Does anyone know what Zshutdown is?

Discussion in 'other security issues & news' started by Seishin, Aug 6, 2006.

Thread Status:
Not open for further replies.
  1. Seishin

    Seishin Registered Member

    Joined:
    Aug 2, 2006
    Posts:
    204
    I did a generalised search for this "thing" and it seems to be completely unknown. I have noticed that there are a number of users who show it in their Hijackthis logs.

    It is only shown as a startup entry but it doesn't carry a file along.

    My Hijacklog detects it under the following entry:

    O4 - HKLM\..\Run: [Zshutdown] c:\sysprep\patch\sysprep.cmd

    Does anyone know what the heck it is?


    Cheers.
     
  2. Tommy

    Tommy Registered Member

    Joined:
    Dec 24, 2002
    Posts:
    1,169
    Location:
    Buenos Aires - Munic
    If i remember well this command is used to shutdown machines and see if there's proper notification.
     
  3. Seishin

    Seishin Registered Member

    Joined:
    Aug 2, 2006
    Posts:
    204
    Correct if I'm wrong but never seen this before in HKLM-Software-M$-Windows-CurrentVersion-Run

    So, can I disable it at startup/kill it?

    Cheers.
     
  4. Tommy

    Tommy Registered Member

    Joined:
    Dec 24, 2002
    Posts:
    1,169
    Location:
    Buenos Aires - Munic
    I realy don't know so it is a comand some aplications need for installing new patches. I don't know what soft you are using.
    Give it a try, but export/backup this registry entry before deleting it.
     
  5. Seishin

    Seishin Registered Member

    Joined:
    Aug 2, 2006
    Posts:
    204
    Thx mate. I'll try that.

    :)
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.