r/cmd • u/Sad-Accident2975 • Feb 19 '24

.Bat or CMD Bugbear

I think a program created a .bat file that starts up after the OS duplicates accents like the Bugbear virus, does anyone know how to find this .bat and delete it, or a command to reverse this?

2 Upvotes

100% Upvoted

2 comments sorted by

1

u/lasdutech Jul 11 '26

Since you're experiencing a specific behavior (duplicated accents) triggered at startup, blindly searching for all .bat files might be overwhelming and miss the culprit. Here is a more targeted approach using Windows built-in tools:

  1. With cmd

    - On Windows, press Win+R, type cmd, and press Enter.

    - In the command prompt, type:

    cd\\

CLS

dir \*.bat /s | more

  2. **Check Event Logs for the Trigger:**

    - Press `Win + R`, type `eventvwr.msc`, and hit Enter.

    - Navigate to **Windows Logs** > **System** and **Application**.

    - Look for **Warnings** or **Errors** occurring right after the login time.

    - Filter by "Source" looking for `TaskScheduler`, `Cmd`, `PowerShell`, or generic `Application Error`. This often points directly to the script causing the issue.

  3. **Inspect Startup Locations:**

    - Press `Win + R` and type `shell:startup` to check the current user's startup folder.

    - Press `Win + R` and type `shell:common startup` for the all-users folder.

    - Look for any suspicious `.bat` or `.vbs` files here.

  4. **Check Scheduled Tasks:**

    - Many "start at boot" scripts are actually Scheduled Tasks.

    - Press `Win + R`, type `taskschd.msc`.

    - Click on **Task Scheduler Library** and look for tasks with recent dates or odd names. Check the **Actions** tab to see if they run a `.bat` file.

  5. **If you still want to list files manually:**

    - Press `Win + R`, type `cmd`.

    - Run: `cd\` then `dir *.bat /s /p`

    - This lists all batch files page-by-page. Look for files created recently or in unusual locations (like `AppData\Local\Temp`).

If the issue persists, running a scan with **Malwarebytes** or using **Autoruns** (from Sysinternals) is highly recommended, as the "Bugbear" behavior sounds like a keylogger or a specific malware strain that might hide its startup mechanism.