows Security options to add a "Deny" entry of Execute file/Traverse directory and inspect the 459/vrdve.js file as a txt file. Post the code here.

9pfs supports Ukraine
  • 121
  • 3