Home » Post Item » How to remove Bar311.exe PC shuts down virus…
"The number one benefit of information technology is that it empowers people to do what they want to do. It lets people be creative. It lets people be productive. It lets people learn things they didn't think they could learn before, and so in a sense it is all about potential".

How to remove Bar311.exe PC shuts down virus…

March 19, 2008

 

Last weekend i just finished formatting my laptop for having a very serious problem regarding these various types of viruses and keeps my day paranoid… One of them is this bar311.exe that keeps blocking my cmd (command prompt) thing… so ill just shared this method on how to solve this problem…

This is the symptom of a computer having bar311.exe virus A.K.A. winzip123. The virus comprises bar311.exe, password_viewer.exe, photos.zip.exe and pc-off.bat.

When you boot your Windows XP in Safe Mode the message appears: Thank You!!!
Password:Winzip123

The pc-off.bat contains the syntax like this”C:/path/shutdown -s -f -t 2 -c” which automatically shutdown your computer when you run the cmd.exe. So heres the solution to this problem… just follow these simple steps that im goin to discuss….

Manual removal:

1. upon start up…. after os loading… go to task manager by pressing CTRL+ALT+DEL then kill (end process) password_viewer.exe or bar311.exe or photos.zip.exe…

2. EDIT the following registry entries thru regedit at start/run

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
“Userinit”=”userinit.exe,bar311.exe” —> remove “, bar311.exe” only… leave userinit.exe because this is used by Windows when you log-in…

[HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced]
“Hidden”=dword:00000001
“HideFileExt”=dword:00000000
“ShowSuperHidden”=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Command Processor]
“autorun”=”c:\Windows\pc-off.bat” –> remove “c:\Windows\pc-off.bat” or delete the autorun key.

3. go to your thumb drive, please use the folders view in the explorer and use the navigation panel on the left side when accessing the drives to avoid triggering the autorun… then delete autorun.inf and password_viewer.exe or bar311.exe

4. open notepad then type what is shown below as is…

@echo off
del /a /f c:\Windows\bar311.exe
del /a /f c:\Windows\password_viewer.exe
del /a /f c:\Windows\photos.zip.exe
del /a /f c:\Windows\pc-off.bat
pause

then save this as remove.bat then click to run…. it will remove this annoying types of PC shut-off thing of virus… ;)

Try it.. it works peepz…

DOWNLOAD ANTI-VIRUS HERE

See all Related Post…



Share and Enjoy:
  • del.icio.us

Posted by edzzy at 11:30 pm | permalink

Previous Comments

Hello Edzzy, Thanks a lot for the tips that u have given. I’m gonna give it a try.

Posted by ed at March 21, 2008, 5:46 pm

thanks bro actually i encountered this type of virus on my PC my plan is to format my PC and also i downloaded an anti virus AVAST and it removed this type of virus but i thank on your info

thanks

Posted by ian at March 23, 2008, 7:30 pm

Thank you so much! You’re so great! how did you know the solution to that kind of virus? actually, i have tried it and it works. you’re the man!

Posted by jonbayona at March 26, 2008, 12:00 am

thanks so much…got the bar311 yesterday but now its gone per your instructions…hope it wont come back…thanks again…more power

Posted by jov at March 26, 2008, 9:27 am

Hey!!!

This tip was great!

I tried it a while ago because that’s also my problem with my desktop PC…

Thanks!!!

And more power!

Posted by Christian at March 28, 2008, 9:15 pm

i’ve been looking for this.
thanks for the tip
it works ^_^

Posted by Fire2Hot at March 29, 2008, 1:48 pm

Thanks! This solved my problem!

Posted by Brian G at April 8, 2008, 4:26 pm

Well done!
finally got rid of the virus i got in school.
thanks a lot!

Posted by TorS at April 14, 2008, 10:26 am

Thank you very much for your post! It helped me a lot.

Posted by Ira at April 24, 2008, 9:31 am

Salamat From the Phillipines!!! I had the problem first with my work pc and when I tried fixing and downloading some tools from the net I tried using my thumb drive to transfer files from my desktop to my laptop. Got my desktop infected aswell. :D
thanks for the tip it did me wonders!!!

Posted by mdizon74 at May 16, 2008, 5:33 am

many thanks to you bro! rok on! more power!

Posted by Jeff at May 20, 2008, 9:41 pm

Thank you so much for this post! I can now access the command prompt. I’m really greatful! ^_^ Salamat talaga!!

Posted by xehnri at May 31, 2008, 3:06 pm

Thanks Jeff,
I tried with some registry utilities & also Symantec antivirus. But your tips helped me to get rid of this Virus.

Thanks a lot, May God bless you.

Posted by John at June 5, 2008, 1:44 pm

A million thanks to you!!! You saved me and my PC from trouble. As soon as I clicked on the remove.bat icon and restarted my PC, the problem was gone like magic! Please keep on posting. :-)

Posted by Marie at August 12, 2008, 6:02 pm

This is a great tutorial :) thanks

Posted by evilklown79 at August 14, 2008, 7:55 am

thanks!!!^_^
but i have another problem, it came back….
how do i delete the virus from my flash drive??
i think it’s the source…

Posted by andrea at September 5, 2008, 12:39 am

WOW.

awesome.
this virus has been bugging me for weeks.
im glad its out of my system now, thanks to you.

THANKS =)

Posted by renz at September 6, 2008, 11:54 pm

hi. how will i get rid of thiw worm?
eset in my laptop used to prompt this msg:
object:
C:\WINDOWS\pc-off.bat
Threat:
Win32/Autoit.CW worm
Information:
cleaned by deleting - quarantined
Every time i scan my laptop it used to indicate that there’s infiltrations.
please help

Posted by m_babyhans at September 13, 2008, 4:59 pm

thanks on this it helps me

Posted by chi at September 25, 2008, 3:23 pm

hi, im a bit confused on editing the registry on this part of your instruction:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced]
“Hidden”=dword:00000001
“HideFileExt”=dword:00000000
“ShowSuperHidden”=dword:00000001

…how do i put the values for those? im sorry i am a bit confused, when i click on the folder icon, there’s a lot of keys and i dont know which is which X(

i’ve got NOD32, and it already quarantined the virus, so the remove.bat wasn’t able to find anything :(

but i really hope that i got it all correctly coz i cant seem to find the virus on my system after a thorough scanning.

salamat! [thankyou!]

Posted by melissa at September 25, 2008, 8:51 pm

thank you eddzy that was fantastic. IT WORKED! It completely removed those bugs.pronto.thanks for sharing that know-how with us.now i can play with my cmd again.
mabuhay ka!

Posted by ken at September 29, 2008, 8:42 pm

hello. how can i do this if my task manager has already been disabled by a virus? thanks a lot!

Posted by dianne at October 3, 2008, 6:29 pm

hey, thank you so much for taking time emailing me. ^__^ i’ve solved the problem thanks to your instructions! antivirus apps now still have its loopholes. salamat!

Posted by melissa at October 4, 2008, 12:46 pm

thank you for this. I got the worm from browsing at a free WIFI zone along G Araneta (Genki Cafe in Sanctuarium)

Posted by Edong Go at October 7, 2008, 5:29 pm

hi there..i have the exact problem like the others about the annoying win32/autofit.cw worm that pops up in my desktop..

im in the number 3 now on your procedure..
im stuck there because i dont know where is the thumb drive or folders view your saying there..

please help what should i do to totally remove this worm.. thanks a lot Godbless

Posted by peygaspar at October 9, 2008, 1:29 am

i hope to hear from you as quick as possible because im getting paranoid about this worm that never gets tired of popping in my desktop,..

thank you so much for your help..

Posted by peygaspar at October 9, 2008, 1:33 am

autorun.inf and password_viewer.exe or bar311.exe,where will i find these?

Posted by adam at October 20, 2008, 7:48 am

thanks for this tips! I just removed it from my pc

Posted by fesh at November 18, 2008, 2:17 pm

hey…. I did this but I think my java was affected of passwor_viewer.exe… because my java does not run properly…

what happen???

Posted by Toyah at November 23, 2008, 11:19 am

thx bro,,,,
really help me to remove n delete dis virus

Posted by andi at November 29, 2008, 6:25 am

THANKS A LOT!!

Posted by altec122 at December 6, 2008, 2:21 am

thanks for this info…but my problem is when i try to
run remove.bat my pc shuts off again…

im going crazy!!!how do i get this thing off my pc??

Posted by krissyclara at December 9, 2008, 10:39 am

Hey Thanks a lot..It’s really helpful..How did you learn it? Well done bro..

Posted by Thilina at December 12, 2008, 1:21 am

Thanks very much for the help!!! I finally got rid of this virus and can now use CMD anytime!! Really, thanks!

BellaCullen-88

Posted by BellaCullen at December 14, 2008, 10:56 am

Thank you for this tips.

Posted by technomatic at December 26, 2008, 6:50 pm

thank you! you helped save my desktop. :)

Posted by quincy of manila at January 8, 2009, 4:05 pm

thanks so much man

i had had this annoying virus for a while on my lap

all i could do is to make a batch that types
shutdown -a every time this pc-off.bat batch works to use my cmd freely and could correct the folder options from the registry

but now with your tips i removed it completely from the lap

thaks again man

keep the good work , it keeps your memory!!

Posted by ex-programmer at January 14, 2009, 11:19 am

Thank you very much for saving my time to reformat another pc.
Thanks a lot!
keep up the good work

Posted by bryan at March 30, 2009, 3:49 pm

Thank you very much

Posted by James Undag at April 5, 2009, 3:34 pm

geezz! should have found your site long time ago. how many times have i reformatted my laptop because of this same problem. and just today it hits me again. good thing i found this and wow, what you have written here really works.

THANKS A BUNCH!!!

Keep up the great work!

Posted by Mina at April 8, 2009, 4:47 pm

Thanks a lot!!!

Posted by daniel at May 22, 2009, 9:48 am

thank you very very much. i remove the pc-off.bat using your tips. it helps a lot… i dont need to reformat my pc.

Keep up the good work!!!.

Posted by xy at June 3, 2009, 7:08 pm

thanks a lot!!!
VERY BIG HELP!
I hope I wont encounter that virus/worm anymore….

thanks again..c:

Posted by g at June 4, 2009, 12:58 am

tnx bro….your da man…from philippines

Posted by Mark at June 22, 2009, 12:23 pm

it work thanks alot save me from formating my pc again

Posted by beeside at July 3, 2009, 12:08 am

Thanks! One problem though:my task manager got disabled. :(

Posted by xssx at August 2, 2009, 4:27 pm

hi edzzy, your the man!!! thanks for the instructions autorun virus has gone! but i have another problem how about the root kit virus, how to delete it manually? thanks again…

Posted by sonny at November 12, 2009, 4:31 pm

All comments are moderated. Your comments will not appear here unless approved by the blog owner. Thank you.

Add a comment