$$mvcool.bat : what is it?

Discussion in 'other security issues & news' started by Jo M, Jan 26, 2005.

Thread Status:
Not open for further replies.
  1. Jo M

    Jo M Registered Member

    Joined:
    Sep 10, 2004
    Posts:
    53
    Hi,

    In the process of restoring a system and upgrading my security software I came across this file on three of my drives in the root of the drive. I certainly don't recognise it and ANYTHING named ***cool*** seems very suspect to me!

    The contents of the file on selecting it for "edit" were as follows:-

    @echo off
    Mountvol F:\ ^
    \\?\Volume{0f010e8e-df12-11d8-8812-806d6172696f}\

    The echo off line says that it goes on igcognito. I checked the registry and found a couple of references to the volume string identifier, but very little information on the origin of the file or the real identity of this folder or file that is being mounted as a drive. Should I delete these as well as removing the *.bat files themselves (already done!)

    Is there anyway I can find out what this is about? I'd like to find the folder or file that is being mounted and delete that too! (unless it really is my F:\ drive, but I can't see why one of my drives should be mounted in such a different way to all the others!!) Can anyone help?

    Thanks in anticipation Jo M
     
Loading...
Thread Status:
Not open for further replies.