A few moments ago, I fixed my friend’s computer’s problem. She’s having problem when accessing the command prompt from her Windows XP operating system. Everytime she attempts to execute “cmd” on her Run dialog box, her computer automatically shuts down. Here is my analysis on how the virus prevents her from using the command prompt and how to remove the virus from the sytem.
Problem
A virus is preventing the user from using the command prompt. When “cmd” is used, the system automatically shuts off.
Analysis
After giving attempting the “cmd” on her system, the command prompt executes a file called “pc-off.bat“. If my assumptions are correct, this file causes the system to shut down. The file injects itself before the “cmd” command starts.
The only way that this can be done is to inject a command in the Command Processor registry entry. To solve the problem, we have to trace and remove the command that was injected by the virus.
Solution
We must first gain access to our registry editor (regedit on your run prompt). In some cases, the virus disables user (admin) access to the registry. Since the virus injects itself in our command prompt, using DOS to access the registry is not possible. What I can suggest is you download and install an alternate registry editor which you can use to browse your registry editors.
One you gain access to the system registry, browse on the [HKEY_CURRENT_USER\Software\Microsoft\Command Processor] and remove the “autorun“= “c:\Windows\pc-off.bat” entry.
Remove or delete the highlighted entry.
After removing the autorun entry, download and run this batch file.
In some reported cases, the pc-off.bat virus have other variations like bar311.exe, password_viewer.exe, and photos.zip.exe. The fix file above should remove these files as well.
After fixing the problem, update your anti-virus or buy an updated anti-virus to prevent further infection.
Related articles
Tagged with: anti-virus, auto-shutdown virus, how to fix auto shutdown, pc-off.bat, shutdown cmd, tips, Tricks, Virus, worm
Subscribe to Techy Kid by Email
November 16th, 2008 at 12:44 am
wow! thanks for this post! It helped me solve my shutdown prob
[Reply]
November 27th, 2008 at 10:36 am
it is the best solution i ever found! i tried a lot but this is the most accurate. thanks!
[Reply]
November 29th, 2008 at 5:47 am
ah. had the same problem a few months ago… pero ang ginamit ko noob killer.
[Reply]
November 29th, 2008 at 6:21 am
not working
[Reply]
December 11th, 2008 at 7:45 pm
Great… my friend problem was solve.. thanks br0
[Reply]
December 14th, 2008 at 11:18 am
Hi there! Thanks very much for this. I was able to get rid of this extremely annoying virus and can now use “CMD” anytime. Thanks again!
-BC
[Reply]