ipconfig and shutdown

Discussion in 'Computer Support' started by a_mcbride, Aug 16, 2004.

  1. a_mcbride

    a_mcbride Guest

    When I shut down my system (XP home) a window appears telling me that ip configs.exe - dll
    initialization failed .

    It says this application failed to initialize because the window station is shutting down.

    The system then eventually closes. Any one know how to prevent this window from appearing?
    Its would seem that ipconfig is running in the background when I try to shut down but I
    don`t seem to be able to prevent it running, tried to restore to earlier date with the
    same problem.

    Andrew
     
    a_mcbride, Aug 16, 2004
    #1
    1. Advertisements

  2. a_mcbride

    Dean C Guest

    Seems like there's a clever trojan here. It gives you the impression
    ipconfig is running as a process when it doesn't in real life. Refer
    to this URL for a description:

    http://www.sophos.com/virusinfo/analyses/trojagentao.html

    From the site:

    Troj/Agent-AO is a trojan downloader which will initiate itself as a
    background process and NT service under the name "IPConfig". The 2
    threads will then monitor each other and regenerate any stopped
    service/registry key when necessary.
    It will also attempt to connect to an specific IRC channel, which will
    then provide a URL address for downloading further components and
    executing them.
    The Trojan will attempt to install itself in:
    <System32>\ipconfigs.exe

    It will also create the following autostart key:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
    IPConfig = ipconfigs.exe
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
     
    Dean C, Aug 16, 2004
    #2
    1. Advertisements

  3. a_mcbride

    a_mcbride Guest

    Thanks for that Dean that seems to be the problem and the cure. So far deleted the items
    in the register just got to go to safe mode now and scan with anti virus and a trojan
    remover.

    Thanks again

    Andrew
     
    a_mcbride, Aug 16, 2004
    #3
  4. a_mcbride

    Dean C Guest

    Andrew,

    Hope it works out.

    Bye,

    Dean

     
    Dean C, Aug 17, 2004
    #4
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.