Task Manager wont respond

[alan b]

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 1716 child of PID 1504 has been terminated.

But I type in cmd /c taskkill /im JDRMCYK.EXE /f /t
AGAIN and it still displays SUCCESS: like above indicating it is still
there.
But SEARCH does not able to locate it.

DARN IT!!!

To post that reply I spent 7:03 to 9:08 local time click Send/Recieve. I am
very angry at the moment.

You have to taskkill them before you can delete them. Now

a/ Reenable Windows Messenger Service. The problem is incorrect
configuration. The internet shouldn't be able to send it messages. But your
computer is treating the internet as a corporate network rather a dangerous
public network - cos XP is designed first and formost as a corporate
computer. I guess you setup the internet via a CD. When this happens the
firewall is not enabled - thus allowing people to send you messages and
virus to send themselves. The popup were a warning that you are wide open
and you did the equiv of taking aspirin for a brain tumor - it helps with
the pain but you still die. Type firewall in XP's Help and turn it on. It
will stop you getting viruses as well.

I know msdm is not an MS file but it may be another companies.

Go to Start - Control Panel - Add/Remove Programs and uninstall anything you
don't want or use.

Then search for those filenames, right click them, choose Properties and
read the version tab. This will help you to identify them, both by what
folder they are in and what the properties say about them.

You can only delete files that aren't running. So you must Taskkill them
before deleting
, so assume that msdm.exe is a virus type

cmd /c taskkill /im msdm.exe /f /t (or type cmd then taskkill /im msdm.exe
/f /t to keep the window open (up/down keys recall previous commands). Then
search for and delete it.

By now that JJJJJJXY file will have probably restarted. You may need to kill
it again.

Test after each taskkill if regedit/taskman can work.

David,

yes i tried to run pop3 mail server long time ago. (5 to 7 months ago) I no
longer need it. WinKill is a pop up killer utility. I no longer use it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever since.

You notice things dont look right to you. I am real still at novice stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft product at
all. I tried to delete it, but it is access denied, tho i unchecked its
archive properties. What should I do ? i vaguely remember about attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
Microsoft Windows XP [Version 5.1.2600]

(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\alan>cd
C:\Documents and Settings\alan

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 1716 child of PID 1504 has been terminated.

But I type in cmd /c taskkill /im JDRMCYK.EXE /f /t
AGAIN and it still display SUCCESS: like above indicating it is still there.
But SEARCH does not able to locate it.

DARN IT!!!


C:\>> >

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been terminated.

I want to delete the files that dont look right. but it is access denied.

thanks for the reply...
C:\>

You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume you are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what

ones
you

know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 20 K
System 4 Console 0 220 K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0 10,084 K
NBTHLP.EXE 1412 Console 0 4,788 K
NVSVC32.EXE 1584 Console 0 2,588 K
POP3 Uniserver.exe 1624 Console 0 5,132 K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0 8,412 K
JDRMCYK.EXE 908 Console 0 3,524 K
MSDM.EXE 976 Console 0 7,172 K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0 2,764 K
Weather.exe 1576 Console 0 13,360 K
libupdate32.exe 1668 Console 0 6,360 K
POPMENU.EXE 1716 Console 0 4,464 K
SQLMANGR.EXE 2316 Console 0 5,532 K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0 3,404 K
WinKill.exe 2540 Console 0 5,936 K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0

20

K

220

K

464

K

4,540

K

2,336

K

3,252

K

1,756

K

3,168

K

17,420

K

2,232

K

3,816

K

4,364

K

6,000

K

2,144

K

10,084

K

3,020

K

4,788

K

2,588

K

5,132

K

3,588

K

35,804

K

8,412

K

6,880

K

3,524

K

7,172

K

1,192

K

7,020

K

8,616

K

23,772

K

7,232

K

3,272

K

2,764

K

13,360

K

6,360

K

4,464

K

5,532

K

3,404

K

5,936

K

32,188

K

1,512

K

1,540

K

3,412

K

4,392

K posted
at

 

[David Candy]

1. Problems were with MS servers. Not you. Been a week and it seems this was
in the final 2 hours of the problems.

2. Firewalls can be configured. What program are you using.

I am in a hurry to reply your note. It is apparent something to do with my
virus that caused you lots of trouble in replying to this note.

I need to explain why I turned off firewall. It is because if I leave it on,
I am not able to answer incoming video calls. I think I will turn firewall
back on! But it means no one can call me, but it will be healthy for my pc.
It is now in shoddy condition.

Now I am going to do all of your steps including TaskKill. And let you know
tmw. I apologize for the time you spent in trying to reply this post.

To post that reply I spent 7:03 to 9:08 local time click Send/Recieve. I am
very angry at the moment.

You have to taskkill them before you can delete them. Now

a/ Reenable Windows Messenger Service. The problem is incorrect
configuration. The internet shouldn't be able to send it messages. But your
computer is treating the internet as a corporate network rather a dangerous
public network - cos XP is designed first and formost as a corporate
computer. I guess you setup the internet via a CD. When this happens the
firewall is not enabled - thus allowing people to send you messages and
virus to send themselves. The popup were a warning that you are wide open
and you did the equiv of taking aspirin for a brain tumor - it helps with
the pain but you still die. Type firewall in XP's Help and turn it on. It
will stop you getting viruses as well.

I know msdm is not an MS file but it may be another companies.

Go to Start - Control Panel - Add/Remove Programs and uninstall anything you
don't want or use.

Then search for those filenames, right click them, choose Properties and
read the version tab. This will help you to identify them, both by what
folder they are in and what the properties say about them.

You can only delete files that aren't running. So you must Taskkill them
before deleting
, so assume that msdm.exe is a virus type

cmd /c taskkill /im msdm.exe /f /t (or type cmd then taskkill /im msdm.exe
/f /t to keep the window open (up/down keys recall previous commands). Then
search for and delete it.

By now that JJJJJJXY file will have probably restarted. You may need to kill
it again.

Test after each taskkill if regedit/taskman can work.


I
no product
at you
are

20

K

220

K

[Below is from IIS?]
INETINFO.EXE 1368 Console 0

10,084

K

4,788

K

2,588

K

5,132

K

[DAP sounds a bit suss?]
DAP.EXE 768 Console 0

8,412

K

3,524

K

7,172

K

[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0

2,764

K

13,360

K

6,360

K

4,464

K

5,532

K

[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0

3,404

K

5,936

K 20 220 464 4,540 2,336 3,252 1,756 3,168 17,420 2,232 3,816 4,364 6,000 2,144 10,084 3,020 4,788 2,588 5,132 3,588 35,804 8,412 6,880 3,524 7,172 1,192 7,020 8,616 23,772 7,232 3,272 2,764 13,360 6,360 4,464 5,532 3,404 5,936 32,188 1,512 1,540 3,412 4,392

 

[David Candy]

Type
effective file permissions
in help (this has a topic in Pro presume Home got a similar page)

It's either above or something is starting it (the other one) faster than
you cann type

If you can't get it you should be able to rename it. Then on next boot
because it's got a new name it doesn't get executed. (A running program exe
file becomes part of the swap file, however it can track name changes so
allows that)

I taskkill msdm.exe, but still cannot delete it. Access denied. I know you
have put all of your time this evening. I have to wait until tomorrow.
There must be a way to delete it. I know taskkill did nail it just for now.

To post that reply I spent 7:03 to 9:08 local time click Send/Recieve. I am
very angry at the moment.

You have to taskkill them before you can delete them. Now

a/ Reenable Windows Messenger Service. The problem is incorrect
configuration. The internet shouldn't be able to send it messages. But your
computer is treating the internet as a corporate network rather a dangerous
public network - cos XP is designed first and formost as a corporate
computer. I guess you setup the internet via a CD. When this happens the
firewall is not enabled - thus allowing people to send you messages and
virus to send themselves. The popup were a warning that you are wide open
and you did the equiv of taking aspirin for a brain tumor - it helps with
the pain but you still die. Type firewall in XP's Help and turn it on. It
will stop you getting viruses as well.

I know msdm is not an MS file but it may be another companies.

Go to Start - Control Panel - Add/Remove Programs and uninstall anything you
don't want or use.

Then search for those filenames, right click them, choose Properties and
read the version tab. This will help you to identify them, both by what
folder they are in and what the properties say about them.

You can only delete files that aren't running. So you must Taskkill them
before deleting
, so assume that msdm.exe is a virus type

cmd /c taskkill /im msdm.exe /f /t (or type cmd then taskkill /im msdm.exe
/f /t to keep the window open (up/down keys recall previous commands). Then
search for and delete it.

By now that JJJJJJXY file will have probably restarted. You may need to kill
it again.

Test after each taskkill if regedit/taskman can work.


I
no product
at you
are

20

K

220

K

[Below is from IIS?]
INETINFO.EXE 1368 Console 0

10,084

K

4,788

K

2,588

K

5,132

K

[DAP sounds a bit suss?]
DAP.EXE 768 Console 0

8,412

K

3,524

K

7,172

K

[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0

2,764

K

13,360

K

6,360

K

4,464

K

5,532

K

[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0

3,404

K

5,936

K 20 220 464 4,540 2,336 3,252 1,756 3,168 17,420 2,232 3,816 4,364 6,000 2,144 10,084 3,020 4,788 2,588 5,132 3,588 35,804 8,412 6,880 3,524 7,172 1,192 7,020 8,616 23,772 7,232 3,272 2,764 13,360 6,360 4,464 5,532 3,404 5,936 32,188 1,512 1,540 3,412 4,392

 

[David Candy]

Type
effective file permissions
in help (this has a topic in Pro presume Home got a similar page)

It's either above or something is starting it (the other one) faster than
you cann type

If you can't get it you should be able to rename it. Then on next boot
because it's got a new name it doesn't get executed. (A running program exe
file becomes part of the swap file, however it can track name changes so
allows that)

I taskkill msdm.exe, but still cannot delete it. Access denied. I know you
have put all of your time this evening. I have to wait until tomorrow.
There must be a way to delete it. I know taskkill did nail it just for now.

To post that reply I spent 7:03 to 9:08 local time click Send/Recieve. I am
very angry at the moment.

You have to taskkill them before you can delete them. Now

a/ Reenable Windows Messenger Service. The problem is incorrect
configuration. The internet shouldn't be able to send it messages. But your
computer is treating the internet as a corporate network rather a dangerous
public network - cos XP is designed first and formost as a corporate
computer. I guess you setup the internet via a CD. When this happens the
firewall is not enabled - thus allowing people to send you messages and
virus to send themselves. The popup were a warning that you are wide open
and you did the equiv of taking aspirin for a brain tumor - it helps with
the pain but you still die. Type firewall in XP's Help and turn it on. It
will stop you getting viruses as well.

I know msdm is not an MS file but it may be another companies.

Go to Start - Control Panel - Add/Remove Programs and uninstall anything you
don't want or use.

Then search for those filenames, right click them, choose Properties and
read the version tab. This will help you to identify them, both by what
folder they are in and what the properties say about them.

You can only delete files that aren't running. So you must Taskkill them
before deleting
, so assume that msdm.exe is a virus type

cmd /c taskkill /im msdm.exe /f /t (or type cmd then taskkill /im msdm.exe
/f /t to keep the window open (up/down keys recall previous commands). Then
search for and delete it.

By now that JJJJJJXY file will have probably restarted. You may need to kill
it again.

Test after each taskkill if regedit/taskman can work.


I
no product
at you
are

20

K

220

K

[Below is from IIS?]
INETINFO.EXE 1368 Console 0

10,084

K

4,788

K

2,588

K

5,132

K

[DAP sounds a bit suss?]
DAP.EXE 768 Console 0

8,412

K

3,524

K

7,172

K

[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0

2,764

K

13,360

K

6,360

K

4,464

K

5,532

K

[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0

3,404

K

5,936

K 20 220 464 4,540 2,336 3,252 1,756 3,168 17,420 2,232 3,816 4,364 6,000 2,144 10,084 3,020 4,788 2,588 5,132 3,588 35,804 8,412 6,880 3,524 7,172 1,192 7,020 8,616 23,772 7,232 3,272 2,764 13,360 6,360 4,464 5,532 3,404 5,936 32,188 1,512 1,540 3,412 4,392

 

[David Candy]

Type msinfo32 into Start Run

Software Evironment - Loaded Modules. This gives the path to the file.

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 1716 child of PID 1504 has been terminated.

But I type in cmd /c taskkill /im JDRMCYK.EXE /f /t
AGAIN and it still displays SUCCESS: like above indicating it is still
there.
But SEARCH does not able to locate it.

DARN IT!!!

To post that reply I spent 7:03 to 9:08 local time click Send/Recieve. I am
very angry at the moment.

You have to taskkill them before you can delete them. Now

a/ Reenable Windows Messenger Service. The problem is incorrect
configuration. The internet shouldn't be able to send it messages. But your
computer is treating the internet as a corporate network rather a dangerous
public network - cos XP is designed first and formost as a corporate
computer. I guess you setup the internet via a CD. When this happens the
firewall is not enabled - thus allowing people to send you messages and
virus to send themselves. The popup were a warning that you are wide open
and you did the equiv of taking aspirin for a brain tumor - it helps with
the pain but you still die. Type firewall in XP's Help and turn it on. It
will stop you getting viruses as well.

I know msdm is not an MS file but it may be another companies.

Go to Start - Control Panel - Add/Remove Programs and uninstall anything you
don't want or use.

Then search for those filenames, right click them, choose Properties and
read the version tab. This will help you to identify them, both by what
folder they are in and what the properties say about them.

You can only delete files that aren't running. So you must Taskkill them
before deleting
, so assume that msdm.exe is a virus type

cmd /c taskkill /im msdm.exe /f /t (or type cmd then taskkill /im msdm.exe
/f /t to keep the window open (up/down keys recall previous commands). Then
search for and delete it.

By now that JJJJJJXY file will have probably restarted. You may need to kill
it again.

Test after each taskkill if regedit/taskman can work.

David,

yes i tried to run pop3 mail server long time ago. (5 to 7 months ago)

I
no

longer need it. WinKill is a pop up killer utility. I no longer use it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever since.

You notice things dont look right to you. I am real still at novice stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft

product
at

all. I tried to delete it, but it is access denied, tho i unchecked its
archive properties. What should I do ? i vaguely remember about attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
Microsoft Windows XP [Version 5.1.2600]

(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\alan>cd
C:\Documents and Settings\alan

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 1716 child of PID 1504 has been terminated.

But I type in cmd /c taskkill /im JDRMCYK.EXE /f /t
AGAIN and it still display SUCCESS: like above indicating it is still there.
But SEARCH does not able to locate it.

DARN IT!!!


C:\>> >

you
are

20

K

220

K

[Below is from IIS?]
INETINFO.EXE 1368 Console 0

10,084

K

4,788

K

2,588

K

5,132

K

[DAP sounds a bit suss?]
DAP.EXE 768 Console 0

8,412

K

3,524

K

7,172

K

[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0

2,764

K

13,360

K

6,360

K

4,464

K

5,532

K

[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0

3,404

K

5,936

K 20 220 464 4,540 2,336 3,252 1,756 3,168 17,420 2,232 3,816 4,364 6,000 2,144 10,084 3,020 4,788 2,588 5,132 3,588 35,804 8,412 6,880 3,524 7,172 1,192 7,020 8,616 23,772 7,232 3,272 2,764 13,360 6,360 4,464 5,532 3,404 5,936 32,188 1,512 1,540 3,412 4,392

 

[alan b]

David,

thanks.. I will do that this weekend.
I really appreciate your help. JDMRCYK.EXE is the soul of the devil!
So far task Manger is able to open. Thanks for mentioning this devil's
name.

I am running AVG anti-virus in the background. I hope it is also considered
one of the scanners.

Type
effective file permissions
in help (this has a topic in Pro presume Home got a similar page)

It's either above or something is starting it (the other one) faster than
you cann type

If you can't get it you should be able to rename it. Then on next boot
because it's got a new name it doesn't get executed. (A running program exe
file becomes part of the swap file, however it can track name changes so
allows that)

I taskkill msdm.exe, but still cannot delete it. Access denied. I know you
have put all of your time this evening. I have to wait until tomorrow.
There must be a way to delete it. I know taskkill did nail it just for now.
I
am anything
you to
kill

ago)

I

no
longer need it. WinKill is a pop up killer utility. I no longer use it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever since.

You notice things dont look right to you. I am real still at novice stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft product
at
all. I tried to delete it, but it is access denied, tho i unchecked its
archive properties. What should I do ? i vaguely remember about attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
cmd /c taskkill /im JDRMCYK.EXE /f /t

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been terminated.

I want to delete the files that dont look right. but it is access denied.

thanks for the reply...
C:\>

You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume you
are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0

20

K
System 4 Console 0

220

K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0

10,084

K
NBTHLP.EXE 1412 Console 0

4,788

K
NVSVC32.EXE 1584 Console 0

2,588

K
POP3 Uniserver.exe 1624 Console 0

5,132

K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0

8,412

K
JDRMCYK.EXE 908 Console 0

3,524

K
MSDM.EXE 976 Console 0

7,172

K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0

2,764

K
Weather.exe 1576 Console 0

13,360

K
libupdate32.exe 1668 Console 0

6,360

K
POPMENU.EXE 1716 Console 0

4,464

K
SQLMANGR.EXE 2316 Console 0

5,532

K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0

3,404

K
WinKill.exe 2540 Console 0

5,936

K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0 20
K
System 4 Console 0 220
K
SMSS.EXE 432 Console 0 464
K
CSRSS.EXE 488 Console 0 4,540
K
WINLOGON.EXE 512 Console 0 2,336
K
SERVICES.EXE 556 Console 0 3,252
K
LSASS.EXE 568 Console 0 1,756
K
SVCHOST.EXE 724 Console 0 3,168
K
SVCHOST.EXE 776 Console 0 17,420
K
SVCHOST.EXE 900 Console 0 2,232
K
SVCHOST.EXE 932 Console 0 3,816
K
SPOOLSV.EXE 1124 Console 0 4,364
K
avgamsvr.exe 1320 Console 0 6,000
K
avgupsvc.exe 1336 Console 0 2,144
K
INETINFO.EXE 1368 Console 0 10,084
K
MDM.EXE 1400 Console 0 3,020
K
NBTHLP.EXE 1412 Console 0 4,788
K
NVSVC32.EXE 1584 Console 0 2,588
K
POP3 Uniserver.exe 1624 Console 0 5,132
K
SVCHOST.EXE 1696 Console 0 3,588
K
EXPLORER.EXE 480 Console 0 35,804
K
DAP.EXE 768 Console 0 8,412
K
QTTASK.EXE 844 Console 0 6,880
K
JDRMCYK.EXE 908 Console 0 3,524
K
MSDM.EXE 976 Console 0 7,172
K
AIM.EXE 912 Console 0 1,192
K
avgcc.exe 1020 Console 0 7,020
K
avgemc.exe 1064 Console 0 8,616
K
AIM.EXE 1208 Console 0 23,772
K
MSNMSGR.EXE 1220 Console 0 7,232
K
CTFMON.EXE 1244 Console 0 3,272
K
RUNDLL32.EXE 1348 Console 0 2,764
K
Weather.exe 1576 Console 0 13,360
K
libupdate32.exe 1668 Console 0 6,360
K
POPMENU.EXE 1716 Console 0 4,464
K
SQLMANGR.EXE 2316 Console 0 5,532
K
WZQKPICK.EXE 2504 Console 0 3,404
K
WinKill.exe 2540 Console 0 5,936
K
MSIMN.EXE 2728 Console 0 32,188
K
cmd.exe 3400 Console 0 1,512
K
cmd.exe 3412 Console 0 1,540
K
tasklist.exe 3420 Console 0 3,412
K
wmiprvse.exe 3460 Console 0 4,392
K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was never posted
at
this
newsgroup. The problem is I am not able to run Task Manager by
clicking
on
the bottom bar. It closed abruptly after opening it. I have not
able
to
put
it to use.

I tried other way by going to Command Prompt. I opened

Windows
and

looked
for taskman. exe. I tried to run it, but it closed abruptly.

Can someoby solve this dileema?

 

[alan b]

I just type msinfo32 and its Software Environment-Loaded Modules then it
displays a long, long list of loaded modules (pgms). I dont think it means
they are running programs like Task Manager. It may mean loaded somewhere
in RAM, but idle. It is still not clear.

Type msinfo32 into Start Run

Software Evironment - Loaded Modules. This gives the path to the file.

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 1716 child of PID 1504 has been terminated.

But I type in cmd /c taskkill /im JDRMCYK.EXE /f /t
AGAIN and it still displays SUCCESS: like above indicating it is still
there.
But SEARCH does not able to locate it.

DARN IT!!!

I
am anything
you to
kill

ago)

I

no
longer need it. WinKill is a pop up killer utility. I no longer use it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever since.

You notice things dont look right to you. I am real still at novice stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft product
at
all. I tried to delete it, but it is access denied, tho i unchecked its
archive properties. What should I do ? i vaguely remember about attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
Microsoft Windows XP [Version 5.1.2600]

(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\alan>cd
C:\Documents and Settings\alan

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 1716 child of PID 1504 has been terminated.

But I type in cmd /c taskkill /im JDRMCYK.EXE /f /t
AGAIN and it still display SUCCESS: like above indicating it is still there.
But SEARCH does not able to locate it.

DARN IT!!!


C:\>> >

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been terminated.

I want to delete the files that dont look right. but it is access denied.

thanks for the reply...
C:\>

You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume you
are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0

20

K
System 4 Console 0

220

K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0

10,084

K
NBTHLP.EXE 1412 Console 0

4,788

K
NVSVC32.EXE 1584 Console 0

2,588

K
POP3 Uniserver.exe 1624 Console 0

5,132

K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0

8,412

K
JDRMCYK.EXE 908 Console 0

3,524

K
MSDM.EXE 976 Console 0

7,172

K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0

2,764

K
Weather.exe 1576 Console 0

13,360

K
libupdate32.exe 1668 Console 0

6,360

K
POPMENU.EXE 1716 Console 0

4,464

K
SQLMANGR.EXE 2316 Console 0

5,532

K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0

3,404

K
WinKill.exe 2540 Console 0

5,936

K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0 20
K
System 4 Console 0 220
K
SMSS.EXE 432 Console 0 464
K
CSRSS.EXE 488 Console 0 4,540
K
WINLOGON.EXE 512 Console 0 2,336
K
SERVICES.EXE 556 Console 0 3,252
K
LSASS.EXE 568 Console 0 1,756
K
SVCHOST.EXE 724 Console 0 3,168
K
SVCHOST.EXE 776 Console 0 17,420
K
SVCHOST.EXE 900 Console 0 2,232
K
SVCHOST.EXE 932 Console 0 3,816
K
SPOOLSV.EXE 1124 Console 0 4,364
K
avgamsvr.exe 1320 Console 0 6,000
K
avgupsvc.exe 1336 Console 0 2,144
K
INETINFO.EXE 1368 Console 0 10,084
K
MDM.EXE 1400 Console 0 3,020
K
NBTHLP.EXE 1412 Console 0 4,788
K
NVSVC32.EXE 1584 Console 0 2,588
K
POP3 Uniserver.exe 1624 Console 0 5,132
K
SVCHOST.EXE 1696 Console 0 3,588
K
EXPLORER.EXE 480 Console 0 35,804
K
DAP.EXE 768 Console 0 8,412
K
QTTASK.EXE 844 Console 0 6,880
K
JDRMCYK.EXE 908 Console 0 3,524
K
MSDM.EXE 976 Console 0 7,172
K
AIM.EXE 912 Console 0 1,192
K
avgcc.exe 1020 Console 0 7,020
K
avgemc.exe 1064 Console 0 8,616
K
AIM.EXE 1208 Console 0 23,772
K
MSNMSGR.EXE 1220 Console 0 7,232
K
CTFMON.EXE 1244 Console 0 3,272
K
RUNDLL32.EXE 1348 Console 0 2,764
K
Weather.exe 1576 Console 0 13,360
K
libupdate32.exe 1668 Console 0 6,360
K
POPMENU.EXE 1716 Console 0 4,464
K
SQLMANGR.EXE 2316 Console 0 5,532
K
WZQKPICK.EXE 2504 Console 0 3,404
K
WinKill.exe 2540 Console 0 5,936
K
MSIMN.EXE 2728 Console 0 32,188
K
cmd.exe 3400 Console 0 1,512
K
cmd.exe 3412 Console 0 1,540
K
tasklist.exe 3420 Console 0 3,412
K
wmiprvse.exe 3460 Console 0 4,392
K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was never posted
at
this
newsgroup. The problem is I am not able to run Task Manager by
clicking
on
the bottom bar. It closed abruptly after opening it. I have not
able
to
put
it to use.

I tried other way by going to Command Prompt. I opened

Windows
and

looked
for taskman. exe. I tried to run it, but it closed abruptly.

Can someoby solve this dileema?

 

[David Candy]

It's sunday here by 1 hr. Rugby League Grand Final tonight, Rugby Union
World cup starts next week here. (Americans can track their team while it's
being eliminated at
http://rugbyheaven.smh.com.au/rwc2003/teams/usa/index.html - they're
amateurs up against professionals - they need your support).

Post back what happens.

David,

thanks.. I will do that this weekend.
I really appreciate your help. JDMRCYK.EXE is the soul of the devil!
So far task Manger is able to open. Thanks for mentioning this devil's
name.

I am running AVG anti-virus in the background. I hope it is also considered
one of the scanners.

Type
effective file permissions
in help (this has a topic in Pro presume Home got a similar page)

It's either above or something is starting it (the other one) faster than
you cann type

If you can't get it you should be able to rename it. Then on next boot
because it's got a new name it doesn't get executed. (A running program exe
file becomes part of the swap file, however it can track name changes so
allows that)

know
you

Send/Recieve.

I on.
It ago)

use

it

because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever since.

You notice things dont look right to you. I am real still at novice
stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft product
at
all. I tried to delete it, but it is access denied, tho i

unchecked
its

archive properties. What should I do ? i vaguely remember about
attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
cmd /c taskkill /im JDRMCYK.EXE /f /t

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been terminated.

I want to delete the files that dont look right. but it is access
denied.

thanks for the reply...
C:\>

You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter

(or
one

removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I

presume
you

are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what
ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0 20
K
System 4 Console 0 220
K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0 10,084
K
NBTHLP.EXE 1412 Console 0 4,788
K
NVSVC32.EXE 1584 Console 0 2,588
K
POP3 Uniserver.exe 1624 Console 0 5,132
K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0 8,412
K
JDRMCYK.EXE 908 Console 0 3,524
K
MSDM.EXE 976 Console 0 7,172
K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0 2,764
K
Weather.exe 1576 Console 0 13,360
K
libupdate32.exe 1668 Console 0 6,360
K
POPMENU.EXE 1716 Console 0 4,464
K
SQLMANGR.EXE 2316 Console 0 5,532
K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0 3,404
K
WinKill.exe 2540 Console 0 5,936
K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
SMSS.EXE 432 Console 0
464
K
CSRSS.EXE 488 Console 0
4,540
K
WINLOGON.EXE 512 Console 0
2,336
K
SERVICES.EXE 556 Console 0
3,252
K
LSASS.EXE 568 Console 0
1,756
K
SVCHOST.EXE 724 Console 0
3,168
K
SVCHOST.EXE 776 Console 0
17,420
K
SVCHOST.EXE 900 Console 0
2,232
K
SVCHOST.EXE 932 Console 0
3,816
K
SPOOLSV.EXE 1124 Console 0
4,364
K
avgamsvr.exe 1320 Console 0
6,000
K
avgupsvc.exe 1336 Console 0
2,144
K
INETINFO.EXE 1368 Console 0
10,084
K
MDM.EXE 1400 Console 0
3,020
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
SVCHOST.EXE 1696 Console 0
3,588
K
EXPLORER.EXE 480 Console 0
35,804
K
DAP.EXE 768 Console 0
8,412
K
QTTASK.EXE 844 Console 0
6,880
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
AIM.EXE 912 Console 0
1,192
K
avgcc.exe 1020 Console 0
7,020
K
avgemc.exe 1064 Console 0
8,616
K
AIM.EXE 1208 Console 0
23,772
K
MSNMSGR.EXE 1220 Console 0
7,232
K
CTFMON.EXE 1244 Console 0
3,272
K
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K
MSIMN.EXE 2728 Console 0
32,188
K
cmd.exe 3400 Console 0
1,512
K
cmd.exe 3412 Console 0
1,540
K
tasklist.exe 3420 Console 0
3,412
K
wmiprvse.exe 3460 Console 0
4,392
K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was never
posted
at
this
newsgroup. The problem is I am not able to run Task

Manager

by have
not

 

[alan b]

What a relief. MS servers are real slow the past two weeks! when I try to
look for the list of SDKs like OE for possible some programming.
I got word from other guy that there is no such OE programming in Inetsdk.

By the way, I just reconfigured firewall. It is Microsoft built in firewall.
It is in network connections>local connection>properties> advanced and put
check next to firewall. I hope it is what you want to know. I dont have
other firewalls.

1. Problems were with MS servers. Not you. Been a week and it seems this was
in the final 2 hours of the problems.

2. Firewalls can be configured. What program are you using.

I am in a hurry to reply your note. It is apparent something to do with my
virus that caused you lots of trouble in replying to this note.

I need to explain why I turned off firewall. It is because if I leave it on,
I am not able to answer incoming video calls. I think I will turn firewall
back on! But it means no one can call me, but it will be healthy for my pc.
It is now in shoddy condition.

Now I am going to do all of your steps including TaskKill. And let you know
tmw. I apologize for the time you spent in trying to reply this post.

I
am anything
you to
kill

ago)

I

no
longer need it. WinKill is a pop up killer utility. I no longer use it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever since.

You notice things dont look right to you. I am real still at novice stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft product
at
all. I tried to delete it, but it is access denied, tho i unchecked its
archive properties. What should I do ? i vaguely remember about attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
cmd /c taskkill /im JDRMCYK.EXE /f /t

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been terminated.

I want to delete the files that dont look right. but it is access denied.

thanks for the reply...
C:\>

You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume you
are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0

20

K
System 4 Console 0

220

K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0

10,084

K
NBTHLP.EXE 1412 Console 0

4,788

K
NVSVC32.EXE 1584 Console 0

2,588

K
POP3 Uniserver.exe 1624 Console 0

5,132

K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0

8,412

K
JDRMCYK.EXE 908 Console 0

3,524

K
MSDM.EXE 976 Console 0

7,172

K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0

2,764

K
Weather.exe 1576 Console 0

13,360

K
libupdate32.exe 1668 Console 0

6,360

K
POPMENU.EXE 1716 Console 0

4,464

K
SQLMANGR.EXE 2316 Console 0

5,532

K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0

3,404

K
WinKill.exe 2540 Console 0

5,936

K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0 20
K
System 4 Console 0 220
K
SMSS.EXE 432 Console 0 464
K
CSRSS.EXE 488 Console 0 4,540
K
WINLOGON.EXE 512 Console 0 2,336
K
SERVICES.EXE 556 Console 0 3,252
K
LSASS.EXE 568 Console 0 1,756
K
SVCHOST.EXE 724 Console 0 3,168
K
SVCHOST.EXE 776 Console 0 17,420
K
SVCHOST.EXE 900 Console 0 2,232
K
SVCHOST.EXE 932 Console 0 3,816
K
SPOOLSV.EXE 1124 Console 0 4,364
K
avgamsvr.exe 1320 Console 0 6,000
K
avgupsvc.exe 1336 Console 0 2,144
K
INETINFO.EXE 1368 Console 0 10,084
K
MDM.EXE 1400 Console 0 3,020
K
NBTHLP.EXE 1412 Console 0 4,788
K
NVSVC32.EXE 1584 Console 0 2,588
K
POP3 Uniserver.exe 1624 Console 0 5,132
K
SVCHOST.EXE 1696 Console 0 3,588
K
EXPLORER.EXE 480 Console 0 35,804
K
DAP.EXE 768 Console 0 8,412
K
QTTASK.EXE 844 Console 0 6,880
K
JDRMCYK.EXE 908 Console 0 3,524
K
MSDM.EXE 976 Console 0 7,172
K
AIM.EXE 912 Console 0 1,192
K
avgcc.exe 1020 Console 0 7,020
K
avgemc.exe 1064 Console 0 8,616
K
AIM.EXE 1208 Console 0 23,772
K
MSNMSGR.EXE 1220 Console 0 7,232
K
CTFMON.EXE 1244 Console 0 3,272
K
RUNDLL32.EXE 1348 Console 0 2,764
K
Weather.exe 1576 Console 0 13,360
K
libupdate32.exe 1668 Console 0 6,360
K
POPMENU.EXE 1716 Console 0 4,464
K
SQLMANGR.EXE 2316 Console 0 5,532
K
WZQKPICK.EXE 2504 Console 0 3,404
K
WinKill.exe 2540 Console 0 5,936
K
MSIMN.EXE 2728 Console 0 32,188
K
cmd.exe 3400 Console 0 1,512
K
cmd.exe 3412 Console 0 1,540
K
tasklist.exe 3420 Console 0 3,412
K
wmiprvse.exe 3460 Console 0 4,392
K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was never posted
at
this
newsgroup. The problem is I am not able to run Task Manager by
clicking
on
the bottom bar. It closed abruptly after opening it. I have not
able
to
put
it to use.

I tried other way by going to Command Prompt. I opened

Windows
and

looked
for taskman. exe. I tried to run it, but it closed abruptly.

Can someoby solve this dileema?

 

[alan b]

I will take a look into it. I prefer to watch Men's Soccer.
It is now showing Women's World Cup on TV. It may last two/three weeks. US
women is still in contention.

By the way, I notice there is a pgm called libupdate32.exe running in the
Task Manager. How do I know if it is another virus pgm?
Let me know so I can delete it asap.

Anyway, thanks for mentioning the link about Rugby. I may look into it
anyway.

I will not be available until after three pm.

It's sunday here by 1 hr. Rugby League Grand Final tonight, Rugby Union
World cup starts next week here. (Americans can track their team while it's
being eliminated at
http://rugbyheaven.smh.com.au/rwc2003/teams/usa/index.html - they're
amateurs up against professionals - they need your support).

Post back what happens.

David,

thanks.. I will do that this weekend.
I really appreciate your help. JDMRCYK.EXE is the soul of the devil!
So far task Manger is able to open. Thanks for mentioning this devil's
name.

I am running AVG anti-virus in the background. I hope it is also considered
one of the scanners.

program
exe Send/Recieve. happens
the messages
and Properties
and Taskkill
them need
to months
ago) use

at

me

JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or
one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume
you
are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what
ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0
10,084
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0
8,412
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
SMSS.EXE 432 Console 0
464
K
CSRSS.EXE 488 Console 0
4,540
K
WINLOGON.EXE 512 Console 0
2,336
K
SERVICES.EXE 556 Console 0
3,252
K
LSASS.EXE 568 Console 0
1,756
K
SVCHOST.EXE 724 Console 0
3,168
K
SVCHOST.EXE 776 Console 0
17,420
K
SVCHOST.EXE 900 Console 0
2,232
K
SVCHOST.EXE 932 Console 0
3,816
K
SPOOLSV.EXE 1124 Console 0
4,364
K
avgamsvr.exe 1320 Console 0
6,000
K
avgupsvc.exe 1336 Console 0
2,144
K
INETINFO.EXE 1368 Console 0
10,084
K
MDM.EXE 1400 Console 0
3,020
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
SVCHOST.EXE 1696 Console 0
3,588
K
EXPLORER.EXE 480 Console 0
35,804
K
DAP.EXE 768 Console 0
8,412
K
QTTASK.EXE 844 Console 0
6,880
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
AIM.EXE 912 Console 0
1,192
K
avgcc.exe 1020 Console 0
7,020
K
avgemc.exe 1064 Console 0
8,616
K
AIM.EXE 1208 Console 0
23,772
K
MSNMSGR.EXE 1220 Console 0
7,232
K
CTFMON.EXE 1244 Console 0
3,272
K
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K
MSIMN.EXE 2728 Console 0
32,188
K
cmd.exe 3400 Console 0
1,512
K
cmd.exe 3412 Console 0
1,540
K
tasklist.exe 3420 Console 0
3,412
K
wmiprvse.exe 3460 Console 0
4,392
K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was never
posted
at
this
newsgroup. The problem is I am not able to run Task

Manager

by
clicking
on
the bottom bar. It closed abruptly after opening it. I have
not
able
to
put
it to use.

I tried other way by going to Command Prompt. I opened Windows
and
looked
for taskman. exe. I tried to run it, but it closed abruptly.

Can someoby solve this dileema?

 

[David Candy]

They were unable to fix and gave up. They now only keep 30 days of messages
instead of 90.

OE is not considered programable, yet it is (at least a little bit).
Probably on a need to know basis.

That's what I mean by firewall. The firewall in XP-SP1 is even more
effective. While we're here go to the network tab, select TCP/IP,
Properties, Advanced, WINS, Disable NetBIOS over TCP/IP. A firewall stops
NetBIOS ever hearing anything, but NetBIOS should never be exposed to the
public internet. This is off by default in 9x for internet connections but
as XP assumes corporate use (and it's essential there) it is on by default
in XP. It also needs to be on any home network to the other computers but
never on the public internet.

What was your video program.

What a relief. MS servers are real slow the past two weeks! when I try to
look for the list of SDKs like OE for possible some programming.
I got word from other guy that there is no such OE programming in Inetsdk.

By the way, I just reconfigured firewall. It is Microsoft built in firewall.
It is in network connections>local connection>properties> advanced and put
check next to firewall. I hope it is what you want to know. I dont have
other firewalls.

1. Problems were with MS servers. Not you. Been a week and it seems this was
in the final 2 hours of the problems.

2. Firewalls can be configured. What program are you using.

with

my it
on, my
pc.

Send/Recieve.

I on.
It ago)

use

it

because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever since.

You notice things dont look right to you. I am real still at novice
stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft product
at
all. I tried to delete it, but it is access denied, tho i

unchecked
its

archive properties. What should I do ? i vaguely remember about
attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
cmd /c taskkill /im JDRMCYK.EXE /f /t

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been terminated.

I want to delete the files that dont look right. but it is access
denied.

thanks for the reply...
C:\>

You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter

(or
one

removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I

presume
you

are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what
ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0 20
K
System 4 Console 0 220
K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0 10,084
K
NBTHLP.EXE 1412 Console 0 4,788
K
NVSVC32.EXE 1584 Console 0 2,588
K
POP3 Uniserver.exe 1624 Console 0 5,132
K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0 8,412
K
JDRMCYK.EXE 908 Console 0 3,524
K
MSDM.EXE 976 Console 0 7,172
K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0 2,764
K
Weather.exe 1576 Console 0 13,360
K
libupdate32.exe 1668 Console 0 6,360
K
POPMENU.EXE 1716 Console 0 4,464
K
SQLMANGR.EXE 2316 Console 0 5,532
K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0 3,404
K
WinKill.exe 2540 Console 0 5,936
K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
SMSS.EXE 432 Console 0
464
K
CSRSS.EXE 488 Console 0
4,540
K
WINLOGON.EXE 512 Console 0
2,336
K
SERVICES.EXE 556 Console 0
3,252
K
LSASS.EXE 568 Console 0
1,756
K
SVCHOST.EXE 724 Console 0
3,168
K
SVCHOST.EXE 776 Console 0
17,420
K
SVCHOST.EXE 900 Console 0
2,232
K
SVCHOST.EXE 932 Console 0
3,816
K
SPOOLSV.EXE 1124 Console 0
4,364
K
avgamsvr.exe 1320 Console 0
6,000
K
avgupsvc.exe 1336 Console 0
2,144
K
INETINFO.EXE 1368 Console 0
10,084
K
MDM.EXE 1400 Console 0
3,020
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
SVCHOST.EXE 1696 Console 0
3,588
K
EXPLORER.EXE 480 Console 0
35,804
K
DAP.EXE 768 Console 0
8,412
K
QTTASK.EXE 844 Console 0
6,880
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
AIM.EXE 912 Console 0
1,192
K
avgcc.exe 1020 Console 0
7,020
K
avgemc.exe 1064 Console 0
8,616
K
AIM.EXE 1208 Console 0
23,772
K
MSNMSGR.EXE 1220 Console 0
7,232
K
CTFMON.EXE 1244 Console 0
3,272
K
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K
MSIMN.EXE 2728 Console 0
32,188
K
cmd.exe 3400 Console 0
1,512
K
cmd.exe 3412 Console 0
1,540
K
tasklist.exe 3420 Console 0
3,412
K
wmiprvse.exe 3460 Console 0
4,392
K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was never
posted
at
this
newsgroup. The problem is I am not able to run Task

Manager

by have
not

 

[David Candy]

These are the things that task manager show AND the files they need loaded
to run. The things in TM can be loaded and idle too. They are waiting to be
told what to do.

I just type msinfo32 and its Software Environment-Loaded Modules then it
displays a long, long list of loaded modules (pgms). I dont think it means
they are running programs like Task Manager. It may mean loaded somewhere
in RAM, but idle. It is still not clear.

Type msinfo32 into Start Run

Software Evironment - Loaded Modules. This gives the path to the file.

Send/Recieve.

I on.
It ago)

use

it

because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever since.

You notice things dont look right to you. I am real still at novice
stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft product
at
all. I tried to delete it, but it is access denied, tho i

unchecked
its

archive properties. What should I do ? i vaguely remember about
attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\alan>cd
C:\Documents and Settings\alan

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 1716 child of PID 1504 has been terminated.

But I type in cmd /c taskkill /im JDRMCYK.EXE /f /t
AGAIN and it still display SUCCESS: like above indicating it is still there.
But SEARCH does not able to locate it.

DARN IT!!!


C:\>> >
I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been terminated.

I want to delete the files that dont look right. but it is access
denied.

thanks for the reply...
C:\>

You have a lot of crap running. Straight away this jumps out at me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter

(or
one

removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I

presume
you

are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what
ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0 20
K
System 4 Console 0 220
K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0 10,084
K
NBTHLP.EXE 1412 Console 0 4,788
K
NVSVC32.EXE 1584 Console 0 2,588
K
POP3 Uniserver.exe 1624 Console 0 5,132
K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0 8,412
K
JDRMCYK.EXE 908 Console 0 3,524
K
MSDM.EXE 976 Console 0 7,172
K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0 2,764
K
Weather.exe 1576 Console 0 13,360
K
libupdate32.exe 1668 Console 0 6,360
K
POPMENU.EXE 1716 Console 0 4,464
K
SQLMANGR.EXE 2316 Console 0 5,532
K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0 3,404
K
WinKill.exe 2540 Console 0 5,936
K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
SMSS.EXE 432 Console 0
464
K
CSRSS.EXE 488 Console 0
4,540
K
WINLOGON.EXE 512 Console 0
2,336
K
SERVICES.EXE 556 Console 0
3,252
K
LSASS.EXE 568 Console 0
1,756
K
SVCHOST.EXE 724 Console 0
3,168
K
SVCHOST.EXE 776 Console 0
17,420
K
SVCHOST.EXE 900 Console 0
2,232
K
SVCHOST.EXE 932 Console 0
3,816
K
SPOOLSV.EXE 1124 Console 0
4,364
K
avgamsvr.exe 1320 Console 0
6,000
K
avgupsvc.exe 1336 Console 0
2,144
K
INETINFO.EXE 1368 Console 0
10,084
K
MDM.EXE 1400 Console 0
3,020
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
SVCHOST.EXE 1696 Console 0
3,588
K
EXPLORER.EXE 480 Console 0
35,804
K
DAP.EXE 768 Console 0
8,412
K
QTTASK.EXE 844 Console 0
6,880
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
AIM.EXE 912 Console 0
1,192
K
avgcc.exe 1020 Console 0
7,020
K
avgemc.exe 1064 Console 0
8,616
K
AIM.EXE 1208 Console 0
23,772
K
MSNMSGR.EXE 1220 Console 0
7,232
K
CTFMON.EXE 1244 Console 0
3,272
K
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K
MSIMN.EXE 2728 Console 0
32,188
K
cmd.exe 3400 Console 0
1,512
K
cmd.exe 3412 Console 0
1,540
K
tasklist.exe 3420 Console 0
3,412
K
wmiprvse.exe 3460 Console 0
4,392
K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was never
posted
at
this
newsgroup. The problem is I am not able to run Task

Manager

by have
not

 

[David Candy]

If one could be sure windows had no security flaws, then disabling NetBIOS
is all one has to do to be safe. A firewall is an extra layer of protection
and mainly protects against unforseen attacks.

They were unable to fix and gave up. They now only keep 30 days of messages
instead of 90.

OE is not considered programable, yet it is (at least a little bit).
Probably on a need to know basis.

That's what I mean by firewall. The firewall in XP-SP1 is even more
effective. While we're here go to the network tab, select TCP/IP,
Properties, Advanced, WINS, Disable NetBIOS over TCP/IP. A firewall stops
NetBIOS ever hearing anything, but NetBIOS should never be exposed to the
public internet. This is off by default in 9x for internet connections but
as XP assumes corporate use (and it's essential there) it is on by default
in XP. It also needs to be on any home network to the other computers but
never on the public internet.

What was your video program.

What a relief. MS servers are real slow the past two weeks! when I try to
look for the list of SDKs like OE for possible some programming.
I got word from other guy that there is no such OE programming in Inetsdk.

By the way, I just reconfigured firewall. It is Microsoft built in firewall.
It is in network connections>local connection>properties> advanced and put
check next to firewall. I hope it is what you want to know. I dont have
other firewalls.
this
was with

leave

it Send/Recieve. happens
the messages
and Properties
and Taskkill
them need
to months
ago) use

at

me

JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or
one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume
you
are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what
ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0
10,084
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0
8,412
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
SMSS.EXE 432 Console 0
464
K
CSRSS.EXE 488 Console 0
4,540
K
WINLOGON.EXE 512 Console 0
2,336
K
SERVICES.EXE 556 Console 0
3,252
K
LSASS.EXE 568 Console 0
1,756
K
SVCHOST.EXE 724 Console 0
3,168
K
SVCHOST.EXE 776 Console 0
17,420
K
SVCHOST.EXE 900 Console 0
2,232
K
SVCHOST.EXE 932 Console 0
3,816
K
SPOOLSV.EXE 1124 Console 0
4,364
K
avgamsvr.exe 1320 Console 0
6,000
K
avgupsvc.exe 1336 Console 0
2,144
K
INETINFO.EXE 1368 Console 0
10,084
K
MDM.EXE 1400 Console 0
3,020
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
SVCHOST.EXE 1696 Console 0
3,588
K
EXPLORER.EXE 480 Console 0
35,804
K
DAP.EXE 768 Console 0
8,412
K
QTTASK.EXE 844 Console 0
6,880
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
AIM.EXE 912 Console 0
1,192
K
avgcc.exe 1020 Console 0
7,020
K
avgemc.exe 1064 Console 0
8,616
K
AIM.EXE 1208 Console 0
23,772
K
MSNMSGR.EXE 1220 Console 0
7,232
K
CTFMON.EXE 1244 Console 0
3,272
K
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K
MSIMN.EXE 2728 Console 0
32,188
K
cmd.exe 3400 Console 0
1,512
K
cmd.exe 3412 Console 0
1,540
K
tasklist.exe 3420 Console 0
3,412
K
wmiprvse.exe 3460 Console 0
4,392
K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was never
posted
at
this
newsgroup. The problem is I am not able to run Task

Manager

by
clicking
on
the bottom bar. It closed abruptly after opening it. I have
not
able
to
put
it to use.

I tried other way by going to Command Prompt. I opened Windows
and
looked
for taskman. exe. I tried to run it, but it closed abruptly.

Can someoby solve this dileema?

 

[David Candy]

http://www.google.com.au/search?q=libupdate32&ie=UTF-8&oe=UTF-8&hl=en&btnG=G
oogle+Search&meta=lr%3Dlang_en

Is one way to find out.

Also http://search.symantec.com/custom/us/query.html

It does appear to be a virus according to
http://www.pacs-portal.co.uk/startup_pages/startup_w.php

I will take a look into it. I prefer to watch Men's Soccer.
It is now showing Women's World Cup on TV. It may last two/three weeks. US
women is still in contention.

By the way, I notice there is a pgm called libupdate32.exe running in the
Task Manager. How do I know if it is another virus pgm?
Let me know so I can delete it asap.

Anyway, thanks for mentioning the link about Rugby. I may look into it
anyway.

I will not be available until after three pm.

It's sunday here by 1 hr. Rugby League Grand Final tonight, Rugby Union
World cup starts next week here. (Americans can track their team while it's
being eliminated at
http://rugbyheaven.smh.com.au/rwc2003/teams/usa/index.html - they're
amateurs up against professionals - they need your support).

Post back what happens.

changes

so

allows that)

I taskkill msdm.exe, but still cannot delete it. Access denied. I know
you
have put all of your time this evening. I have to wait until tomorrow.
There must be a way to delete it. I know taskkill did nail it just for
now.
To post that reply I spent 7:03 to 9:08 local time click Send/Recieve.
I
am
very angry at the moment.

You have to taskkill them before you can delete them. Now

a/ Reenable Windows Messenger Service. The problem is incorrect
configuration. The internet shouldn't be able to send it

messages.
But

your
computer is treating the internet as a corporate network rather a
dangerous
public network - cos XP is designed first and formost as a corporate
computer. I guess you setup the internet via a CD. When this happens
the
firewall is not enabled - thus allowing people to send you messages
and
virus to send themselves. The popup were a warning that you are wide
open
and you did the equiv of taking aspirin for a brain tumor - it helps
with
the pain but you still die. Type firewall in XP's Help and turn

it
on.

It
will stop you getting viruses as well.

I know msdm is not an MS file but it may be another companies.

Go to Start - Control Panel - Add/Remove Programs and uninstall
anything
you
don't want or use.

Then search for those filenames, right click them, choose Properties
and
read the version tab. This will help you to identify them, both by
what
folder they are in and what the properties say about them.

You can only delete files that aren't running. So you must Taskkill
them
before deleting
, so assume that msdm.exe is a virus type

cmd /c taskkill /im msdm.exe /f /t (or type cmd then taskkill /im
msdm.exe
/f /t to keep the window open (up/down keys recall previous commands).
Then
search for and delete it.

By now that JJJJJJXY file will have probably restarted. You may need
to
kill
it again.

Test after each taskkill if regedit/taskman can work.


David,

yes i tried to run pop3 mail server long time ago. (5 to 7 months
ago)
I
no
longer need it. WinKill is a pop up killer utility. I no

longer
use

it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever
since.

You notice things dont look right to you. I am real still at novice
stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft
product
at
all. I tried to delete it, but it is access denied, tho i unchecked
its
archive properties. What should I do ? i vaguely remember about
attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
cmd /c taskkill /im JDRMCYK.EXE /f /t

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been
terminated.

I want to delete the files that dont look right. but it is access
denied.

thanks for the reply...
C:\>

You have a lot of crap running. Straight away this jumps out

at

me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra

letter
(or

one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume
you
are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell

me
what

ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0
10,084
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0
8,412
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session#
Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
SMSS.EXE 432 Console 0
464
K
CSRSS.EXE 488 Console 0
4,540
K
WINLOGON.EXE 512 Console 0
2,336
K
SERVICES.EXE 556 Console 0
3,252
K
LSASS.EXE 568 Console 0
1,756
K
SVCHOST.EXE 724 Console 0
3,168
K
SVCHOST.EXE 776 Console 0
17,420
K
SVCHOST.EXE 900 Console 0
2,232
K
SVCHOST.EXE 932 Console 0
3,816
K
SPOOLSV.EXE 1124 Console 0
4,364
K
avgamsvr.exe 1320 Console 0
6,000
K
avgupsvc.exe 1336 Console 0
2,144
K
INETINFO.EXE 1368 Console 0
10,084
K
MDM.EXE 1400 Console 0
3,020
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
SVCHOST.EXE 1696 Console 0
3,588
K
EXPLORER.EXE 480 Console 0
35,804
K
DAP.EXE 768 Console 0
8,412
K
QTTASK.EXE 844 Console 0
6,880
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
AIM.EXE 912 Console 0
1,192
K
avgcc.exe 1020 Console 0
7,020
K
avgemc.exe 1064 Console 0
8,616
K
AIM.EXE 1208 Console 0
23,772
K
MSNMSGR.EXE 1220 Console 0
7,232
K
CTFMON.EXE 1244 Console 0
3,272
K
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K
MSIMN.EXE 2728 Console 0
32,188
K
cmd.exe 3400 Console 0
1,512
K
cmd.exe 3412 Console 0
1,540
K
tasklist.exe 3420 Console 0
3,412
K
wmiprvse.exe 3460 Console 0
4,392
K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was never
posted
at
this
newsgroup. The problem is I am not able to run Task Manager
by
clicking
on
the bottom bar. It closed abruptly after opening it.

I
have

not
able
to
put
it to use.

I tried other way by going to Command Prompt. I opened
Windows
and
looked
for taskman. exe. I tried to run it, but it closed abruptly.

Can someoby solve this dileema?

 

[alan b]

I agree with you about firewall stopping NEtBios. I only know that NETBIOS
is operating system within home networked computers). A firewall when sees
NETBIOS trying to get outside information then disables the information.
That is why i cannot use NEtMeeting (my video software) for incoming video
calls anymore. Perhaps disable firewall temporarily while using netmeeting
for incoming calls.

Re about OE programming. I dont want to get involved into this programming,
but for some reasons, I need the text output from OE 6.0's list of INBOX
entrees like Subjects, From, To Fields. I know that OD 6.0 does not generate
them as .txt or .doc files for access to other non ms products. I need these
like .txt or .doc as inputs to my other programs. But learning the hard way
that it is virtually or not wholly impossible. As it is, it is very
clannish.

If one could be sure windows had no security flaws, then disabling NetBIOS
is all one has to do to be safe. A firewall is an extra layer of protection
and mainly protects against unforseen attacks.

They were unable to fix and gave up. They now only keep 30 days of messages
instead of 90.

OE is not considered programable, yet it is (at least a little bit).
Probably on a need to know basis.

That's what I mean by firewall. The firewall in XP-SP1 is even more
effective. While we're here go to the network tab, select TCP/IP,
Properties, Advanced, WINS, Disable NetBIOS over TCP/IP. A firewall stops
NetBIOS ever hearing anything, but NetBIOS should never be exposed to the
public internet. This is off by default in 9x for internet connections but
as XP assumes corporate use (and it's essential there) it is on by default
in XP. It also needs to be on any home network to the other computers but
never on the public internet.

What was your video program.

try

to

look for the list of SDKs like OE for possible some programming.
I got word from other guy that there is no such OE programming in Inetsdk.

By the way, I just reconfigured firewall. It is Microsoft built in firewall.
It is in network connections>local connection>properties> advanced and put
check next to firewall. I hope it is what you want to know. I dont have
other firewalls.
1. Problems were with MS servers. Not you. Been a week and it seems this
was
in the final 2 hours of the problems.

2. Firewalls can be configured. What program are you using.

I am in a hurry to reply your note. It is apparent something to do with
my
virus that caused you lots of trouble in replying to this note.

I need to explain why I turned off firewall. It is because if I

leave

it
on,
I am not able to answer incoming video calls. I think I will turn
firewall
back on! But it means no one can call me, but it will be healthy

for
my

pc.
It is now in shoddy condition.

Now I am going to do all of your steps including TaskKill. And let you
know
tmw. I apologize for the time you spent in trying to reply this post.

To post that reply I spent 7:03 to 9:08 local time click Send/Recieve.
I
am
very angry at the moment.

You have to taskkill them before you can delete them. Now

a/ Reenable Windows Messenger Service. The problem is incorrect
configuration. The internet shouldn't be able to send it

messages.
But

your
computer is treating the internet as a corporate network rather a
dangerous
public network - cos XP is designed first and formost as a corporate
computer. I guess you setup the internet via a CD. When this happens
the
firewall is not enabled - thus allowing people to send you messages
and
virus to send themselves. The popup were a warning that you are wide
open
and you did the equiv of taking aspirin for a brain tumor - it helps
with
the pain but you still die. Type firewall in XP's Help and turn

it
on.

It
will stop you getting viruses as well.

I know msdm is not an MS file but it may be another companies.

Go to Start - Control Panel - Add/Remove Programs and uninstall
anything
you
don't want or use.

Then search for those filenames, right click them, choose Properties
and
read the version tab. This will help you to identify them, both by
what
folder they are in and what the properties say about them.

You can only delete files that aren't running. So you must Taskkill
them
before deleting
, so assume that msdm.exe is a virus type

cmd /c taskkill /im msdm.exe /f /t (or type cmd then taskkill /im
msdm.exe
/f /t to keep the window open (up/down keys recall previous commands).
Then
search for and delete it.

By now that JJJJJJXY file will have probably restarted. You may need
to
kill
it again.

Test after each taskkill if regedit/taskman can work.


David,

yes i tried to run pop3 mail server long time ago. (5 to 7 months
ago)
I
no
longer need it. WinKill is a pop up killer utility. I no

longer
use

it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever
since.

You notice things dont look right to you. I am real still at novice
stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft
product
at
all. I tried to delete it, but it is access denied, tho i unchecked
its
archive properties. What should I do ? i vaguely remember about
attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
cmd /c taskkill /im JDRMCYK.EXE /f /t

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been
terminated.

I want to delete the files that dont look right. but it is access
denied.

thanks for the reply...
C:\>

You have a lot of crap running. Straight away this jumps out

at

me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra

letter
(or

one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume
you
are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell

me
what

ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0
10,084
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0
8,412
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session#
Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
SMSS.EXE 432 Console 0
464
K
CSRSS.EXE 488 Console 0
4,540
K
WINLOGON.EXE 512 Console 0
2,336
K
SERVICES.EXE 556 Console 0
3,252
K
LSASS.EXE 568 Console 0
1,756
K
SVCHOST.EXE 724 Console 0
3,168
K
SVCHOST.EXE 776 Console 0
17,420
K
SVCHOST.EXE 900 Console 0
2,232
K
SVCHOST.EXE 932 Console 0
3,816
K
SPOOLSV.EXE 1124 Console 0
4,364
K
avgamsvr.exe 1320 Console 0
6,000
K
avgupsvc.exe 1336 Console 0
2,144
K
INETINFO.EXE 1368 Console 0
10,084
K
MDM.EXE 1400 Console 0
3,020
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
SVCHOST.EXE 1696 Console 0
3,588
K
EXPLORER.EXE 480 Console 0
35,804
K
DAP.EXE 768 Console 0
8,412
K
QTTASK.EXE 844 Console 0
6,880
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
AIM.EXE 912 Console 0
1,192
K
avgcc.exe 1020 Console 0
7,020
K
avgemc.exe 1064 Console 0
8,616
K
AIM.EXE 1208 Console 0
23,772
K
MSNMSGR.EXE 1220 Console 0
7,232
K
CTFMON.EXE 1244 Console 0
3,272
K
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K
MSIMN.EXE 2728 Console 0
32,188
K
cmd.exe 3400 Console 0
1,512
K
cmd.exe 3412 Console 0
1,540
K
tasklist.exe 3420 Console 0
3,412
K
wmiprvse.exe 3460 Console 0
4,392
K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was never
posted
at
this
newsgroup. The problem is I am not able to run Task Manager
by
clicking
on
the bottom bar. It closed abruptly after opening it.

I
have

not
able
to
put
it to use.

I tried other way by going to Command Prompt. I opened
Windows
and
looked
for taskman. exe. I tried to run it, but it closed abruptly.

Can someoby solve this dileema?

 

[David Candy]

If you export OE to Outlook, Outlook can export as CSV files (and probably
others but I love CSV files). If only people wouldn't use , and " in their
posts. As tabs aren't in email messages a tab delimited file would maintain
it's order (and I think Access as well). Tom Koch has a message extractor
for OE's DBX files (you can drag them out as well but the get named after
the subject line so they keep overwriting each other). I haven't seen it.
But OE message format once a message is out of OE is just a plain text file.
You can open and read the headers with all three of ms programming script
languages built in to XP (and 2 of the 3 on 9x).

This is the headers and 1st paragraph from the post I'm replying to. Mail is
very similar.

NNTP-Posting-Date: Sat, 04 Oct 2003 10:58:43 -0500
From: "alan b" <[email protected]>
Newsgroups: microsoft.public.windowsxp.general
References: <#[email protected]>
<[email protected]> <[email protected]>
<[email protected]> <[email protected]>
<#a3y#[email protected]> <[email protected]>
<[email protected]> <[email protected]>
<[email protected]>
<[email protected]>
Subject: Re: Task Manager wont respond
Date: Sat, 4 Oct 2003 11:58:54 -0400
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Message-ID: <[email protected]>
Lines: 524
NNTP-Posting-Host: 68.39.229.25
X-Trace:
sv3-IQut4DxYA97saX9M44VnnOyDa0qx6Zo6oM9r12ErNPHtP5mITW3dVr1rCGjvRl7LWJwNXoSu
VruaRaD!esuvSpXVXaYXrfsDyuMTd7mNFzdIbl0XcvHw58ldyHzkc6dyEZBG+gX7sDff
X-Complaints-To: (e-mail address removed)
X-DMCA-Complaints-To: (e-mail address removed)
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint
properly
X-Postfilter: 1.1
Path:
TK2MSFTNGP08.phx.gbl!newsfeed00.sul.t-online.de!t-online.de!npeer.de.kpn-eur
orings.net!news-xfer.cox.net!peer01.cox.net!cox.net!border3.nntp.aus1.gigane
ws.com!intern1.nntp.aus1.giganews.com!nntp.giganews.com!nntp.comcast.com!new
s.comcast.com.POSTED!not-for-mail
Xref: TK2MSFTNGP08.phx.gbl microsoft.public.windowsxp.general:738342

I agree with you about firewall stopping NEtBios. I only know that NETBIOS
is operating system within home networked computers). A firewall when sees
NETBIOS trying to get outside information then disables the information.
That is why i cannot use NEtMeeting (my video software) for incoming video
calls anymore. Perhaps disable firewall temporarily while using netmeeting
for incoming calls.

I agree with you about firewall stopping NEtBios. I only know that NETBIOS
is operating system within home networked computers). A firewall when sees
NETBIOS trying to get outside information then disables the information.
That is why i cannot use NEtMeeting (my video software) for incoming video
calls anymore. Perhaps disable firewall temporarily while using netmeeting
for incoming calls.

Re about OE programming. I dont want to get involved into this programming,
but for some reasons, I need the text output from OE 6.0's list of INBOX
entrees like Subjects, From, To Fields. I know that OD 6.0 does not generate
them as .txt or .doc files for access to other non ms products. I need these
like .txt or .doc as inputs to my other programs. But learning the hard way
that it is virtually or not wholly impossible. As it is, it is very
clannish.

If one could be sure windows had no security flaws, then disabling NetBIOS
is all one has to do to be safe. A firewall is an extra layer of protection
and mainly protects against unforseen attacks.
try and
put dont
have seems
this let
you

rather

a are
wide
helps

turn

it

both

by

what
folder they are in and what the properties say about them.

You can only delete files that aren't running. So you must Taskkill
them
before deleting
, so assume that msdm.exe is a virus type

cmd /c taskkill /im msdm.exe /f /t (or type cmd then taskkill /im
msdm.exe
/f /t to keep the window open (up/down keys recall previous
commands).
Then
search for and delete it.

By now that JJJJJJXY file will have probably restarted. You

may
need

to
kill
it again.

Test after each taskkill if regedit/taskman can work.


David,

yes i tried to run pop3 mail server long time ago. (5 to 7 months
ago)
I
no
longer need it. WinKill is a pop up killer utility. I no longer
use
it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever
since.

You notice things dont look right to you. I am real still at
novice
stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft
product
at
all. I tried to delete it, but it is access denied, tho i
unchecked
its
archive properties. What should I do ? i vaguely remember about
attribute
subcommands..It may work. It looks like you are the right

guy
for

assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
cmd /c taskkill /im JDRMCYK.EXE /f /t

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been
terminated.

I want to delete the files that dont look right. but it is access
denied.

thanks for the reply...
C:\>

You have a lot of crap running. Straight away this jumps

out
at

me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter
(or
one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I
presume
you
are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me
what
ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session#
Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0
10,084
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0
8,412
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session#
Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
SMSS.EXE 432 Console 0
464
K
CSRSS.EXE 488 Console 0
4,540
K
WINLOGON.EXE 512 Console 0
2,336
K
SERVICES.EXE 556 Console 0
3,252
K
LSASS.EXE 568 Console 0
1,756
K
SVCHOST.EXE 724 Console 0
3,168
K
SVCHOST.EXE 776 Console 0
17,420
K
SVCHOST.EXE 900 Console 0
2,232
K
SVCHOST.EXE 932 Console 0
3,816
K
SPOOLSV.EXE 1124 Console 0
4,364
K
avgamsvr.exe 1320 Console 0
6,000
K
avgupsvc.exe 1336 Console 0
2,144
K
INETINFO.EXE 1368 Console 0
10,084
K
MDM.EXE 1400 Console 0
3,020
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
SVCHOST.EXE 1696 Console 0
3,588
K
EXPLORER.EXE 480 Console 0
35,804
K
DAP.EXE 768 Console 0
8,412
K
QTTASK.EXE 844 Console 0
6,880
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
AIM.EXE 912 Console 0
1,192
K
avgcc.exe 1020 Console 0
7,020
K
avgemc.exe 1064 Console 0
8,616
K
AIM.EXE 1208 Console 0
23,772
K
MSNMSGR.EXE 1220 Console 0
7,232
K
CTFMON.EXE 1244 Console 0
3,272
K
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K
MSIMN.EXE 2728 Console 0
32,188
K
cmd.exe 3400 Console 0
1,512
K
cmd.exe 3412 Console 0
1,540
K
tasklist.exe 3420 Console 0
3,412
K
wmiprvse.exe 3460 Console 0
4,392
K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was
never
posted
at
this
newsgroup. The problem is I am not able to run Task
Manager
by
clicking
on
the bottom bar. It closed abruptly after opening

it.

I

 

[David Candy]

Opps Steve Cochran is the Author.
http://www.oehelp.com/DBXtract/Default.aspx

http://insideoe.tomsterdam.com/tools/index.htm#dbxtract
These are programs written for OE. These authors are in the OE newsgroups.

If your ISP carries it
If not
news://msnews.microsoft.com/microsoft.public.windows.inetexplorer.ie6_outloo
kexpress

If you export OE to Outlook, Outlook can export as CSV files (and probably
others but I love CSV files). If only people wouldn't use , and " in their
posts. As tabs aren't in email messages a tab delimited file would maintain
it's order (and I think Access as well). Tom Koch has a message extractor
for OE's DBX files (you can drag them out as well but the get named after
the subject line so they keep overwriting each other). I haven't seen it.
But OE message format once a message is out of OE is just a plain text file.
You can open and read the headers with all three of ms programming script
languages built in to XP (and 2 of the 3 on 9x).

This is the headers and 1st paragraph from the post I'm replying to. Mail is
very similar.

NNTP-Posting-Date: Sat, 04 Oct 2003 10:58:43 -0500
From: "alan b" <[email protected]>
Newsgroups: microsoft.public.windowsxp.general
References: <#[email protected]>
<[email protected]>

<[email protected]>

<#a3y#[email protected]>

<[email protected]>

<[email protected]>
<[email protected]>
Subject: Re: Task Manager wont respond
Date: Sat, 4 Oct 2003 11:58:54 -0400
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Message-ID: <[email protected]>
Lines: 524
NNTP-Posting-Host: 68.39.229.25
X-Trace:
sv3-IQut4DxYA97saX9M44VnnOyDa0qx6Zo6oM9r12ErNPHtP5mITW3dVr1rCGjvRl7LWJwNXoSu
VruaRaD!esuvSpXVXaYXrfsDyuMTd7mNFzdIbl0XcvHw58ldyHzkc6dyEZBG+gX7sDff
X-Complaints-To: (e-mail address removed)
X-DMCA-Complaints-To: (e-mail address removed)
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint
properly
X-Postfilter: 1.1
Path:
TK2MSFTNGP08.phx.gbl!newsfeed00.sul.t-online.de!t-online.de!npeer.de.kpn-eurorings.net!news-xfer.cox.net!peer01.cox.net!cox.net!border3.nntp.aus1.giganews.com!intern1.nntp.aus1.giganews.com!nntp.giganews.com!nntp.comcast.com!new
s.comcast.com.POSTED!not-for-mail
Xref: TK2MSFTNGP08.phx.gbl microsoft.public.windowsxp.general:738342

I agree with you about firewall stopping NEtBios. I only know that NETBIOS
is operating system within home networked computers). A firewall when sees
NETBIOS trying to get outside information then disables the information.
That is why i cannot use NEtMeeting (my video software) for incoming video
calls anymore. Perhaps disable firewall temporarily while using netmeeting
for incoming calls.

I agree with you about firewall stopping NEtBios. I only know that NETBIOS
is operating system within home networked computers). A firewall when sees
NETBIOS trying to get outside information then disables the information.
That is why i cannot use NEtMeeting (my video software) for incoming video
calls anymore. Perhaps disable firewall temporarily while using netmeeting
for incoming calls.

Re about OE programming. I dont want to get involved into this programming,
but for some reasons, I need the text output from OE 6.0's list of INBOX
entrees like Subjects, From, To Fields. I know that OD 6.0 does not generate
them as .txt or .doc files for access to other non ms products. I need these
like .txt or .doc as inputs to my other programs. But learning the hard way
that it is virtually or not wholly impossible. As it is, it is very
clannish.



to
the connections
but computers
but I
try

to

do healthy
for rather

it

helps
with
the pain but you still die. Type firewall in XP's Help and

turn

it
on.
It
will stop you getting viruses as well.

I know msdm is not an MS file but it may be another companies.

Go to Start - Control Panel - Add/Remove Programs and uninstall
anything
you
don't want or use.

Then search for those filenames, right click them, choose
Properties
and
read the version tab. This will help you to identify them,

both

by
what
folder they are in and what the properties say about them.

You can only delete files that aren't running. So you must
Taskkill
them
before deleting
, so assume that msdm.exe is a virus type

cmd /c taskkill /im msdm.exe /f /t (or type cmd then

taskkill
/im

msdm.exe
/f /t to keep the window open (up/down keys recall previous
commands).
Then
search for and delete it.

By now that JJJJJJXY file will have probably restarted. You may
need
to
kill
it again.

Test after each taskkill if regedit/taskman can work.


David,

yes i tried to run pop3 mail server long time ago. (5 to 7
months
ago)
I
no
longer need it. WinKill is a pop up killer utility. I no longer
use
it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever
since.

You notice things dont look right to you. I am real still at
novice
stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft
product
at
all. I tried to delete it, but it is access denied, tho i
unchecked
its
archive properties. What should I do ? i vaguely remember about
attribute
subcommands..It may work. It looks like you are the right guy
for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
cmd /c taskkill /im JDRMCYK.EXE /f /t

I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been
terminated.

I want to delete the files that dont look right. but it is
access
denied.

thanks for the reply...
C:\>

You have a lot of crap running. Straight away this jumps out
at
me
JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter
(or
one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I
presume
you
are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So

tell
me

what
ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session#
Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0
10,084
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0
8,412
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session#
Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
SMSS.EXE 432 Console 0
464
K
CSRSS.EXE 488 Console 0
4,540
K
WINLOGON.EXE 512 Console 0
2,336
K
SERVICES.EXE 556 Console 0
3,252
K
LSASS.EXE 568 Console 0
1,756
K
SVCHOST.EXE 724 Console 0
3,168
K
SVCHOST.EXE 776 Console 0
17,420
K
SVCHOST.EXE 900 Console 0
2,232
K
SVCHOST.EXE 932 Console 0
3,816
K
SPOOLSV.EXE 1124 Console 0
4,364
K
avgamsvr.exe 1320 Console 0
6,000
K
avgupsvc.exe 1336 Console 0
2,144
K
INETINFO.EXE 1368 Console 0
10,084
K
MDM.EXE 1400 Console 0
3,020
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
SVCHOST.EXE 1696 Console 0
3,588
K
EXPLORER.EXE 480 Console 0
35,804
K
DAP.EXE 768 Console 0
8,412
K
QTTASK.EXE 844 Console 0
6,880
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
AIM.EXE 912 Console 0
1,192
K
avgcc.exe 1020 Console 0
7,020
K
avgemc.exe 1064 Console 0
8,616
K
AIM.EXE 1208 Console 0
23,772
K
MSNMSGR.EXE 1220 Console 0
7,232
K
CTFMON.EXE 1244 Console 0
3,272
K
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K
MSIMN.EXE 2728 Console 0
32,188
K
cmd.exe 3400 Console 0
1,512
K
cmd.exe 3412 Console 0
1,540
K
tasklist.exe 3420 Console 0
3,412
K
wmiprvse.exe 3460 Console 0
4,392
K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was
never
posted
at
this
newsgroup. The problem is I am not able to run Task
Manager
by
clicking
on
the bottom bar. It closed abruptly after opening

it.

I
have
not
able
to
put
it to use.

I tried other way by going to Command Prompt. I opened
Windows
and
looked
for taskman. exe. I tried to run it, but it closed
abruptly.

Can someoby solve this dileema?

 

[alan b]

I appreciate Thanks for the clear and straightforward explanation about TM
and idle programs.

I have been using AVG 7.0 from Grisoft. No virus detected since nearly two
weeks ago. Thanks again for helping me detect like JDRMCYK.EXE .
It appears to be gone!

These are the things that task manager show AND the files they need loaded
to run. The things in TM can be loaded and idle too. They are waiting to be
told what to do.

I just type msinfo32 and its Software Environment-Loaded Modules then it
displays a long, long list of loaded modules (pgms). I dont think it means
they are running programs like Task Manager. It may mean loaded somewhere
in RAM, but idle. It is still not clear.

Type msinfo32 into Start Run

Software Evironment - Loaded Modules. This gives the path to the file.

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 1716 child of PID 1504 has been terminated.

But I type in cmd /c taskkill /im JDRMCYK.EXE /f /t
AGAIN and it still displays SUCCESS: like above indicating it is still
there.
But SEARCH does not able to locate it.

DARN IT!!!

To post that reply I spent 7:03 to 9:08 local time click

Send/Recieve.

I
am
very angry at the moment.

You have to taskkill them before you can delete them. Now

a/ Reenable Windows Messenger Service. The problem is incorrect
configuration. The internet shouldn't be able to send it messages. But
your
computer is treating the internet as a corporate network rather a
dangerous
public network - cos XP is designed first and formost as a corporate
computer. I guess you setup the internet via a CD. When this

happens
the

firewall is not enabled - thus allowing people to send you

messages
and

virus to send themselves. The popup were a warning that you are wide
open
and you did the equiv of taking aspirin for a brain tumor - it helps
with
the pain but you still die. Type firewall in XP's Help and turn it on.
It
will stop you getting viruses as well.

I know msdm is not an MS file but it may be another companies.

Go to Start - Control Panel - Add/Remove Programs and uninstall anything
you
don't want or use.

Then search for those filenames, right click them, choose

Properties
and

read the version tab. This will help you to identify them, both by what
folder they are in and what the properties say about them.

You can only delete files that aren't running. So you must

Taskkill
them

before deleting
, so assume that msdm.exe is a virus type

cmd /c taskkill /im msdm.exe /f /t (or type cmd then taskkill /im
msdm.exe
/f /t to keep the window open (up/down keys recall previous commands).
Then
search for and delete it.

By now that JJJJJJXY file will have probably restarted. You may

need
to

kill
it again.

Test after each taskkill if regedit/taskman can work.


David,

yes i tried to run pop3 mail server long time ago. (5 to 7

months
ago)

I
no
longer need it. WinKill is a pop up killer utility. I no longer

use

it
because
I have disabled Windows Messengers to prevent any message with
title"Messenger" to pop up. It works well as pop up killer ever since.

You notice things dont look right to you. I am real still at novice
stage
for long time and still am.

I just found out from another guy that MSDM.EXE is not microsoft
product
at
all. I tried to delete it, but it is access denied, tho i unchecked
its
archive properties. What should I do ? i vaguely remember about
attribute
subcommands..It may work. It looks like you are the right guy for
assistance.

yes it is real nuisance. i am having malicious virus.
I typed in:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\alan>cd
C:\Documents and Settings\alan

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 1716 child of PID 1504 has been terminated.

But I type in cmd /c taskkill /im JDRMCYK.EXE /f /t
AGAIN and it still display SUCCESS: like above indicating it is still
there.
But SEARCH does not able to locate it.

DARN IT!!!


C:\>> >
I typed in the line below and got the output SUCCESS:

C:\>cmd /c taskkill /im JDRMCYK.EXE /f /t
SUCCESS: The process with PID 908 child of PID 480 has been
terminated.

I want to delete the files that dont look right. but it is access
denied.

thanks for the reply...
C:\>

You have a lot of crap running. Straight away this jumps out

at

me

JDRMCYK.EXE

This looks suss as it's a legit filename with an extra letter (or
one
removed depending oon what file)
MSDM.EXE

I'd like you to tell me which ones you know are legit. (I presume
you
are
running a pop3 mail server?), what winkill for instance.

I don't want to spend time researching every file. So tell me what
ones
you
know are legit.

Type in Start Run
cmd /c taskkill /im JDRMCYK.EXE /f /t

Here's YOUR list with standard parts of windows removed
Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
[Below is from IIS?]
INETINFO.EXE 1368 Console 0
10,084
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
[DAP sounds a bit suss?]
DAP.EXE 768 Console 0
8,412
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
[Rundll32 is a helper program - it runs DLLs as exe.]
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
[Something to do with winzip or Logictech?]
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K

I do as you said about the cmd line.
It is copied and pasted below.
Tell me what I should do next.

Image Name PID Session Name Session# Mem
Usage
========================= ====== ================ ========
============
System Idle Process 0 Console 0
20
K
System 4 Console 0
220
K
SMSS.EXE 432 Console 0
464
K
CSRSS.EXE 488 Console 0
4,540
K
WINLOGON.EXE 512 Console 0
2,336
K
SERVICES.EXE 556 Console 0
3,252
K
LSASS.EXE 568 Console 0
1,756
K
SVCHOST.EXE 724 Console 0
3,168
K
SVCHOST.EXE 776 Console 0
17,420
K
SVCHOST.EXE 900 Console 0
2,232
K
SVCHOST.EXE 932 Console 0
3,816
K
SPOOLSV.EXE 1124 Console 0
4,364
K
avgamsvr.exe 1320 Console 0
6,000
K
avgupsvc.exe 1336 Console 0
2,144
K
INETINFO.EXE 1368 Console 0
10,084
K
MDM.EXE 1400 Console 0
3,020
K
NBTHLP.EXE 1412 Console 0
4,788
K
NVSVC32.EXE 1584 Console 0
2,588
K
POP3 Uniserver.exe 1624 Console 0
5,132
K
SVCHOST.EXE 1696 Console 0
3,588
K
EXPLORER.EXE 480 Console 0
35,804
K
DAP.EXE 768 Console 0
8,412
K
QTTASK.EXE 844 Console 0
6,880
K
JDRMCYK.EXE 908 Console 0
3,524
K
MSDM.EXE 976 Console 0
7,172
K
AIM.EXE 912 Console 0
1,192
K
avgcc.exe 1020 Console 0
7,020
K
avgemc.exe 1064 Console 0
8,616
K
AIM.EXE 1208 Console 0
23,772
K
MSNMSGR.EXE 1220 Console 0
7,232
K
CTFMON.EXE 1244 Console 0
3,272
K
RUNDLL32.EXE 1348 Console 0
2,764
K
Weather.exe 1576 Console 0
13,360
K
libupdate32.exe 1668 Console 0
6,360
K
POPMENU.EXE 1716 Console 0
4,464
K
SQLMANGR.EXE 2316 Console 0
5,532
K
WZQKPICK.EXE 2504 Console 0
3,404
K
WinKill.exe 2540 Console 0
5,936
K
MSIMN.EXE 2728 Console 0
32,188
K
cmd.exe 3400 Console 0
1,512
K
cmd.exe 3412 Console 0
1,540
K
tasklist.exe 3420 Console 0
3,412
K
wmiprvse.exe 3460 Console 0
4,392
K


Type

cmd /c tasklist >"%userprofile%\desktop\tl.txt"
and post the text file that appears on your desktop.
I made posting earlier about two hours ago and it was never
posted
at
this
newsgroup. The problem is I am not able to run Task

Manager

by
clicking
on
the bottom bar. It closed abruptly after opening it. I have
not
able
to
put
it to use.

I tried other way by going to Command Prompt. I opened Windows
and
looked
for taskman. exe. I tried to run it, but it closed abruptly.

Can someoby solve this dileema?