This is a path companion BAT virus. It does not change batch files but instead creates new batches with the same names as ones further down, so when an infected batch is run from out of a path directory the virus runs first and searches for more batch files to infect them before running the host batch. Delete the hidden batch files from path directories to remove this virus.
This virus infects one batch in each path directory each run by copying a copy of this batch to the same filename but in an earlier path directory. After infecting 35 batch files it displays the message:
ShadowBat 1997
