c.bat infected file

[Guest]

I noticed that on a few pcs within our network that Norton AV is catching an infected file called c.bat which is infected by BAT.Trojan. That's it. I tried doing a search for the c.bat file but it doesn't exist except in the quarantine section of Norton AV. I can only assume that it's being generated by something, but can't figure out what. I did a search for BAT.Trojan on Symantec but found nothing and then did a general search on Google and again nothing. I don't know if this is related somehow to the W32/Gaobot that is running around (some of our pcs have been infected with that), but find it puzzling that Norton wouldn't also find Gaobot on the pc along with the c.bat file. Has anybody else encountered this Trojan or have any info on it. It would be much appreciated.

 

[George Hester]

Why don't you send the c.bat file to Notepad and see what is in it? Do NOT double-click it. That might lead to further information.

 

[Guest]

I kinda did that. From the command line, i typed in edit c.bat and the code showed there, unfortunately i deleted it so can't post here what exactly it said, but it appeared to connect to an ftp site and then ran an executable name smsc.exe. If i find another infected computer i'll try to get the exact coding.

 

[George Hester]

Yes edit will work also. That is old technology. You could have done in the command prompt notepad c.bat as well.

What I was hoping for is what you provided. I would also have deleted smsc.exe if it had properties with no version tab or copyright. Maybe not delete but make sure it wasn't in my path or in the path in the bat file.