Does anyone know what Zshutdown is?

Discussion in 'other security issues & news' started by Seishin, Aug 6, 2006.

Thread Status:
Not open for further replies.
  1. Seishin

    Seishin Registered Member

    Joined:
    Aug 2, 2006
    Posts:
    204
    I did a generalised search for this "thing" and it seems to be completely unknown. I have noticed that there are a number of users who show it in their Hijackthis logs.

    It is only shown as a startup entry but it doesn't carry a file along.

    My Hijacklog detects it under the following entry:

    O4 - HKLM\..\Run: [Zshutdown] c:\sysprep\patch\sysprep.cmd

    Does anyone know what the heck it is?


    Cheers.
     
  2. Tommy

    Tommy Registered Member

    Joined:
    Dec 24, 2002
    Posts:
    1,169
    Location:
    Buenos Aires - Munic
    If i remember well this command is used to shutdown machines and see if there's proper notification.
     
  3. Seishin

    Seishin Registered Member

    Joined:
    Aug 2, 2006
    Posts:
    204
    Correct if I'm wrong but never seen this before in HKLM-Software-M$-Windows-CurrentVersion-Run

    So, can I disable it at startup/kill it?

    Cheers.
     
  4. Tommy

    Tommy Registered Member

    Joined:
    Dec 24, 2002
    Posts:
    1,169
    Location:
    Buenos Aires - Munic
    I realy don't know so it is a comand some aplications need for installing new patches. I don't know what soft you are using.
    Give it a try, but export/backup this registry entry before deleting it.
     
  5. Seishin

    Seishin Registered Member

    Joined:
    Aug 2, 2006
    Posts:
    204
    Thx mate. I'll try that.

    :)
     
Loading...
Thread Status:
Not open for further replies.