Although my posts might be influenced by the daily happenings in my life, most of it would be simple thoughts that crosses my mind, questions that I have which I cannot answer, facts that I have discovered, and opinions and beliefs that I want to prove or, have already been proven.

Tuesday, January 13, 2009

PC Shuts Down

I was infected by this annoying virus and I was disappointed AVG was not able to detect it.
An indicator of this virus is that you PC suddenly shuts down, specially when you open your command prompt (cmd).

One more way you could detect if your PC is infected is by going to the
Task Manager (Ctrl+Alt+Delete), then going to the 'Processes' tab and seeing if you can find a process named:
bar311.exe
password_viewer.exe
photos.zip.exe
pc-off bat


If any of the above appears, then you are infected.
Googling the solution, let me share with you how to remove it.

Manual Removal:
1. Go to Task Manager by pressing CTRL+ALT+DEL then kill (end process) password_viewer.exe or bar311.exe or photos.zip.exe...

2. Access the regedit
Go to Start Menu > Run
Type regedit and press Enter key

From the left navigation pane, go to the ff:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon
"Userinit"="userinit.exe
This should only be userinit.exe because this is used by Windows when
you log-in...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced
Double click on each of the following and supply the last number as the
value:
"Hidden"=dword:00000001
"HideFileExt"=dword:00000000
"ShowSuperHidden"=dword:00000001

HKEY_CURRENT_USER\Software\Microsoft\Command Processor]
"autorun"="c:\Windows\pc-off.bat" -> remove "c:\Windows\pc-off.bat" or delete
the autorun key.

3. Pull-up Windows Explorer from accessories.
Plug in the thumbdrives / usb flash disks that you have been using. These probably are infected already.
Do not let autorun open it because if the USB drive is infected, it would infect your pc again.
Do not open your USB drive using My Computer as well.
Using Windows Explorer, click on the USB drive from the left navigation pane.

Delete the following files from your USB drive:
autorun.inf
password_viewer.exe
bar311.exe


If you have more than 1 USB drive, do this for all of them.

4. Remove the virus totally from your hard disk.
Open notepad and paste the ff:
@echo off
del /a /f c:\Windows\bar311.exe
del /a /f
c:\Windows\password_viewer.exe
del /a /f c:\Windows\photos.zip.exe
del
/a /f c:\Windows\pc-off.bat
pause

Save the file as remove.bat
(File > Save As. From the Save As File Type, select All Files)

This would run a command prompt pop-up allowing you to see if your PC still has the virus as well as how it is being removed.
Press Any Key and the pop-up will close.

5. You're Done.

No comments: