Task Manager wont respond

  • Thread starter Thread starter alan b
  • Start date Start date
A

alan b

I made posting earlier about two hours ago and it was never posted at this
newsgroup. The problem is I am not able to run Task Manager by clicking on
the bottom bar. It closed abruptly after opening it. I have not able to put
it to use.

I tried other way by going to Command Prompt. I opened Windows and looked
for taskman. exe. I tried to run it, but it closed abruptly.

Can someoby solve this dileema?
 
-----Original Message-----
I made posting earlier about two hours ago and it was never posted at this
newsgroup. The problem is I am not able to run Task Manager by clicking on
the bottom bar. It closed abruptly after opening it. I have not able to put
it to use.

I tried other way by going to Command Prompt. I opened Windows and looked
for taskman. exe. I tried to run it, but it closed abruptly.


Hi!
Visit http://www.kellys-korner-xp.com/xp t.htm and scroll
down to the
topic titled "Task Manager - Control/Alt/Delete - Doesn't
Work"

[Courtesy of Kelly Theriot, MS-MVP]

regards/
ssg/pronetworks.org
 
Greetings --

And the answers remain the same, this time, as they were for your
last post.

The behavior you've described is typical behavior of more than one
virus/worm, the three below being the most common:

W32.Klez
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

W32.Yaha
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

W32.Spybot.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
Greetings..
How do I solve this from one of three links below? I think it requires
purcdhasing Symantec product, first. Please correct me. I already
purchased AVG from grisoft. It does not solve this problem.
 
How do I run updated scan? My xp does not have any virus scan. I already
have AVG from Grisoft. the avg does not solve the problem. I am still
having TASK MANAGER virus. Please explain more.
 
Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
 
PS I gave you another link with grisoft for free 30 day Nortons. Whereever
that post is have another look.
 
I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 20 K
System 4 Console 0 220 K
SMSS.EXE 432 Console 0 464 K
CSRSS.EXE 488 Console 0 4,540 K
WINLOGON.EXE 512 Console 0 2,336 K
SERVICES.EXE 556 Console 0 3,252 K
LSASS.EXE 568 Console 0 1,756 K
SVCHOST.EXE 724 Console 0 3,168 K
SVCHOST.EXE 776 Console 0 17,420 K
SVCHOST.EXE 900 Console 0 2,232 K
SVCHOST.EXE 932 Console 0 3,816 K
SPOOLSV.EXE 1124 Console 0 4,364 K
avgamsvr.exe 1320 Console 0 6,000 K
avgupsvc.exe 1336 Console 0 2,144 K
INETINFO.EXE 1368 Console 0 10,084 K
MDM.EXE 1400 Console 0 3,020 K
NBTHLP.EXE 1412 Console 0 4,788 K
NVSVC32.EXE 1584 Console 0 2,588 K
POP3 Uniserver.exe 1624 Console 0 5,132 K
SVCHOST.EXE 1696 Console 0 3,588 K
EXPLORER.EXE 480 Console 0 35,804 K
DAP.EXE 768 Console 0 8,412 K
QTTASK.EXE 844 Console 0 6,880 K
JDRMCYK.EXE 908 Console 0 3,524 K
MSDM.EXE 976 Console 0 7,172 K
AIM.EXE 912 Console 0 1,192 K
avgcc.exe 1020 Console 0 7,020 K
avgemc.exe 1064 Console 0 8,616 K
AIM.EXE 1208 Console 0 23,772 K
MSNMSGR.EXE 1220 Console 0 7,232 K
CTFMON.EXE 1244 Console 0 3,272 K
RUNDLL32.EXE 1348 Console 0 2,764 K
Weather.exe 1576 Console 0 13,360 K
libupdate32.exe 1668 Console 0 6,360 K
POPMENU.EXE 1716 Console 0 4,464 K
SQLMANGR.EXE 2316 Console 0 5,532 K
WZQKPICK.EXE 2504 Console 0 3,404 K
WinKill.exe 2540 Console 0 5,936 K
MSIMN.EXE 2728 Console 0 32,188 K
cmd.exe 3400 Console 0 1,512 K
cmd.exe 3412 Console 0 1,540 K
tasklist.exe 3420 Console 0 3,412 K
wmiprvse.exe 3460 Console 0 4,392 K
 
Greetings --

No. you don't necessarily have to purchase anything. Simply
follow Symantec's removal instructions for whichever virus your
antivirus detects. Additionally, you can try using one or more of
these free on-line virus scanners:


Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/

McAfee Security - FreeScan
http://www.mcafee.com/myapps/mfs/default.asp

Symantec Security Check
http://security.symantec.com/ssc/home.asp


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume you are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what ones you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 20 K
System 4 Console 0 220 K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0 10,084 K
NBTHLP.EXE 1412 Console 0 4,788 K
NVSVC32.EXE 1584 Console 0 2,588 K
POP3 Uniserver.exe 1624 Console 0 5,132 K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0 8,412 K
JDRMCYK.EXE 908 Console 0 3,524 K
MSDM.EXE 976 Console 0 7,172 K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0 2,764 K
Weather.exe 1576 Console 0 13,360 K
libupdate32.exe 1668 Console 0 6,360 K
POPMENU.EXE 1716 Console 0 4,464 K
SQLMANGR.EXE 2316 Console 0 5,532 K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0 3,404 K
WinKill.exe 2540 Console 0 5,936 K
 
You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume you are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what ones you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 20 K
System 4 Console 0 220 K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0 10,084 K
NBTHLP.EXE 1412 Console 0 4,788 K
NVSVC32.EXE 1584 Console 0 2,588 K
POP3 Uniserver.exe 1624 Console 0 5,132 K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0 8,412 K
JDRMCYK.EXE 908 Console 0 3,524 K
MSDM.EXE 976 Console 0 7,172 K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0 2,764 K
Weather.exe 1576 Console 0 13,360 K
libupdate32.exe 1668 Console 0 6,360 K
POPMENU.EXE 1716 Console 0 4,464 K
SQLMANGR.EXE 2316 Console 0 5,532 K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0 3,404 K
WinKill.exe 2540 Console 0 5,936 K
 
You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume you are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what ones you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 20 K
System 4 Console 0 220 K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0 10,084 K
NBTHLP.EXE 1412 Console 0 4,788 K
NVSVC32.EXE 1584 Console 0 2,588 K
POP3 Uniserver.exe 1624 Console 0 5,132 K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0 8,412 K
JDRMCYK.EXE 908 Console 0 3,524 K
MSDM.EXE 976 Console 0 7,172 K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0 2,764 K
Weather.exe 1576 Console 0 13,360 K
libupdate32.exe 1668 Console 0 6,360 K
POPMENU.EXE 1716 Console 0 4,464 K
SQLMANGR.EXE 2316 Console 0 5,532 K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0 3,404 K
WinKill.exe 2540 Console 0 5,936 K
 
Object not found!
The requested URL was not found on this server. If you entered the URL
manually please check your spelling and try again.
If you think this is a server error, please contact the webmaster
Error 404

what next? thanks ..bits of info.. My computer>properties> system restore
are currently OFF. Affect on it?
www.kellys-korner-xp.com
Fri 03 Oct 2003 06:29:31 PM CDT
Apache/2.0.40 (Red Hat Linux)
S.Sengupta said:
-----Original Message-----
I made posting earlier about two hours ago and it was never posted at this
newsgroup. The problem is I am not able to run Task Manager by clicking on
the bottom bar. It closed abruptly after opening it. I have not able to put
it to use.

I tried other way by going to Command Prompt. I opened Windows and looked
for taskman. exe. I tried to run it, but it closed abruptly.


Hi!
Visit http://www.kellys-korner-xp.com/xp t.htm and scroll
down to the
topic titled "Task Manager - Control/Alt/Delete - Doesn't
Work"

[Courtesy of Kelly Theriot, MS-MVP]

regards/
ssg/pronetworks.org
Can someoby solve this dileema?

--

alan


.
 
David,

yes i tried to run pop3 mail server long time ago. (5 to 7 months ago) I no
longer need it. WinKill is a pop up killer utility. I no longer use it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever since.

You notice things dont look right to you. I am real still at novice stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft product at
all. I tried to delete it, but it is access denied, tho i unchecked its
archive properties. What should I do ? i vaguely remember about attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
cmd /c taskkill /im JDRMCYK.EXE /f /t

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been terminated.

I want to delete the files that dont look right. but it is access denied.

thanks for the reply...
C:\>

David Candy said:
You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume you are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what ones you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 20 K
System 4 Console 0 220 K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0 10,084 K
NBTHLP.EXE 1412 Console 0 4,788 K
NVSVC32.EXE 1584 Console 0 2,588 K
POP3 Uniserver.exe 1624 Console 0 5,132 K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0 8,412 K
JDRMCYK.EXE 908 Console 0 3,524 K
MSDM.EXE 976 Console 0 7,172 K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0 2,764 K
Weather.exe 1576 Console 0 13,360 K
libupdate32.exe 1668 Console 0 6,360 K
POPMENU.EXE 1716 Console 0 4,464 K
SQLMANGR.EXE 2316 Console 0 5,532 K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0 3,404 K
WinKill.exe 2540 Console 0 5,936 K

alan b said:
I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 20 K
System 4 Console 0 220 K
SMSS.EXE 432 Console 0 464 K
CSRSS.EXE 488 Console 0 4,540 K
WINLOGON.EXE 512 Console 0 2,336 K
SERVICES.EXE 556 Console 0 3,252 K
LSASS.EXE 568 Console 0 1,756 K
SVCHOST.EXE 724 Console 0 3,168 K
SVCHOST.EXE 776 Console 0 17,420 K
SVCHOST.EXE 900 Console 0 2,232 K
SVCHOST.EXE 932 Console 0 3,816 K
SPOOLSV.EXE 1124 Console 0 4,364 K
avgamsvr.exe 1320 Console 0 6,000 K
avgupsvc.exe 1336 Console 0 2,144 K
INETINFO.EXE 1368 Console 0 10,084 K
MDM.EXE 1400 Console 0 3,020 K
NBTHLP.EXE 1412 Console 0 4,788 K
NVSVC32.EXE 1584 Console 0 2,588 K
POP3 Uniserver.exe 1624 Console 0 5,132 K
SVCHOST.EXE 1696 Console 0 3,588 K
EXPLORER.EXE 480 Console 0 35,804 K
DAP.EXE 768 Console 0 8,412 K
QTTASK.EXE 844 Console 0 6,880 K
JDRMCYK.EXE 908 Console 0 3,524 K
MSDM.EXE 976 Console 0 7,172 K
AIM.EXE 912 Console 0 1,192 K
avgcc.exe 1020 Console 0 7,020 K
avgemc.exe 1064 Console 0 8,616 K
AIM.EXE 1208 Console 0 23,772 K
MSNMSGR.EXE 1220 Console 0 7,232 K
CTFMON.EXE 1244 Console 0 3,272 K
RUNDLL32.EXE 1348 Console 0 2,764 K
Weather.exe 1576 Console 0 13,360 K
libupdate32.exe 1668 Console 0 6,360 K
POPMENU.EXE 1716 Console 0 4,464 K
SQLMANGR.EXE 2316 Console 0 5,532 K
WZQKPICK.EXE 2504 Console 0 3,404 K
WinKill.exe 2540 Console 0 5,936 K
MSIMN.EXE 2728 Console 0 32,188 K
cmd.exe 3400 Console 0 1,512 K
cmd.exe 3412 Console 0 1,540 K
tasklist.exe 3420 Console 0 3,412 K
wmiprvse.exe 3460 Console 0 4,392 K


at
this clicking
able
 
I did type in HELP at Command Prompt and it lists attrib with its
subcommands. I tried attrib -r MSDM.exe.. but i still cannot delete it..
access denied. do you know of other solution etc?thanks
David Candy said:
You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume you are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what ones you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 20 K
System 4 Console 0 220 K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0 10,084 K
NBTHLP.EXE 1412 Console 0 4,788 K
NVSVC32.EXE 1584 Console 0 2,588 K
POP3 Uniserver.exe 1624 Console 0 5,132 K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0 8,412 K
JDRMCYK.EXE 908 Console 0 3,524 K
MSDM.EXE 976 Console 0 7,172 K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0 2,764 K
Weather.exe 1576 Console 0 13,360 K
libupdate32.exe 1668 Console 0 6,360 K
POPMENU.EXE 1716 Console 0 4,464 K
SQLMANGR.EXE 2316 Console 0 5,532 K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0 3,404 K
WinKill.exe 2540 Console 0 5,936 K

alan b said:
I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 20 K
System 4 Console 0 220 K
SMSS.EXE 432 Console 0 464 K
CSRSS.EXE 488 Console 0 4,540 K
WINLOGON.EXE 512 Console 0 2,336 K
SERVICES.EXE 556 Console 0 3,252 K
LSASS.EXE 568 Console 0 1,756 K
SVCHOST.EXE 724 Console 0 3,168 K
SVCHOST.EXE 776 Console 0 17,420 K
SVCHOST.EXE 900 Console 0 2,232 K
SVCHOST.EXE 932 Console 0 3,816 K
SPOOLSV.EXE 1124 Console 0 4,364 K
avgamsvr.exe 1320 Console 0 6,000 K
avgupsvc.exe 1336 Console 0 2,144 K
INETINFO.EXE 1368 Console 0 10,084 K
MDM.EXE 1400 Console 0 3,020 K
NBTHLP.EXE 1412 Console 0 4,788 K
NVSVC32.EXE 1584 Console 0 2,588 K
POP3 Uniserver.exe 1624 Console 0 5,132 K
SVCHOST.EXE 1696 Console 0 3,588 K
EXPLORER.EXE 480 Console 0 35,804 K
DAP.EXE 768 Console 0 8,412 K
QTTASK.EXE 844 Console 0 6,880 K
JDRMCYK.EXE 908 Console 0 3,524 K
MSDM.EXE 976 Console 0 7,172 K
AIM.EXE 912 Console 0 1,192 K
avgcc.exe 1020 Console 0 7,020 K
avgemc.exe 1064 Console 0 8,616 K
AIM.EXE 1208 Console 0 23,772 K
MSNMSGR.EXE 1220 Console 0 7,232 K
CTFMON.EXE 1244 Console 0 3,272 K
RUNDLL32.EXE 1348 Console 0 2,764 K
Weather.exe 1576 Console 0 13,360 K
libupdate32.exe 1668 Console 0 6,360 K
POPMENU.EXE 1716 Console 0 4,464 K
SQLMANGR.EXE 2316 Console 0 5,532 K
WZQKPICK.EXE 2504 Console 0 3,404 K
WinKill.exe 2540 Console 0 5,936 K
MSIMN.EXE 2728 Console 0 32,188 K
cmd.exe 3400 Console 0 1,512 K
cmd.exe 3412 Console 0 1,540 K
tasklist.exe 3420 Console 0 3,412 K
wmiprvse.exe 3460 Console 0 4,392 K


at
this clicking
able
 
To post that reply I spent 7:03 to 9:08 local time click Send/Recieve. I am
very angry at the moment.

You have to taskkill them before you can delete them. Now

a/ Reenable Windows Messenger Service. The problem is incorrect
configuration. The internet shouldn't be able to send it messages. But your
computer is treating the internet as a corporate network rather a dangerous
public network - cos XP is designed first and formost as a corporate
computer. I guess you setup the internet via a CD. When this happens the
firewall is not enabled - thus allowing people to send you messages and
virus to send themselves. The popup were a warning that you are wide open
and you did the equiv of taking aspirin for a brain tumor - it helps with
the pain but you still die. Type firewall in XP's Help and turn it on. It
will stop you getting viruses as well.

I know msdm is not an MS file but it may be another companies.

Go to Start - Control Panel - Add/Remove Programs and uninstall anything you
don't want or use.

Then search for those filenames, right click them, choose Properties and
read the version tab. This will help you to identify them, both by what
folder they are in and what the properties say about them.

You can only delete files that aren't running. So you must Taskkill them
before deleting
, so assume that msdm.exe is a virus type

cmd /c taskkill /im msdm.exe /f /t (or type cmd then taskkill /im msdm.exe
/f /t to keep the window open (up/down keys recall previous commands). Then
search for and delete it.

By now that JJJJJJXY file will have probably restarted. You may need to kill
it again.

Test after each taskkill if regedit/taskman can work.


alan b said:
David,

yes i tried to run pop3 mail server long time ago. (5 to 7 months ago) I no
longer need it. WinKill is a pop up killer utility. I no longer use it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever since.

You notice things dont look right to you. I am real still at novice stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft product at
all. I tried to delete it, but it is access denied, tho i unchecked its
archive properties. What should I do ? i vaguely remember about attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
cmd /c taskkill /im JDRMCYK.EXE /f /t

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been terminated.

I want to delete the files that dont look right. but it is access denied.

thanks for the reply...
C:\>

David Candy said:
You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume you are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what ones you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 20 K
System 4 Console 0 220 K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0 10,084 K
NBTHLP.EXE 1412 Console 0 4,788 K
NVSVC32.EXE 1584 Console 0 2,588 K
POP3 Uniserver.exe 1624 Console 0 5,132 K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0 8,412 K
JDRMCYK.EXE 908 Console 0 3,524 K
MSDM.EXE 976 Console 0 7,172 K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0 2,764 K
Weather.exe 1576 Console 0 13,360 K
libupdate32.exe 1668 Console 0 6,360 K
POPMENU.EXE 1716 Console 0 4,464 K
SQLMANGR.EXE 2316 Console 0 5,532 K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0 3,404 K
WinKill.exe 2540 Console 0 5,936 K

alan b said:
I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 20 K
System 4 Console 0 220 K
SMSS.EXE 432 Console 0 464 K
CSRSS.EXE 488 Console 0 4,540 K
WINLOGON.EXE 512 Console 0 2,336 K
SERVICES.EXE 556 Console 0 3,252 K
LSASS.EXE 568 Console 0 1,756 K
SVCHOST.EXE 724 Console 0 3,168 K
SVCHOST.EXE 776 Console 0 17,420 K
SVCHOST.EXE 900 Console 0 2,232 K
SVCHOST.EXE 932 Console 0 3,816 K
SPOOLSV.EXE 1124 Console 0 4,364 K
avgamsvr.exe 1320 Console 0 6,000 K
avgupsvc.exe 1336 Console 0 2,144 K
INETINFO.EXE 1368 Console 0 10,084 K
MDM.EXE 1400 Console 0 3,020 K
NBTHLP.EXE 1412 Console 0 4,788 K
NVSVC32.EXE 1584 Console 0 2,588 K
POP3 Uniserver.exe 1624 Console 0 5,132 K
SVCHOST.EXE 1696 Console 0 3,588 K
EXPLORER.EXE 480 Console 0 35,804 K
DAP.EXE 768 Console 0 8,412 K
QTTASK.EXE 844 Console 0 6,880 K
JDRMCYK.EXE 908 Console 0 3,524 K
MSDM.EXE 976 Console 0 7,172 K
AIM.EXE 912 Console 0 1,192 K
avgcc.exe 1020 Console 0 7,020 K
avgemc.exe 1064 Console 0 8,616 K
AIM.EXE 1208 Console 0 23,772 K
MSNMSGR.EXE 1220 Console 0 7,232 K
CTFMON.EXE 1244 Console 0 3,272 K
RUNDLL32.EXE 1348 Console 0 2,764 K
Weather.exe 1576 Console 0 13,360 K
libupdate32.exe 1668 Console 0 6,360 K
POPMENU.EXE 1716 Console 0 4,464 K
SQLMANGR.EXE 2316 Console 0 5,532 K
WZQKPICK.EXE 2504 Console 0 3,404 K
WinKill.exe 2540 Console 0 5,936 K
MSIMN.EXE 2728 Console 0 32,188 K
cmd.exe 3400 Console 0 1,512 K
cmd.exe 3412 Console 0 1,540 K
tasklist.exe 3420 Console 0 3,412 K
wmiprvse.exe 3460 Console 0 4,392 K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was never posted at
this
newsgroup. The problem is I am not able to run Task Manager by clicking
on
the bottom bar. It closed abruptly after opening it. I have not
able
to
put
it to use.

I tried other way by going to Command Prompt. I opened Windows and
looked
for taskman. exe. I tried to run it, but it closed abruptly.

Can someoby solve this dileema?
 
I am in a hurry to reply your note. It is apparent something to do with my
virus that caused you lots of trouble in replying to this note.

I need to explain why I turned off firewall. It is because if I leave it on,
I am not able to answer incoming video calls. I think I will turn firewall
back on! But it means no one can call me, but it will be healthy for my pc.
It is now in shoddy condition.

Now I am going to do all of your steps including TaskKill. And let you know
tmw. I apologize for the time you spent in trying to reply this post.

David Candy said:
To post that reply I spent 7:03 to 9:08 local time click Send/Recieve. I am
very angry at the moment.

You have to taskkill them before you can delete them. Now

a/ Reenable Windows Messenger Service. The problem is incorrect
configuration. The internet shouldn't be able to send it messages. But your
computer is treating the internet as a corporate network rather a dangerous
public network - cos XP is designed first and formost as a corporate
computer. I guess you setup the internet via a CD. When this happens the
firewall is not enabled - thus allowing people to send you messages and
virus to send themselves. The popup were a warning that you are wide open
and you did the equiv of taking aspirin for a brain tumor - it helps with
the pain but you still die. Type firewall in XP's Help and turn it on. It
will stop you getting viruses as well.

I know msdm is not an MS file but it may be another companies.

Go to Start - Control Panel - Add/Remove Programs and uninstall anything you
don't want or use.

Then search for those filenames, right click them, choose Properties and
read the version tab. This will help you to identify them, both by what
folder they are in and what the properties say about them.

You can only delete files that aren't running. So you must Taskkill them
before deleting
, so assume that msdm.exe is a virus type

cmd /c taskkill /im msdm.exe /f /t (or type cmd then taskkill /im msdm.exe
/f /t to keep the window open (up/down keys recall previous commands). Then
search for and delete it.

By now that JJJJJJXY file will have probably restarted. You may need to kill
it again.

Test after each taskkill if regedit/taskman can work.


alan b said:
David,

yes i tried to run pop3 mail server long time ago. (5 to 7 months ago) I no
longer need it. WinKill is a pop up killer utility. I no longer use it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever since.

You notice things dont look right to you. I am real still at novice stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft product at
all. I tried to delete it, but it is access denied, tho i unchecked its
archive properties. What should I do ? i vaguely remember about attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
cmd /c taskkill /im JDRMCYK.EXE /f /t

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been terminated.

I want to delete the files that dont look right. but it is access denied.

thanks for the reply...
C:\>

David Candy said:
You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume you are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what
ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 20 K
System 4 Console 0 220 K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0 10,084 K
NBTHLP.EXE 1412 Console 0 4,788 K
NVSVC32.EXE 1584 Console 0 2,588 K
POP3 Uniserver.exe 1624 Console 0 5,132 K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0 8,412 K
JDRMCYK.EXE 908 Console 0 3,524 K
MSDM.EXE 976 Console 0 7,172 K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0 2,764 K
Weather.exe 1576 Console 0 13,360 K
libupdate32.exe 1668 Console 0 6,360 K
POPMENU.EXE 1716 Console 0 4,464 K
SQLMANGR.EXE 2316 Console 0 5,532 K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0 3,404 K
WinKill.exe 2540 Console 0 5,936 K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0
20
220
464
4,540
2,336
3,252
1,756
3,168
17,420
2,232
3,816
4,364
6,000
2,144
10,084
3,020
4,788
2,588
5,132
3,588
35,804
8,412
6,880
3,524
7,172
1,192
7,020
8,616
23,772
7,232
3,272
2,764
13,360
6,360
4,464
5,532
3,404
5,936
32,188
1,512
1,540
3,412
4,392
K posted
at
 
I taskkill msdm.exe, but still cannot delete it. Access denied. I know you
have put all of your time this evening. I have to wait until tomorrow.
There must be a way to delete it. I know taskkill did nail it just for now.
David Candy said:
To post that reply I spent 7:03 to 9:08 local time click Send/Recieve. I am
very angry at the moment.

You have to taskkill them before you can delete them. Now

a/ Reenable Windows Messenger Service. The problem is incorrect
configuration. The internet shouldn't be able to send it messages. But your
computer is treating the internet as a corporate network rather a dangerous
public network - cos XP is designed first and formost as a corporate
computer. I guess you setup the internet via a CD. When this happens the
firewall is not enabled - thus allowing people to send you messages and
virus to send themselves. The popup were a warning that you are wide open
and you did the equiv of taking aspirin for a brain tumor - it helps with
the pain but you still die. Type firewall in XP's Help and turn it on. It
will stop you getting viruses as well.

I know msdm is not an MS file but it may be another companies.

Go to Start - Control Panel - Add/Remove Programs and uninstall anything you
don't want or use.

Then search for those filenames, right click them, choose Properties and
read the version tab. This will help you to identify them, both by what
folder they are in and what the properties say about them.

You can only delete files that aren't running. So you must Taskkill them
before deleting
, so assume that msdm.exe is a virus type

cmd /c taskkill /im msdm.exe /f /t (or type cmd then taskkill /im msdm.exe
/f /t to keep the window open (up/down keys recall previous commands). Then
search for and delete it.

By now that JJJJJJXY file will have probably restarted. You may need to kill
it again.

Test after each taskkill if regedit/taskman can work.


alan b said:
David,

yes i tried to run pop3 mail server long time ago. (5 to 7 months ago) I no
longer need it. WinKill is a pop up killer utility. I no longer use it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever since.

You notice things dont look right to you. I am real still at novice stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft product at
all. I tried to delete it, but it is access denied, tho i unchecked its
archive properties. What should I do ? i vaguely remember about attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
cmd /c taskkill /im JDRMCYK.EXE /f /t

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been terminated.

I want to delete the files that dont look right. but it is access denied.

thanks for the reply...
C:\>

David Candy said:
You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume you are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what
ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 20 K
System 4 Console 0 220 K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0 10,084 K
NBTHLP.EXE 1412 Console 0 4,788 K
NVSVC32.EXE 1584 Console 0 2,588 K
POP3 Uniserver.exe 1624 Console 0 5,132 K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0 8,412 K
JDRMCYK.EXE 908 Console 0 3,524 K
MSDM.EXE 976 Console 0 7,172 K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0 2,764 K
Weather.exe 1576 Console 0 13,360 K
libupdate32.exe 1668 Console 0 6,360 K
POPMENU.EXE 1716 Console 0 4,464 K
SQLMANGR.EXE 2316 Console 0 5,532 K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0 3,404 K
WinKill.exe 2540 Console 0 5,936 K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0
20
220
464
4,540
2,336
3,252
1,756
3,168
17,420
2,232
3,816
4,364
6,000
2,144
10,084
3,020
4,788
2,588
5,132
3,588
35,804
8,412
6,880
3,524
7,172
1,192
7,020
8,616
23,772
7,232
3,272
2,764
13,360
6,360
4,464
5,532
3,404
5,936
32,188
1,512
1,540
3,412
4,392
K posted
at
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads


Back
Top