A nasty batch trojan

[HKEd]

BAT.Trojan.DeltreeY

By using deltree /y, it will erase all files on C: without prompting you.

A safeguard would be to rename deltree.exe in C:\Windows\Command. Make sure there are no deltree commands in autoexec.bat first.

Another way to protect your system is to change the default action for .BAT files from Open to Edit. This can be done at:

HKEY_CLASSES_ROOT\batfile\shell

Just double-click on Default and change the value data to Edit. To run batch files, you now have to right-click and choose Open.

As anyone familiar with DOS knows, this command can be appended to autoexec.bat with just a couple of extra lines. In this scenario, the batch file will run at startup. Not a nice way to start the day.

Never run a received batch without reading it first.

[Junky]

Very good info, thanks.