Computer Shuts Down when you Open up CMD (Command Prompt)

-
Computer Shuts Down when you Open up CMD (Command Prompt)

This is the symptom of a computer having bar311.exe virus A.K.A. winzip123. The virus comprises bar311.exe, password_viewer.exe, photos.zip.exe and pc-off.bat.

When you boot your Windows XP in Safe Mode the message appears: Thank You!!!
Password:Winzip123

The pc-off.bat contains the syntax like this"C:/path/shutdown -s -f -t 2 -c" which automatically shutdown your computer when you run the cmd.exe.

Manual removal is outlined below. Download bar311.exe - winzip123.exe Automatic Remover here.

Manual removal:

1. upon start up.... after os loading... go to task manager by pressing CTRL+ALT+DEL then kill password_viewer.exe or bar311.exe or photos.zip.exe...

2. EDIT the following registry entries thru regedit at start/run

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="userinit.exe,bar311.exe" ---> remove ", bar311.exe" only... leave userinit.exe because this is used by Windows when you log-in...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
"HideFileExt"=dword:00000000
"ShowSuperHidden"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Command Processor]
"autorun"="c:\Windows\pc-off.bat" --> remove "c:\Windows\pc-off.bat" or delete the autorun key.


3. go to your flash drive (USB drive), please use the folders view in the explorer and use the navigation panel on the left side when accessing the drives to avoid triggering the autorun... then delete autorun.inf and password_viewer.exe or bar311.exe


4. open notepad then type what is shown below as is...

@echo off
del /a /f c:\Windows\bar311.exe
del /a /f c:\Windows\password_viewer.exe
del /a /f c:\Windows\photos.zip.exe
del /a /f c:\Windows\pc-off.bat
pause

then save this as remove.bat then click to run.... this will remove the virus...

Comments

Anonymous said…
Your Suggestation is very help ful thans a lot
July 16, 2008 at 6:18 PM
Anonymous said…
thanks, it works
July 30, 2008 at 10:02 AM
Anonymous said…
Thank you. You're the man! :)
August 12, 2008 at 1:50 PM
Anonymous said…
thanks a lot..but how did u know? did u develop the virus urself?
August 14, 2008 at 8:12 PM
Anonymous said…
kick @ss! killed the virus in a snap. Now, time to get an avs. Thanks!
August 20, 2008 at 12:35 PM
Anonymous said…
wth, avg can't piss it off...
August 20, 2008 at 9:32 PM
Anonymous said…
nicely done sir!
August 21, 2008 at 9:53 AM
Anonymous said…
Thanks for sharing this solution.. was very helpful! Thanks again
August 26, 2008 at 5:56 AM
Anonymous said…
nice tut man....^^
dam avg....
August 28, 2008 at 2:14 AM
Anonymous said…
Great! It really helps.
Thank you...
August 28, 2008 at 1:57 PM
Anonymous said…
salamat
September 29, 2008 at 10:26 AM
Anonymous said…
Thanks for this blog, now I can use my cmd :)

More power to you sir! :)
September 30, 2008 at 11:54 AM
Anonymous said…
IT WORKS!!!!
THANK YOU!!!!
YIPEEE!!!
October 7, 2008 at 3:51 PM
Anonymous said…
wow galeng
October 11, 2008 at 7:02 PM
Unknown said…
you're a genius! lufet!
October 13, 2008 at 7:09 PM
Unknown said…
AVG can't detect that @#+!% virus...but YOU'RE THE MAN!
October 13, 2008 at 7:10 PM
Anonymous said…
I love you for that
October 17, 2008 at 6:36 PM
Anonymous said…
salamat
October 29, 2008 at 10:35 PM
ObnoxiousDweeb said…
I'm a Believer!!!! WAHOOO!!!!! Curse the one who created that virus, and all hail to you for your solution!!!
October 31, 2008 at 12:50 AM
Anonymous said…
thanks so much!
November 1, 2008 at 5:40 PM
Anonymous said…
thank you sooooo..much.... your post is superb..:)
November 4, 2008 at 2:10 PM
Anonymous said…
w00t! Thanks to you problem has been resolved. It's kinda crappy that my AVG is up to date but it can't detect it. :S
November 7, 2008 at 10:56 AM
Anonymous said…
wow!..thanks alot!,it really works!..:)
November 11, 2008 at 8:09 PM
Anonymous said…
thanks. ang sarap mo!
November 15, 2008 at 7:07 AM
Toyamah said…
I can't find the "Autorun.inf"... pls... help me... I need it ASAP... :(
November 22, 2008 at 8:53 PM
à´šà´•്à´•à´šുà´³ said…
The amount of replies giving me some confidence, i've been chasing this solution for almost five-six months now... let me have a try!!
November 30, 2008 at 4:25 PM
à´šà´•്à´•à´šുà´³ said…
Still have the "shtdown running cmd.exe " I tried all these, not a single file is present what you have specified. All seemed OK in regisry as well. What could be the issue?
November 30, 2008 at 4:44 PM
Anonymous said…
thank u very much..i've been worried sick...thank u thank u thank u
December 5, 2008 at 11:01 PM
Anonymous said…
your the man!!!!.....


thank you very much for this post... I remove now the #$^&*& virus... :D
December 18, 2008 at 8:08 AM
Anonymous said…
Both Task Manager and Registry Editor were disabled. What now?
December 31, 2008 at 1:46 PM
Anonymous said…
WOW!!! I was about to reformat my PC when I saw this link. Thanks a lot!!!
January 2, 2009 at 8:03 AM
Anonymous said…
not that techie here need help...where do i go to instruction number 3? thumb drive mo?

i will manually delete the virus/es because the automatic delete does not work or the link won't open.

thanks!
January 5, 2009 at 11:01 PM
Anonymous said…
magaling magaling magaling!!!!!! salamat ng marami!!!!!!
January 12, 2009 at 12:52 PM
Anonymous said…
thanks...meron pla n2 eh!!thanks bro,try qoh 2...
January 15, 2009 at 10:45 PM
Anonymous said…
Hello. I'm having the same problem, but I can't seem to find the exe files you mentioned in my processes. Pls. help. Thaks in advance! :)
January 20, 2009 at 6:18 PM
Anonymous said…
rak rakan na toh. . galing mo pare. . astig. . salamat. . wag na magtiwala sa anti-virus. . sayo nako magtitiwala. .\m/
January 21, 2009 at 9:48 AM
Anonymous said…
DUDE!!! THANKS ALOT! WHEW! THAT WAS VERY HELPFUL, EASY STEP BY STEP TOO:)
GREAT JOB!
January 22, 2009 at 6:56 AM
p said…
hi.. thank you for posting this.. i've been having this problem for a long time now.. you're d man!
January 22, 2009 at 1:26 PM
Mel said…
wonderful, halatang pinoy eh! haha panalo!
January 24, 2009 at 4:56 PM
Anonymous said…
wow. this was very helpful. good thing this post is available online. i couldn't thank you enough. cheers mate!
January 26, 2009 at 8:45 PM
Unknown said…
my norton detect the said file as a virus and unsafe to run.
February 2, 2009 at 8:26 PM
Anonymous said…
Thanks...it helps a lot...

My computer shuts down not just when running CMD but also when installing any anti-virus program so I'm thinking that it's the same virus.

But now it's solved. Thanks alot!!!

Mabuhay ka! :)
February 7, 2009 at 5:02 PM
Anonymous said…
i also can't open task manager, it's disabled T_T
February 9, 2009 at 6:05 PM
Anonymous said…
wow! it worked!!! finally got rid of that stoopid problem. thank god i found this blog. thanks dude!! da best ka!!!
February 18, 2009 at 12:52 AM
Anonymous said…
you're the man! one thing.. the automated removal of the virus - the file itself is infected.
February 22, 2009 at 11:46 AM
Doc Woofy said…
thank you very much for this guide. you're a blessing!
February 27, 2009 at 9:15 PM
Anonymous said…
um. di ko dn magets #3. paexplain nmn ung thumb drive mo..?
March 5, 2009 at 6:58 AM
Anonymous said…
thanks very helpful...
March 22, 2009 at 11:23 AM
Anonymous said…
thanx! good job!
March 25, 2009 at 8:42 AM
Anonymous said…
I was struggling with this issue for the past 5 months and your article for manual removal helped to resolve the problem.
Thanks alot for posting the solution.
March 31, 2009 at 11:13 AM
Unknown said…
Thank you very much dude, you are an angel, it worked like a charm.
April 3, 2009 at 3:44 PM
Anonymous said…
Thank you very much, you are an angel, it worked like a charm.
April 3, 2009 at 4:03 PM
Anonymous said…
It's really TRUE! i'm searching for this answer for so long! UR A BLESSING DUDE! thank u!
April 8, 2009 at 12:31 AM
Anonymous said…
i remove viruses through the command prompt, and one day it refuses to work properly!! thanks to your guide i got it working again. thank you very much!!
na-typo ka siguro sa #3.. are u pinoy? salamat!
April 27, 2009 at 7:16 PM
Anonymous said…
thanks been infected since last week after backing up some pics from a friends pc
May 9, 2009 at 2:26 PM
Anonymous said…
salamat po nang marami..
ie,
thanks a lot po...
May 18, 2009 at 12:09 PM
Anonymous said…
3. go to your thumb drive mo, please use the folders view in the explorer and use the navigation panel on the left side when accessing the drives to avoid triggering the autorun... then delete autorun.inf and password_viewer.exe or bar311.exe

HELP IM STUCK HIR PLSS HELP ME
May 19, 2009 at 8:30 PM
Anonymous said…
hi!
i was following the step by step manual removal of the virus kaso pagdting ko sa #3 wala na..wat does he mean by thumb drive mo?
May 30, 2009 at 8:20 AM
Anonymous said…
superb man thanks a lot...bravo
June 3, 2009 at 10:45 AM
Anonymous said…
You're a genius!!!!

You helped me solve my problem. Mabuhay ka, brader.
June 11, 2009 at 1:09 AM
Anonymous said…
You're a genius!!!!

You helped me solve my problem. Mabuhay ka, brader.
June 11, 2009 at 1:09 AM
N said…
THANK YOU VERY VERY VERY MUCH!!!
June 20, 2009 at 10:21 AM
Maitha de Vera said…
Thanks a lot. It really helps. Godbless.
June 20, 2009 at 1:33 PM
Anonymous said…
Thank you! I normally don't post a comment anywhere but just wanted to let you know your simple instructions worked for me. Trend Micro's housecall didn't work but your solution did the trick. Keep blogging!
July 12, 2009 at 11:21 PM
Anonymous said…
what's thumb drive mo?
August 7, 2009 at 10:10 PM
Edmar said…
Edited it a while ago. Thumb drive a.k.a. flash drive.
August 8, 2009 at 8:11 AM
Anonymous said…
you are damm great!!!!! it works!!
August 17, 2009 at 5:44 PM
Anonymous said…
THANKS,YOUR THE MAN
September 9, 2009 at 7:13 PM
Anonymous said…
good job man your very helpful
October 7, 2009 at 11:21 AM
Anonymous said…
wow i downloaded the auto removal..it worked..we have two desktops and one laptop that shuts down everytime i open command prompt..tried it on my laptop and my cmd works now..will try it on the 2 other units..thanks again
November 13, 2009 at 1:53 PM
Unknown said…
this is how you make a great technical guide. very easy to follow.. thanks
November 22, 2009 at 6:30 PM
Anonymous said…
wow! man u saved a a lot of time! i was thinking of reformatting the system! thanks a lot bro! ur d man!!
November 25, 2009 at 12:28 PM
Anonymous said…
thanks dude :)
December 5, 2009 at 11:04 PM
Anonymous said…
thanks! downloaded the file.. works!
December 28, 2009 at 6:37 PM
Earl said…
do I have to delete the following too?:

"Hidden"=dword:00000001
"HideFileExt"=dword:00000000
"ShowSuperHidden"=dword:00000001

I did not find any bar311.exe, password_viewer.exe, and photos.zip.exe but did find the pc-off.bat on my laptop..

will it work the same? and please do answer my question. Do I have to delete the 3 things that I have mentioned above?
December 29, 2009 at 2:06 AM
Marge said…
whoa, this thing was posted July 2008, and is still helpful up to now. thank you so much! i enjoyed the step-by-step fix. =)
January 9, 2010 at 5:00 PM
-Berry- said…
ohmigod! Thanks for the guide! It is very useful! ;D Cheers :D
March 10, 2010 at 11:07 AM
Anonymous said…
two years on the net and still very usefull...

btw YOUR MY HERO!!!!
May 21, 2010 at 5:39 PM
Anonymous said…
after trying to find the fix for my computer for a long time, you're simple automatic remover program was absolutely brilliant!!!

Ultimate props!!!
May 25, 2010 at 10:23 PM
thomassabo-charm said…
this is very useful information for me!thank you for your information, i will share it with my friend.
October 22, 2010 at 4:18 PM
Anonymous said…
thank you very much!!! :)
October 31, 2010 at 4:59 PM
video card repair said…
There definitely can be the issue of virus attacking your system.
February 3, 2011 at 8:04 PM
Lpatop repair said…
I was also facing the same problem recently, you need to get the program re installed and then get it installed again....
May 24, 2011 at 5:39 PM
Laurence said…
i had experienced this once from windows xp and did the step-by-step procedure...now that i have win7, i cant find those batch files and when running the cmd prmpt shuts my pc down.. :(
July 13, 2011 at 1:17 PM
Anonymous said…
You're the best man! This helped me a month ago, but I didn't get to post... so thank you! XD
July 23, 2011 at 11:34 PM
Anonymous said…
Two thumbs up man. it works.thanks a lot.
August 17, 2011 at 4:48 PM
TKS said…
Awesome solution! Thanks dude!
October 31, 2011 at 8:35 PM
Anonymous said…
How does this many people have the same virus?
March 1, 2015 at 2:21 AM
Post a Comment

Popular posts from this blog

How to check if your PSP can have CFW installed

-
Image
Taken from: atmaxplorer.com I’ve been receiving tons of questions on how to check if their PSP can have custom firmware installed. Here’s a complete and concise guide to get you going. Make sure to read through the guide fully since it will answer all your psp motherboard related questions. First of, you need to understand that there are three types of PSPs: 1) 1000 Series (Also known as PSP Phat/Fat) 2) 2000 Series (Also known as PSP Slim or Lite & Slim) 3) 3000 Series (Also known as PSP Brite) So why install Custom Firmware on a PSP? People install Custom Firmware so they can run Homebrew, programs developed by people that don’t have a contract with Sony. A PSP with Custom Firmware could also back up your games from the UMD to your computer; it also allows you to play those backups from your Memory Stick (MS). You could also do some serious customizations to your theme. Basically, you free your PSP from the hands of Sony. Why can’t I install Custom Firmware on my
Read more

Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged (code 19)

-
Image
Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged (code 19)- CD ROM Device Manager Error One of my client brought in a Dell Latitude laptop that has a problem with its CD ROM. According to the owner he can't access his CD. The model of his CD Rom is Samsung CD ROM SN-124. Upon inspection, I found out that the device (CD ROM drive) is missing from his My Computer (as you can see on the image below) At first, I thought that the problem lies with the connection of the CDROM because I had it disassembled a week before due to display problem. The CD Rom is snap in type, so I easily took it out and back in without hassle. Upon logging in to windows, the problem still persist. Next, I checked the Device Manager (right-click My Computer, choose Properties, then Hardware and click on Device Manager). As you can see on the picture below, there is a problem with the CD ROM because there is a yellow exclamation mark befor
Read more

Funny UST Scandal Avi.Exe Remover

-
Funny UST Scandal Virus Removal Tool Automatic remover = Download this: Funny UST Scandal Avi.exe Remover Manual: Software used to build the virus= AutoIt V3 drop Files- killer.exe(4084 kb) in c:\windows\ lsass.exe(3920kb) in c:\documents and settings\all users\start menu\programs\startup smss.exe(4088kb) in all root drives and in c:\windows autorun.inf(1kb) in all root drives with a script [autorun] open=smss.exe shell\Open\Command=smss.exe shell\open\Default=1 shell\Explore\Command=smss.exe shell\Autoplay\command=smss.exe Funny UST Sandal.avi.exe(228kb) in all root drives Registry Entries-HKLM\Software\Microsoft\WindowNT\CurrentVersion\Winlogon=shell(killer.exe) HKCU\Software\Microsoft\windows\Currentversion\Run=runonce(c:\windows\smss.exe) HOw to remove this lame virus???? -first download taskiller in http://www.rsdsoft.com/task_killer/index.php4 and install it to your computer because you cant use taskmanager to terminate the virus(the virus automatically close taskmanager). -run t
Read more