Virus - Logoff XP

[spools.exe]

I would like to point out how a virus can actually make you run a file. Logoff.exe is executed when you logoff your computer. Logoff.exe can only be found in windows XP. This file cannot be edited unless in safe mode. When in safe mode a user can replace logoff.exe with any fie of their choice. This can also be done virii themselves.

The reason i posted this is because i was reading about how some people would get a message from Norton everytime they attempted to logoff. The reason, mostlikely, is because your logoff.exe file has been replaces with a virus. If you have a windows XP disk, then you should be able to find a fresh copy of Logoff.exe on it. I belive the file might be called CAB1.

The file is located at C:\WINDOWS\system32\logoff.exe
Located in the same DIR is also a file called Shutdown.exe

NOTE: This is just from what i have read, I havent Tried to edit the logoff.exe file because i don't have winndows XP. If there is not truth to this please tell me.

I also understand that this is probably know to most XP users but i thought i would put it just in case someone didn't.

[neta1o]

I frequently read up on viruses and I haven't heard of this before. Although I found a good article discussing the topic.
article

edit: and article 2

-neta1o-

[spools.exe]

thats, correct, i forgot to mention that websites can also make those files run and shutdown your computer. this is not really a security rish but it does get very annoying

[nihil]

That explains a few practical problems that turned out as viruses. Not many have XP round here so it is a little rare.

Many thanks

Cheers

[rapier57]

Yes, this was addressed many patches ago. Just a reminder to keep your system up to date.

[spools.exe]

Everyone that has XP probably knows this but i'll post it anyway.

Shutdown & Restart Shortcuts for Windows XP & Windows 2000

Windows 2000 (with the Resource Kit installed) and Windows XP (natively) have an actual shutdown command that can be launched from a command prompt — and which, therefore, also can be launched from a shortcut. To see all available options for this command, click Start, click Run, and type:

SHUTDOWN /?
You can also study the available options in the Microsoft KB 317371, “How to Use the Remote Shutdown Tool to Shut Down and Restart a Computer in Windows 2000.” (The article is basically suitable for Win XP also.)

This command starts a 30-second countdown for a shutdown or restart, which permits you to abort it (with a shutdown -a command). It you want the command to execute, use the -t flag, which lets you set the time lapse in seconds. The examples below use a 1-second delay.

For a shortcut to RESTART Windows XP:
SHUTDOWN -r -t 01

For a shortcut to SHUT DOWN Windows XP:
SHUTDOWN -s -t 01


Source(http://aumha.org/win5/a/shutcut.htm)

[deftones12]

wow...good info. Anyone could just make a lil script to have one of those 2 programs run at the quarter of every hour or every half hour or randomly and have it restart or logoff or shutdown. Norton or McAfee wouldnt detect it i dont think just because its not a popular virus or real well known. Interesting...thanx for the read.

[WishMaster]

wow never knew that I will pass this on to other people I am sure they will be glad to be aware of this.