How can i delete virus from my pc using command prompt

This is a virus activity which prevents to use command prompt on the infected machine, this virus is called PC-OFF.bat trojan which turns off or shutdown your computer when ever you try to use command prompt by any means.
The infected computer restarts on opening command prompt.
This PC-OFF.bat virus creates the following files

• • password_viewer.exe
  • bar311.exe
  • photo.zip.exe
  • pc-off.bat

at the following locations

• • c:\windows\bar311.exe
  • c:\windows\password_viewer.exe
  • c:\windows\photo.zip.exe
  • c:\windows\pc-off.bat

Another variant of the this virus is recognized as bar311.exe virus A.K.A. winzip123 which will have almost the same symptoms and when ever you boot your Windows Xp computer in safe mode it will say a message Thank You!!! Password:Winzip123
Let's find out the fix to remove this shutdown virus completely from computer.
Fix:
1. Open Task Manager by pressing Ctrl+Shift+Esc, click the process tab and locate the process named 'password_viewer.exe' or 'bar311.exe' or 'photo.zip.exe' one by one and right click and select 'End Process'
2. Open Start Menu >> Run, type regedit and press Enter key or OK button
3. Navigate to the following path
HKEY_LOCAL_MACHINE \ SOFTWARE \ MICROSOFT \ WINDOWS NT \ CURRENTVERSION \ WINLOGON
4. Locate the key named Userinit in right pane
"Userinit" = C:\WINDOWS\system32\userinit.exe,bar311.exe"
double click and remove the text 'bar311.exe' from the above
OR
"Userinit" = C:\WINDOWS\system32\userinit.exe,photo.zip.exe"
double click and remove the text 'photo.zip.exe' from the above
OR
"Userinit" = C:\WINDOWS\system32\userinit.exe,password_viewer.exe"
double click and remove the text 'password_viewer.exe' from the above
Note: Please make sure after editing the above Userinit key value it should be only
C:\WINDOWS\system32\userinit.exe (as shown in the image below)

5. Navigate to the following path now
HKEY_CURRENT_USER \software\microsoft\windows\currentversion\explorer\advanced
Change Value of the following registry Key's :-
"Hidden"=dword:00000001 (1) - Change to '1'
"HideFileExt"=Dword:00000000 (0) - Change to '0'
"ShowSupperHidden"=Dword:00000001 (1) - Change to '1'
6. Navigate to the following registry path
HKEY_CURRENT_USER \software\microsoft\Command Processor
Find the registry key named autorun, right click and delete this key. The value of the key would be autorun=c:\windows\pc-off.bat

7. Open notepad and type the following commands
@echo off
del /a /f c:\windows\bar311.exe
del /a /f c:\windows\password_viewer.exe
del /a /f c:\windows\photo.zip.exe
del /a /f c:\windows\pc-off.bat
pause
Save it as remove-pc-off-virus.bat and double click to run it. Or just download this batch file here and run it by double click.
8. Search for bar311.exe OR password_viewer.exe OR photo.zip.exe OR pc-off.bat and delete these files where ever found on your computer.
9. That's it, Enjoy the pc off virus is now completely removed from your computer.

have a good security system installed in the computer
\ plug in the flash drive and the sign will come up scan for virus
click yes and let the security program do the job
If there is nothing important on the flash drive go to the computer right click on the flash drive icon, click on properties and then click on format
that will clean the flash drive and remove the virus

I have faced same problem. Shortcuts everywhere.

Not once, many times.

I tried many solutions.

Shortcut Virus Remover is the best solution I found.

A 100% free simple application.

You can download it from this link - Shortcut Virus Remover

Place it in your pen drive and double click to run.
Press Enter to confirm its process.
That is all.

Shortcuts will remove and your data will be back in a second.

I don't think that command prompt can delete the virus. You better use the anti-virus for pc called Quick Heal. It supports scanning mobile phones. And if you don't have a pc then give the phone to the Service center of the company.

Use command prompt ! Detailed guide here ! http://www.ehow.com/how_5937471_format-usb-flash-drive-dos.html

Please follow these steps to Remove Virus using Command Promt:

Click the "Start" menu and type "CMD" into the "Run" box and click "OK."

Select the drive that is infected with the virus. If you are not sure which drive is infected, start with the "C:" drive. Type in "C:" and press "Enter" to access this drive.

Type the following into the command prompt box: - s - h *. * /s /d and press "Enter." This will bring up any suspicious files located on the drive. Open the suspicious file.

Look for a file that contains a ".exe" file and a file titled "autorun.inf." If you find these two files, you have found the tainted file. Make sure to write down the name of the program where the file is located.

Rename the "autorun.inf" so you can access the drive later without activating the virus. Type: rename autorun.inf as virusfile and close out of the "Command" prompt box.

Double-click the "My Computer" icon and select the drive that has the infected file. Find the program that contains the infected file.

Right-click on the program and choose "Open."

Right-click on the file you renamed "virusfile" and choose "Delete."

Right-click on the ".exe" file and choose "Delete." You have now removed the virus from your computer's hard drive.

How to remove the virus:
first download taskiller in here or here and install it to your computer because you can’t use task manager to terminate the virus(the virus automatically close task manager).

run taskiller and left click it on the system tray(the one with a skull icon)
click processes
to close the virus, select process and click yes to the question
(process to close)

1. killer.exe
2. lsass.exe
3. smss.exe

note: close only file that have the same icon of Funny UST Scandal.avi.exe
CMD STEPS

1. now, click “start” then “run”
2. type “cmd” without quotes
3. type “cd\” without quotes
4. type “attrib -h -s smss.exe” without quotes
5. type “attrib -h -s autorun.inf” without quotes
6. type “start c:” without quotes (a new window will open)
7. select smss.exe, autorun.inf, Funny UST Scandal.avi.exe and delete it

If theres any drive or a partition type “d:” in command prompt without quotes “d” is the drive letter then repeat the CMD STEPS number 4-7 above…….

• now type this on the command prompt “cd windows” without quotes.
• type “attrib -h -s smss.exe” (without quotes)
• type “start c:\windows” (without quotes)
• delete the file smss.exe
• now, goto c:\documents and settings\all users\startmenu\programs\startup
• delete lsass.exe

click “start” then “run”
type “regedit” without quotes then delete the registry entries above….
“VIRUS REMOVE”
Or just simply download this UST VIRUS REMOVER (not tested)

Use sav32cli and scan your pc in command prompt.

http://www.sophos.com/support/disinfection/pedis.html

1. Download an emergency copy of SAV32CLI. On an uninfected Windows computer, run this file to extract the contents into a SAV32CLI folder on a medium that can be write-protected. Copy the SAV32CLI folder produced onto a medium that can be write-protected. Add any relevant IDEs to this folder and write-protect the disk (on a CD/R or CD/RW close the session).
2. Restart the computer in Safe Mode with command prompt.
3. At the infected computer, place the CD in the CD drive (D: in this example). At the command prompt type
   D:
   to access the CD drive. Type:
   CD SAV32CLI
   Then type:
   SAV32CLI -DI -P=C:\LOGFILE.TXT
   to disinfect the virus.
   All other files must be deleted. Some of these were dropped by the virus and need not be restored. Others should be recovered from backups.
   SAV32CLI -REMOVE -P=C:\REMOVLOG.TXT
   This command writes a report to the root of the C: drive. This report can be used to check which deleted files should be restored from backups.
   In Windows 2000/XP/2003/Vista, when disinfection and deletion have finished, restart the computer in Windows.
   Install or reinstall Sophos Anti-Virus then run an 'All files' scan to check that the virus has gone.
   
4. Before leaving Safe Mode, check any registry entries mentioned in the virus analysis recovery instructions, and edit them if necessary. If problems persist, contact support.

If it truly is a virus I suggest you first look for and purchase CA(Computer Associates) Internet Security Suite 2008 and run the Anti-Virus to check for viruses.

Second I would then make absolutly sure that those files are indeed not being used [Try to delete one; does it let you?]

If it does I would then go into the command prompt by this method.
Start > Run > cmd.exe
then type this command[Note unless you are positively sure those files arent important and they are taking up alot of space I would not use this command. If the above is true execute this command:
del C:\Windows\Temp\*.tmp

Again please make sure these files are not important lest you mess up your pc with that command!