What the hell.. [NEVER MIND] [[RESOLVED]]

[Senoska]

So I'm just wondering if anyone else is getting this. I have no FFXI related programs on my PC other then windower. I have no kind of P2P software. I freshly reformatted my PC because of a .exe that opened called Conime.exe. It would open when I opened POL. so after long debate I said fuck it and just reformatted. After reformatting I downloaded 4 files, Windower Firefox Photoshop CS3 trial [off the Photoshop website]and Winrar. About a week goes by when I notice the Conime.exe file is back and opens when I open POL. Any idea of why this is occurring and if anyone else has it can they tell me what files they have on their PC?

NEVER MIND TY FOR THOSE WHO HELPED ^^;

[Snowknight26]

BFGhost 1.0 Remote administration backdoor tool, remove it!
Dunno how you got it, but get rid of it.

[Killgannon]

http://www.liutilities.com/products/win ... ry/conime/

um....

ok

#1 get antivirus ASAP, IE now

#2 are you on a network? does anyone else on your network play FF? trojans like this can spread over open shares (default by windows xp install everything is openly shared and the admin password is blank....)

#3 if you're on a network with someone else that plays FF kill them and break their computer

added by editing below:

#4 if you're directly connected to the internet... get a firewall NOW... windows firewall doesnt cut it turn that shit off and gtfo

#5 are there other hard drives in your pc that you possibly didnt reformat?

#6 did you download windower from windower.net? and no other site?

#7 did you happen to download images of FF CDs to reinstall (ie maybe you lost yours or something)

[Senoska]

Im not on a network
#5 Nope everything got reformated
#6: yes

[Gulkeeva]

The process Console IME belongs to the software MicrosoftR WindowsR Operating System

Microsoft Console IME (Input Method Editor). It executes whenever a command prompt is opened. Apparently used for Asian language input support in the command prompt.

Hello IME ﾎﾞﾝｼﾞｭｰﾙ (￣∠ ￣ )ﾉ

[Killgannon]

http://www.file.net/process/conime.exe.html

what gulkeeva just posted

do you have IME installed? because when you run windower it opens a console thus it would launch the file to allow you to input asian text...

[Senoska]

The process Console IME belongs to the software MicrosoftR WindowsR Operating System

Microsoft Console IME (Input Method Editor). It executes whenever a command prompt is opened. Apparently used for Asian language input support in the command prompt.

Hello IME ﾎﾞﾝｼﾞｭｰﾙ (￣∠ ￣ )ﾉ

what does this have to do with IME? CONIME is the exe name.
http://img440.imageshack.us/img440/5735/wtfsjpgfd2.jpg

ctfmon or w/e is what the IME support is:
http://www.liutilities.com/products/win ... ry/ctfmon/

[Killgannon]

do you have asian language support installed in your xp version?

its a valid windows file if you do, it allows asian text to be input on the console window

when you hit launcher for windower it pops a console window which would make that app run...

[Gulkeeva]

The process Console IME belongs to the software MicrosoftR WindowsR Operating System

Microsoft Console IME (Input Method Editor). It executes whenever a command prompt is opened. Apparently used for Asian language input support in the command prompt.

Hello IME ﾎﾞﾝｼﾞｭｰﾙ (￣∠ ￣ )ﾉ

what does this have to do with IME? CONIME is the exe name.
http://img440.imageshack.us/img440/5735/wtfsjpgfd2.jpg

Its the consol thats loaded when you try to type into something with a foreign language. it laoded soon as I started typing japanese as I posted above

http://www.neko-sentai.com/images2/conime.jpg

[Senoska]

Yes I do but everyone is listing Conime.exe to be a virus. ctfmon tho I do know is for he IME input.

edit: one more thing, I never activated the IME, but thank you for helping. Why is everyone listing this as a virus tho?

[Killgannon]

check out the second link i posted

it IS a valid windows file for asian language support

if you wanna just confirm for yourself that its nothing dangerous

http://security.symantec.com/sscv6/home ... h_status=0

and run it

[Killgannon]

Why is everyone listing this as a virus tho?

because it also is a filename of a trojan

to fool people into thinking they are safe hackers will name files to something close to or resembling a valid file

[Gulkeeva]

Yeah ... alot of viruses are named same as windows system files.. to usualy fool a system/user to making them delete it...

Its also considered a system critical file to winXP... it'll be replaced by the system backup if you rename/delete it repedidly >.>

http://www.neko-sentai.com/images2/conime2.jpg