Winstart.bat is overwritten if it exists. Otherwise the virus names itself winstart.bat.

Bat.Rahiworm is a batch file that infects archived files, such as .zip, .arj, and .rar files. The virus is added to infected archives using the name Info.bat. The virus creates a Winstart.bat file that runs when Windows is restarted. It also renames itself to either Win.bat or Format.bat.