The "password_viewer.exe" virus executes during startup and cannot be easily disabled from the task manager. It shuts down your computer thru a batch file named "pc-off.bat". Surprisingly, this virus cannot be removed by known anti-malware programs but can be easily removed if done carefully on a manual way.
Here's how:
1. Turn off 'System Restore'.
Right click 'My Computer', click 'Properties', click the 'System Restore' tab, mark/check "Turn off System Restore on all drives", click Ok.
Here's how:
1. Turn off 'System Restore'.
Right click 'My Computer', click 'Properties', click the 'System Restore' tab, mark/check "Turn off System Restore on all drives", click Ok.
2. Restart computer in "Safe Mode" (press F2 or equivalent before the Windows bootup screen appears).
3. Now go to 'My Computer'. At the Menu bar click 'Tools', click 'Folder Options', click the 'View' tab. Scroll down and mark "Show hidden files and folders", uncheck both "Hide extensions for known file types" and "Hide protected operating system files", if a prompt appears click 'Yes', and then click 'Apply' and 'Ok' to close.
4. Open your system drive (usually drive C:), open 'Windows', scroll down, look for and delete the following files:
password_viewer.exe
pc-off.bat
- if a prompt appears each instance, click "Delete All".
5. Click the 'Back' button then go back to 'Tools', click 'Folder Options', click the 'View' tab. Scroll down and mark "Do not show hidden files and folders", check both "Hide extensions for known file types" and "Hide protected operating system files" and then click 'Apply' and 'Ok' to close.
6. Restart your computer to normal mode and turn on System Restore back by right clicking 'My Computer', click 'Properties', click the 'System Restore' tab, unmark/uncheck "Turn off System Restore on all drives", click ok.
You can check if the virus is still there by opening the Task Manager/Processes then look for password_viewer.exe. If its not there, you just had a successful virus removal. To test to make sure your computer doesn't shutdown when executing the Command Prompt, go to Start/Run and type cmd.
Good luck!
3. Now go to 'My Computer'. At the Menu bar click 'Tools', click 'Folder Options', click the 'View' tab. Scroll down and mark "Show hidden files and folders", uncheck both "Hide extensions for known file types" and "Hide protected operating system files", if a prompt appears click 'Yes', and then click 'Apply' and 'Ok' to close.
4. Open your system drive (usually drive C:), open 'Windows', scroll down, look for and delete the following files:
password_viewer.exe
pc-off.bat
- if a prompt appears each instance, click "Delete All".
5. Click the 'Back' button then go back to 'Tools', click 'Folder Options', click the 'View' tab. Scroll down and mark "Do not show hidden files and folders", check both "Hide extensions for known file types" and "Hide protected operating system files" and then click 'Apply' and 'Ok' to close.
6. Restart your computer to normal mode and turn on System Restore back by right clicking 'My Computer', click 'Properties', click the 'System Restore' tab, unmark/uncheck "Turn off System Restore on all drives", click ok.
You can check if the virus is still there by opening the Task Manager/Processes then look for password_viewer.exe. If its not there, you just had a successful virus removal. To test to make sure your computer doesn't shutdown when executing the Command Prompt, go to Start/Run and type cmd.
Good luck!