My PC shuts down when I open cmd
Solved/Closed
Anonymous User
-
Updated on Jan 16, 2019 at 08:52 AM
Gervarod Posts 306 Registration date Saturday March 27, 2010 Status Member Last seen June 8, 2014 - Jul 25, 2010 at 10:15 AM
Gervarod Posts 306 Registration date Saturday March 27, 2010 Status Member Last seen June 8, 2014 - Jul 25, 2010 at 10:15 AM
Related:
- How to stop automatic restart windows 7 cmd
- Kmspico windows 7 - Download - Other
- Minecraft java edition free download for pc windows 7 - Download - Sandbox
- Change computer name cmd - Guide
- Microsoft store download windows 7 - Download - App downloads
- Gta 5 download apk pc windows 10 - Download - Action and adventure
2 responses
Gervarod
Posts
306
Registration date
Saturday March 27, 2010
Status
Member
Last seen
June 8, 2014
21
Updated on Sep 9, 2019 at 07:45 AM
Updated on Sep 9, 2019 at 07:45 AM
This is a virus activity which prevents to use command prompt on the infected machine, this virus is called PC-OFF.bat trojan which turns off or shutdown your computer when ever you try to use command prompt by any means.
The infected computer restarts on opening command prompt.
This PC-OFF.bat virus creates the following files
at the following locations
Another variant of the this virus is recognized as bar311.exe virus A.K.A. winzip123 which will have almost the same symptoms and when ever you boot your Windows Xp computer in safe mode it will say a message Thank You!!! Password:Winzip123
Let's find out the fix to remove this shutdown virus completely from computer.
Fix:
1. Open Task Manager by pressing Ctrl+Shift+Esc, click the process tab and locate the process named `password_viewer.exe` or `bar311.exe` or `photo.zip.exe` one by one and right click and select `End Process'
2. Open Start Menu >> Run, type regedit and press Enter key or OK button
3. Navigate to the following path
HKEY_LOCAL_MACHINE \ SOFTWARE \ MICROSOFT \ WINDOWS NT \ CURRENTVERSION \ WINLOGON
4. Locate the key named Userinit in right pane
"Userinit" = C:\WINDOWS\system32\userinit.exe,bar311.exe"
double click and remove the text `bar311.exe' from the above
OR
"Userinit" = C:\WINDOWS\system32\userinit.exe,photo.zip.exe"
double click and remove the text `photo.zip.exe' from the above
OR
"Userinit" = C:\WINDOWS\system32\userinit.exe,password_viewer.exe"
double click and remove the text `password_viewer.exe' from the above
Note: Please make sure after editing the above Userinit key value it should be only
C:\WINDOWS\system32\userinit.exe (as shown in the image below)
or try this one to get rid of it.
The pc-off.bat contains the syntax like this"C:/path/shutdown -s -f -t 2 -c" which automatically shutdown your computer when you run the cmd.exe.
Manual removal is outlined below. Download bar311.exe - winzip123.exe Automatic Remover here.
Manual removal:
1. upon start up.... after os loading... go to task manager by pressing CTRL+ALT+DEL then kill password_viewer.exe or bar311.exe or photos.zip.exe...
2. EDIT the following registry entries thru regedit at start/run
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="userinit.exe,bar311.exe" ---> remove ", bar311.exe" only... leave userinit.exe because this is used by Windows when you log-in...
[HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
"HideFileExt"=dword:00000000
"ShowSuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Command Processor]
"autorun"="c:\Windows\pc-off.bat" --> remove "c:\Windows\pc-off.bat" or delete the autorun key.
3. go to your flash drive (USB drive), please use the folders view in the explorer and use the navigation panel on the left side when accessing the drives to avoid triggering the autorun... then delete autorun.inf and password_viewer.exe or bar311.exe
4. open notepad then type what is shown below as is...
@echo off
del /a /f c:\Windows\bar311.exe
del /a /f c:\Windows\password_viewer.exe
del /a /f c:\Windows\photos.zip.exe
del /a /f c:\Windows\pc-off.bat
pause
then save this as remove.bat then click to run.... this will remove the virus...
hope to get a reply back from you buddy.
Regards, Gervarod
The infected computer restarts on opening command prompt.
This PC-OFF.bat virus creates the following files
- password_viewer.exe
- bar311.exe
- photo.zip.exe
- pc-off.bat
at the following locations
- c:\windows\bar311.exe
- c:\windows\password_viewer.exe
- c:\windows\photo.zip.exe
- c:\windows\pc-off.bat
Another variant of the this virus is recognized as bar311.exe virus A.K.A. winzip123 which will have almost the same symptoms and when ever you boot your Windows Xp computer in safe mode it will say a message Thank You!!! Password:Winzip123
Let's find out the fix to remove this shutdown virus completely from computer.
Fix:
1. Open Task Manager by pressing Ctrl+Shift+Esc, click the process tab and locate the process named `password_viewer.exe` or `bar311.exe` or `photo.zip.exe` one by one and right click and select `End Process'
2. Open Start Menu >> Run, type regedit and press Enter key or OK button
3. Navigate to the following path
HKEY_LOCAL_MACHINE \ SOFTWARE \ MICROSOFT \ WINDOWS NT \ CURRENTVERSION \ WINLOGON
4. Locate the key named Userinit in right pane
"Userinit" = C:\WINDOWS\system32\userinit.exe,bar311.exe"
double click and remove the text `bar311.exe' from the above
OR
"Userinit" = C:\WINDOWS\system32\userinit.exe,photo.zip.exe"
double click and remove the text `photo.zip.exe' from the above
OR
"Userinit" = C:\WINDOWS\system32\userinit.exe,password_viewer.exe"
double click and remove the text `password_viewer.exe' from the above
Note: Please make sure after editing the above Userinit key value it should be only
C:\WINDOWS\system32\userinit.exe (as shown in the image below)
or try this one to get rid of it.
The pc-off.bat contains the syntax like this"C:/path/shutdown -s -f -t 2 -c" which automatically shutdown your computer when you run the cmd.exe.
Manual removal is outlined below. Download bar311.exe - winzip123.exe Automatic Remover here.
Manual removal:
1. upon start up.... after os loading... go to task manager by pressing CTRL+ALT+DEL then kill password_viewer.exe or bar311.exe or photos.zip.exe...
2. EDIT the following registry entries thru regedit at start/run
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="userinit.exe,bar311.exe" ---> remove ", bar311.exe" only... leave userinit.exe because this is used by Windows when you log-in...
[HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
"HideFileExt"=dword:00000000
"ShowSuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Command Processor]
"autorun"="c:\Windows\pc-off.bat" --> remove "c:\Windows\pc-off.bat" or delete the autorun key.
3. go to your flash drive (USB drive), please use the folders view in the explorer and use the navigation panel on the left side when accessing the drives to avoid triggering the autorun... then delete autorun.inf and password_viewer.exe or bar311.exe
4. open notepad then type what is shown below as is...
@echo off
del /a /f c:\Windows\bar311.exe
del /a /f c:\Windows\password_viewer.exe
del /a /f c:\Windows\photos.zip.exe
del /a /f c:\Windows\pc-off.bat
pause
then save this as remove.bat then click to run.... this will remove the virus...
hope to get a reply back from you buddy.
Regards, Gervarod
