Supplementary: (provided by Baidu Baike)
Description of the conime.exe process: conime.exe is an input method editor that allows users to enter complex characters and symbols using a standard keyboard! conime.exe may also be a bfghost 1.0 remote control backdoor program. This program allows attackers to access your computer, steal passwords and personal data. It is recommended to delete this process immediately."
I used to always not know when this process would start quietly, and later I found that it often appears after running cmd.exe. But conime.exe is not a child process of cmd.exe, and its parent process ID is not displayed in the Task Manager.
Conime is often used by viruses to infect, it is recommended to delete.
Many people ask what the conime.exe process is, and most people will refer to the process descriptions on domestic and foreign websites, saying it is a virus and teaching them how to end it.
Everyone knows that a conime.exe process will appear in the process after running cmd.exe.
The descriptions of the process on the Internet, whether domestic or foreign, say it is a virus...
Of course, maybe the virus has the same name as it, but it can't be generalized.
Some people say that conime.exe is a child process of cmd.exe.
I will now carefully check conime.
Here sunwear is using KD to check whether the InheritedFromUniqueProcessId of the eprocess of conime.exe is the UniqueProcessId of the eprocess of cmd.exe
If so, it can be explained that conime.exe is a child process of cmd.exe. Then let's take a look.
PROCESS 817217c0 SessionId: 0 Cid: 04dc Peb: 7ffdf000 ParentCid: 032c
DirBase: 1558f000 ObjectTable: 8170d168 TableSize: 18.
Image: conime.exe
PROCESS 81733460 SessionId: 0 Cid: 038c Peb: 7ffdf000 ParentCid: 02f8
DirBase: 056a1000 ObjectTable: 81692288 TableSize: 22.
Image: cmd.exe
Then check the eprocess of conime.exe
nt!_EPROCESS
..................
+0x09c UniqueProcessId : 0x000004dc
..................
+0x1c8 InheritedFromUniqueProcessId : 0x0000032c
..................
The process ID of conime.exe is 0x000004dc. The parent process is 0x0000032c
Let's take a look at cmd.exe again
nt!_EPROCESS
..............
+0x09c UniqueProcessId : 0x0000038c
..............
That is to say, conime.exe is not a child process of cmd.exe.
And the parent process ID of conime.exe is not in the Task Manager
From the name, conime.exe is related to the input method. Indeed, it is a program that handles console input method-related matters.
We can do an experiment. First, we run cmd.exe, and then use ctrl+shift to switch the input method, can we switch it?
We end conime with the Task Manager, and then try it? What's the result?
I think if you want to write an explanation, you must give the function of the original MS program. It is a normal process in the Windows operating system. You can explain in the additional explanation that some viruses have the same name as it.
Just like service explorer svchost and so on. If they are possessed by viruses (it happens frequently). Then what should the process description be? Write service explorer svchost all viruses? Here, I really want to cry for conime.exe.
conime.exe is the abbreviation of Console IME, that is, IME console
It is normal by itself. When cmd is started, it starts with it. The most typical function of it is to control the input method under the command line
You can first start cmd, and then in the command line window, press ctrl+space and you will see that the Chinese input method under the command line is called out
Now you end the conime.exe process in the Task Manager and then try to use the Chinese input method under the command line...
In addition, at present, conime.exe must have cmd or other programs to execute. Directly executing conime.exe will not be successful. For example, if you kill it and then execute conime.exe again, check the Task Manager and find that there is no conime.exe process at all
Under the condition that the normal file is not replaced, it is completely unscientific to casually conjecture that it is already a virus or a Trojan server
Why do some people say it is a backdoor, trojan, virus? Their statements are also very subjective
Because in the test of Hacker's Door 1.0, there is such a step in the example
rundll32 hkdoordll,DllRegisterServer conime.exe 1
But it only infects the process, not the system file. The backdoor exits when the machine restarts or the process exits, but the above is only an example provided by the author. In fact, the default infected process of Hacker's Door version 1.0 is services.exe
Based on the above information, conime.exe is a system process. If it is infected with a trojan, it is also caused by the user's improper use of the computer
