Tips and Tricks: This is the symptom of a computer having bar311.exe virus A.K.A. winzip123. The virus comprises bar311.exe, password_viewer.exe, photos.zip.exe and pc-off.bat.   When you boot your Windows XP in Safe Mode the message appears: Thank You!!! Password:Winzip123   The pc-off.bat contains the syntax like this”C:/path/shutdown -s -f -t 2 -c” which automatically shutdown your computer when you run the cmd.exe. So Here’s how to remove it Winzip123 or Bar311 Virus:   Step 1: Run the task manager or simply press CTRL+ALT+DEL.   Step 2: End the following process: password_viewer.exe or bar311.exe or photos.zip.exe   Step 3: The Virus have an entry in the registry, you should modify the entry in order to delete the virus. We will use regedit, Click on START, then RUN, then type regedit.   Step 4: Now that regedit is popout, we will start to modify. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon   Step 5: In the userinit entry right click and modify you will notice the value: userinit.exe, bar311.exe, password_viewer.exe, photos.zip.exe remove the ,bar311.exe. DO NOT DELETE userinit.exe   Step 6: Go to: HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Explorer\Advanced delete the following entries “Hidden”=dword:00000001 “HideFileExt”=dword:00000000 “ShowSuperHidden”=dword:00000001   Step 7: Go to: HKEY_CURRENT_USER\Software\Microsoft\Command Processor in the autorun entry, delete “c:\Windows\pc-off.bat” or delete the autorun …
... READ MORE