Can't switch Chinese input method under the command line - China DOS Union Forum

Supplementary: (provided by Baidu Baike)
Description of the conime.exe process: conime.exe is an input method editor that allows users to enter complex characters and symbols using a standard keyboard! conime.exe may also be a bfghost 1.0 remote control backdoor program. This program allows attackers to access your computer, steal passwords and personal data. It is recommended to delete this process immediately."
I used to always not know when this process would start quietly, and later I found that it often appears after running cmd.exe. But conime.exe is not a child process of cmd.exe, and its parent process ID is not displayed in the Task Manager.
Conime is often used by viruses to infect, it is recommended to delete.
Many people ask what the conime.exe process is, and most people will refer to the process descriptions on domestic and foreign websites, saying it is a virus and teaching them how to end it.
Everyone knows that a conime.exe process will appear in the process after running cmd.exe.
The descriptions of the process on the Internet, whether domestic or foreign, say it is a virus...
Of course, maybe the virus has the same name as it, but it can't be generalized.
Some people say that conime.exe is a child process of cmd.exe.
I will now carefully check conime.
Here sunwear is using KD to check whether the InheritedFromUniqueProcessId of the eprocess of conime.exe is the UniqueProcessId of the eprocess of cmd.exe
If so, it can be explained that conime.exe is a child process of cmd.exe. Then let's take a look.
PROCESS 817217c0 SessionId: 0 Cid: 04dc Peb: 7ffdf000 ParentCid: 032c
DirBase: 1558f000 ObjectTable: 8170d168 TableSize: 18.
Image: conime.exe

PROCESS 81733460 SessionId: 0 Cid: 038c Peb: 7ffdf000 ParentCid: 02f8
DirBase: 056a1000 ObjectTable: 81692288 TableSize: 22.
Image: cmd.exe
Then check the eprocess of conime.exe
nt!_EPROCESS
..................
+0x09c UniqueProcessId : 0x000004dc
..................
+0x1c8 InheritedFromUniqueProcessId : 0x0000032c
..................
The process ID of conime.exe is 0x000004dc. The parent process is 0x0000032c

Let's take a look at cmd.exe again
nt!_EPROCESS
..............
+0x09c UniqueProcessId : 0x0000038c
..............
That is to say, conime.exe is not a child process of cmd.exe.
And the parent process ID of conime.exe is not in the Task Manager

From the name, conime.exe is related to the input method. Indeed, it is a program that handles console input method-related matters.
We can do an experiment. First, we run cmd.exe, and then use ctrl+shift to switch the input method, can we switch it?
We end conime with the Task Manager, and then try it? What's the result?
I think if you want to write an explanation, you must give the function of the original MS program. It is a normal process in the Windows operating system. You can explain in the additional explanation that some viruses have the same name as it.
Just like service explorer svchost and so on. If they are possessed by viruses (it happens frequently). Then what should the process description be? Write service explorer svchost all viruses? Here, I really want to cry for conime.exe.

conime.exe is the abbreviation of Console IME, that is, IME console
It is normal by itself. When cmd is started, it starts with it. The most typical function of it is to control the input method under the command line
You can first start cmd, and then in the command line window, press ctrl+space and you will see that the Chinese input method under the command line is called out
Now you end the conime.exe process in the Task Manager and then try to use the Chinese input method under the command line...
In addition, at present, conime.exe must have cmd or other programs to execute. Directly executing conime.exe will not be successful. For example, if you kill it and then execute conime.exe again, check the Task Manager and find that there is no conime.exe process at all

Under the condition that the normal file is not replaced, it is completely unscientific to casually conjecture that it is already a virus or a Trojan server

Why do some people say it is a backdoor, trojan, virus? Their statements are also very subjective
Because in the test of Hacker's Door 1.0, there is such a step in the example
rundll32 hkdoordll,DllRegisterServer conime.exe 1
But it only infects the process, not the system file. The backdoor exits when the machine restarts or the process exits, but the above is only an example provided by the author. In fact, the default infected process of Hacker's Door version 1.0 is services.exe
Based on the above information, conime.exe is a system process. If it is infected with a trojan, it is also caused by the user's improper use of the computer

Floor1　fanly121119	Posted 2007-03-02 02:24
初级用户　Posts 15　Credits 34
I just installed the YLMF 1.88 system last night. Just modified it in the registry. Change the favorites directory: Open the registry, find , find and double-click the key named 'Favorites' in the left pane, enter the path where you want the favorites to be located in the opened window (for example: e:/favorites), press F5 to refresh and exit the registry. I didn't do anything else. But when I open the command prompt, I can't switch to the Chinese input method at the command line. It could be switched in my previous system. Also, I installed the矮人DOS toolkit, but I can't reach drive D. I can only execute dir, and what is displayed are some DOS commands. I can't see the folders installed on drive C at all. I also had the矮人DOS toolkit installed in my previous system. Why are all the problems coming out now when I changed the system? Troublesome, big shots. [ Last edited by fanly121119 on 2007-3-1 at 01:27 PM ]

Floor3　fanly121119	Posted 2007-03-04 02:18
初级用户　Posts 15　Credits 34
It doesn't work. All have been tried. Could it be a system issue???

Floor4　Kinglion	Posted 2007-03-04 05:13
铂金会员　Posts 1,924　Credits 5,798　From 金獅電腦軟體工作室
If the keyboard shortcut settings are changed, then switching operations should be possible by pressing the newly set keys. 楼主,请查看一下你对语言切换快捷键的设置情况吧。

Floor5　ebfok	Posted 2007-03-04 05:22
初级用户　Posts 33　Credits 87　From cs
Check if there is conime in the process. Without this, input methods won't be supported in the command line! You need to fix this file. Copy one from someone else's machine or download one!

Floor6　ebfok	Posted 2007-03-04 05:28
初级用户　Posts 33　Credits 87　From cs
Supplementary: (provided by Baidu Baike) Description of the conime.exe process: conime.exe is an input method editor that allows users to enter complex characters and symbols using a standard keyboard! conime.exe may also be a bfghost 1.0 remote control backdoor program. This program allows attackers to access your computer, steal passwords and personal data. It is recommended to delete this process immediately." I used to always not know when this process would start quietly, and later I found that it often appears after running cmd.exe. But conime.exe is not a child process of cmd.exe, and its parent process ID is not displayed in the Task Manager. Conime is often used by viruses to infect, it is recommended to delete. Many people ask what the conime.exe process is, and most people will refer to the process descriptions on domestic and foreign websites, saying it is a virus and teaching them how to end it. Everyone knows that a conime.exe process will appear in the process after running cmd.exe. The descriptions of the process on the Internet, whether domestic or foreign, say it is a virus... Of course, maybe the virus has the same name as it, but it can't be generalized. Some people say that conime.exe is a child process of cmd.exe. I will now carefully check conime. Here sunwear is using KD to check whether the InheritedFromUniqueProcessId of the eprocess of conime.exe is the UniqueProcessId of the eprocess of cmd.exe If so, it can be explained that conime.exe is a child process of cmd.exe. Then let's take a look. PROCESS 817217c0 SessionId: 0 Cid: 04dc Peb: 7ffdf000 ParentCid: 032c DirBase: 1558f000 ObjectTable: 8170d168 TableSize: 18. Image: conime.exe PROCESS 81733460 SessionId: 0 Cid: 038c Peb: 7ffdf000 ParentCid: 02f8 DirBase: 056a1000 ObjectTable: 81692288 TableSize: 22. Image: cmd.exe Then check the eprocess of conime.exe nt!_EPROCESS .................. +0x09c UniqueProcessId : 0x000004dc .................. +0x1c8 InheritedFromUniqueProcessId : 0x0000032c .................. The process ID of conime.exe is 0x000004dc. The parent process is 0x0000032c Let's take a look at cmd.exe again nt!_EPROCESS .............. +0x09c UniqueProcessId : 0x0000038c .............. That is to say, conime.exe is not a child process of cmd.exe. And the parent process ID of conime.exe is not in the Task Manager From the name, conime.exe is related to the input method. Indeed, it is a program that handles console input method-related matters. We can do an experiment. First, we run cmd.exe, and then use ctrl+shift to switch the input method, can we switch it? We end conime with the Task Manager, and then try it? What's the result? I think if you want to write an explanation, you must give the function of the original MS program. It is a normal process in the Windows operating system. You can explain in the additional explanation that some viruses have the same name as it. Just like service explorer svchost and so on. If they are possessed by viruses (it happens frequently). Then what should the process description be? Write service explorer svchost all viruses? Here, I really want to cry for conime.exe. conime.exe is the abbreviation of Console IME, that is, IME console It is normal by itself. When cmd is started, it starts with it. The most typical function of it is to control the input method under the command line You can first start cmd, and then in the command line window, press ctrl+space and you will see that the Chinese input method under the command line is called out Now you end the conime.exe process in the Task Manager and then try to use the Chinese input method under the command line... In addition, at present, conime.exe must have cmd or other programs to execute. Directly executing conime.exe will not be successful. For example, if you kill it and then execute conime.exe again, check the Task Manager and find that there is no conime.exe process at all Under the condition that the normal file is not replaced, it is completely unscientific to casually conjecture that it is already a virus or a Trojan server Why do some people say it is a backdoor, trojan, virus? Their statements are also very subjective Because in the test of Hacker's Door 1.0, there is such a step in the example rundll32 hkdoordll,DllRegisterServer conime.exe 1 But it only infects the process, not the system file. The backdoor exits when the machine restarts or the process exits, but the above is only an example provided by the author. In fact, the default infected process of Hacker's Door version 1.0 is services.exe Based on the above information, conime.exe is a system process. If it is infected with a trojan, it is also caused by the user's improper use of the computer

Floor2　MSDN	Posted 2007-03-03 06:56
初级用户　Posts 41　Credits 32

Floor7　fanly121119	Posted 2007-03-04 07:07
初级用户　Posts 15　Credits 34
Really appreciate it. I'll give it a try first.

Floor8　fanly121119	Posted 2007-03-04 07:28
初级用户　Posts 15　Credits 34
Really grateful oh Okay