Remote Shut Down

Today while in my webdesign class ( Don't laugh its an easy half credit ), I was working on my webpage when all of a sudden a box popped up and my computer shut down. All I saw when the box flashed was HAHAHAH and some other stuff. This first happen to me, then happen to a couple other people. I know who did it..but I don't know HOW they did it. I've searched google and didn't come up with anything. My school runs on Windows 2000 compters. Is there some sort of program he downloaded or something hidden in Windows? This has been bugging me for the entire day now, someone relieve me of my anguish.

There is a command-line utility you can use for this.

Try to start a command prompt and type 'shutdown.exe -?' this will give you a list of switches you can pass to the program (it also is a verification that you have the utility on your workstation). It is also possible to remotely shutdown a box with this utility, but I think it requires administrator privilegies but Im not 100% sure since I always have been administrator when using this utility :).

~micael

FamStars&Straps,

If not, the one that turned off your computer could have used a program to remotely control your pc (and he/she has deactivated the option to see him/her using your pc), or, if you tell me that you saw a box saying "HAHAHAH", then he/she could have used a trojan program, this is more sure for the box saying "HAHAHAH".

Bye.

Yup dark, it does sound like a trojan to me too based on the box with the "hahaha". It could also be a prog called LANGUARD for windows. Its a security testing utility that offers the option to send spoofed messages in a box with what ever text you want. It also offers a remote shutdown option and can also crack win9X/winme passwords. I suggest you tighten your security on your machine in all ways, from securing the OS by itself, then firewalls and antivirus. Very important is also to make regular backups of whatever is important. Makup a password policy like changing it every few weeks, use GOOD passwords, and try renaming any admin accounts (administrator) is a bad user name for the admin. I hope that it helps you what i have posted here.

Good luck.

FamStars&Straps

I would start to check if it's the command 'shutdown' they have used. It may be that some students with some computer knowledge has found out how to do this remotely or scheduled the command via Scheduler or 'At.exe' (AT scheduler) which is another quite useful tool.

But you should ofcourse also be aware that it may be a trojan or another tool they have used to make the computers reboot.

Example of use with shutdown.exe

Quote:

---

Local shutdown from command prompt in Windows XP

shutdown -s -t 05 -c "HAHAHA" -f

-s : shutdown.
-t xx : time in seconds.
-c "message here" : optional message (shows in a pop-up window).
-f : Force applications to shutdown.

---

Quote:

---

Remote shutdown from command prompt in Windows XP

shutdown -s -t 05 -c "HAHAHA" -f -m \\computername

-s : shutdown.
-t xx : time in seconds.
-c "message here" : optional message (shows in a pop-up window).
-f : Force applications to shutdown.
-m \\computername : Name of remote computer to shutdown

---

To abort a shutdown use the command 'shutdown -a' from a command prompt.

Quote:

---

HOW TO: Use the Remote Shutdown Tool in windows 2000

Shutdown.exe is available in the Microsoft Windows 2000 Resource Kit . It is a command-line tool that you can use to shut down or restart a local or remote computer that is running Windows 2000 or Windows NT 4.0. If you want to schedule a computer to shut down and restart at a specific time, use Shutdown.exe in combination with the at command or Task Scheduler.

---

~micael

Edit: The example in the first two quotes is for Windows XP pro and the link in the last quote leads to commands and information for Windows 2000

micael : i like that tool, but it didn't work with me
i'm running XP Pro, and as the link to MS site says , it's win2k command.

so , does it work for xp pro as well, or there's another format for it ?
pls. let me know.

appreciated

Very well micael. Good work. There is also an included programme on WinXP for all of these "remote" things. You can disable these services by going to the control panel and then administrative tool and services, then find "Remote..." and diable them. I have made a list of some service that you don't need i don't have it with me now, so you have to wait some time.

I don't think it was command line. This guy didn't have any special privlidges on the computers. And there is no way to get into command prompt on the school computers...I've tried...and tried...and tried...and tried..hehe. I'l sure it was a program that was already on all the computers because I remember the guy brought the program up on other peoples computers and showed them how to use it. Oh and the program couldn't have used DOS to run because theres a list of programs the computer lets run things in DOS and I don't think this is one on the list. Let me know what you guys think.

bimmer

Quote:

---

Originally posted here by bimmer
micael : i like that tool, but it didn't work with me
i'm running XP Pro, and as the link to MS site says , it's win2k command.

so , does it work for xp pro as well, or there's another format for it ?
pls. let me know.

appreciated

---

It should work if you have the tool in your computer.. Try to search for 'shutdown.exe' and launch it from the default location if it's in the computer.

The location in my computer is '%systemroot%\system32\' and the default permission allows a normal user to shutdown the computer with this tool. If it's in the computer but still does not work check up the permissions for the program and see if you are allowed to run it.

All Windows XP Pro installations I have done have included the 'shutdown.exe' command line tool and I dont know why it should be missing or not working in your computer ?

~micael

ii-monk : do u mean if i disable the remote thing in my administrative tools.
1- no one can shut my pc remotely.
or
2- i can't do any remote operation ?

THERE IS ANOTHER WAY..
If every student logs on as administrator with same username and password. You don’t need any third tools to reboot a computer on the network. YOU CAN SIMPLY REBOOT A W2K MACHINE ON THE NETWORK BY DOING THE FOLLOWING.

Right click on my computer->Manage->Right click computer management(local) and click connect to another computer->select the computer you want to reboot->right click properties->Advanced->Startup and Recovery->Shutdown->you’ll get options to log off the user or shutdown the system and much more

ok micael i've found it, under system32 as u told me.
but still don't know how to use it, or , i've tried to use it and it didn't work.

i'll read more about that in the MS XP support center.

thanks anyway, bimmer

There are many unknown variables with this situation, so I will take a best guess at this too.

I used to be responsible for a school lab and more times than not, command line attacks were uncommon. MANY of the attacks were done with NETBUS and other trojan programs.

Looking at this situation, your computer lab personnel now have to sanitize all the machines then lock them down (within reason) in order to cut down on this type of activity.