When a batch file is run, the shell program (usually COMMAND.COM or cmd.exe) reads the file and executes its commands, normally line-by-line.

Unix-like operating systems, such as Linux, have a similar, but more flexible, type of file called a shell script.

The filename extension .bat is used in DOS and Windows.

The line-by-line code is meant to be used as a script to accomplish something positive on your computer. Such as renaming hundreds of files, or any other repetitive task to help save time.

However, in some instances batch files can be crafted to do some pretty amazing things to infect computers, networks, etc… In some cases avoiding antivirus detection.

Understanding how these batch files can be malicious and how they work can help us in defending against them.

For educational purposes only.