some ? in windows register

c:\windows\tasks is where .job files are located. .Job files are Windows
Task Scheduler Task Objects. .Job files are created when you use the Task
Schedule to Schedule something.

c:\windows\tasks is where you can find Add Scheduled Task.

c:\windows\tasks is where malware sometimes likes to hide.

c:\windows\tasks\ipfqykg\crfyNpnoo.dat is probably related to some kind of
malware.

wowexec.exe is used in conjunction with ntvdm.exe to run old MS-DOS
16-bit applications. ntvdm.exe is NTVirtualDOSMahine. NT is New
Technology. Windows XP is really windows NT 5.1.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:A2EE8782-9AD9-4C35-B674-581A026864C6@microsoft.com,
giordi <giordi RemoveThis @discussions.microsoft.com> hunted and pecked:
> Ciao,
> in my winXP sp2 register, I have found some commands with a "?" after the
> disk letter "c", as for example:
> c?\windows\microsoft.net\framework\v2.0.50727\Microsfot.Common.tasks .
> In other word "?" replaces ":" .
> Is there a possible reason or maybe I should correct all of them?
> Let you observe in addition that to solve (I hope) a strange problem
> (ntvdm.exe started after adsl connection occupying the whole cpu), I found
> and removed in HKLM\software\microsoft\user media\tool user, the comand
> c:\windows\tasks\ipfqykg\crfyNpnoo.dat (I checked that this occurred each
> time before ntvdm.exe). I do not know if there is some correlation, but I
> suspect some problem with microsoft.net or asp.net. I have not found any
> virus or malware.. Thank you in advance for your help.
 >> Stay informed about: some ? in windows register 

And I've checked all our systems here and cannot find:

HKLM\software\microsoft\user media\tool user

in the registry on any of them.

"Wesley Vogel" <123WVogel955 DeleteThis @comcast.net> wrote in message
news:OOg29mmFHHA.5000@TK2MSFTNGP03.phx.gbl...
> c:\windows\tasks is where .job files are located. .Job files are Windows
> Task Scheduler Task Objects. .Job files are created when you use the Task
> Schedule to Schedule something.
>
> c:\windows\tasks is where you can find Add Scheduled Task.
>
> c:\windows\tasks is where malware sometimes likes to hide.
>
> c:\windows\tasks\ipfqykg\crfyNpnoo.dat is probably related to some kind of
> malware.
>
> wowexec.exe is used in conjunction with ntvdm.exe to run old MS-DOS
> 16-bit applications. ntvdm.exe is NTVirtualDOSMahine. NT is New
> Technology. Windows XP is really windows NT 5.1.
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In news:A2EE8782-9AD9-4C35-B674-581A026864C6@microsoft.com,
> giordi <giordi DeleteThis @discussions.microsoft.com> hunted and pecked:
>> Ciao,
>> in my winXP sp2 register, I have found some commands with a "?" after the
>> disk letter "c", as for example:
>> c?\windows\microsoft.net\framework\v2.0.50727\Microsfot.Common.tasks .
>> In other word "?" replaces ":" .
>> Is there a possible reason or maybe I should correct all of them?
>> Let you observe in addition that to solve (I hope) a strange problem
>> (ntvdm.exe started after adsl connection occupying the whole cpu), I
>> found
>> and removed in HKLM\software\microsoft\user media\tool user, the comand
>> c:\windows\tasks\ipfqykg\crfyNpnoo.dat (I checked that this occurred each
>> time before ntvdm.exe). I do not know if there is some correlation, but I
>> suspect some problem with microsoft.net or asp.net. I have not found any
>> virus or malware.. Thank you in advance for your help.
>
 >> Stay informed about: some ? in windows register 

Thank you very much for your answers:
As I said, using a lot of antivirus/antispy it was not possible to find any
malware. However, in the windows directory I found also a ".exe" with random
name (like dtyxw..exe) that was referring to the register key "video
streaming", present at the same level of "user media". In "video streaming" a
numerical value was settled to the string "license expire data" and I removed
also this value. Initially I suspected of some troubles caused by Windows
Desktop Live that was located in c:\windows\tasks as well, and I removed it
too. By using Norton GoBack I have seen that ntvdm.exe started after the adsl
connection (rasphone.exe): then a ping to the google site occurs, and some
"random" .exe are launched up to the final one
"c:\windows\tasks\ipfqykg\crfyNpnoo.dat": then ntvdm.exe started.
Yesterday, I found that c:\windows\tasks\ipfqykg\crfyNpnoo.dat was present
in "HKLM\software\microsoft\user media\tool user" and I removed this command.
For the moment, it seems that ntvdm.exe does not start more, but it is not
clear what caused the problem and if it is really solved.
Do you think I should delete "user media" and "video streaming" in the
windows register? Thank you for your additional comments.

"NewScience" wrote:

> And I've checked all our systems here and cannot find:
>
> HKLM\software\microsoft\user media\tool user
>
> in the registry on any of them.
>
> "Wesley Vogel" <123WVogel955 RemoveThis @comcast.net> wrote in message
> news:OOg29mmFHHA.5000@TK2MSFTNGP03.phx.gbl...
> > c:\windows\tasks is where .job files are located. .Job files are Windows
> > Task Scheduler Task Objects. .Job files are created when you use the Task
> > Schedule to Schedule something.
> >
> > c:\windows\tasks is where you can find Add Scheduled Task.
> >
> > c:\windows\tasks is where malware sometimes likes to hide.
> >
> > c:\windows\tasks\ipfqykg\crfyNpnoo.dat is probably related to some kind of
> > malware.
> >
> > wowexec.exe is used in conjunction with ntvdm.exe to run old MS-DOS
> > 16-bit applications. ntvdm.exe is NTVirtualDOSMahine. NT is New
> > Technology. Windows XP is really windows NT 5.1.
> >
> > --
> > Hope this helps. Let us know.
> >
> > Wes
> > MS-MVP Windows Shell/User
> >
> > In news:A2EE8782-9AD9-4C35-B674-581A026864C6@microsoft.com,
> > giordi <giordi RemoveThis @discussions.microsoft.com> hunted and pecked:
> >> Ciao,
> >> in my winXP sp2 register, I have found some commands with a "?" after the
> >> disk letter "c", as for example:
> >> c?\windows\microsoft.net\framework\v2.0.50727\Microsfot.Common.tasks .
> >> In other word "?" replaces ":" .
> >> Is there a possible reason or maybe I should correct all of them?
> >> Let you observe in addition that to solve (I hope) a strange problem
> >> (ntvdm.exe started after adsl connection occupying the whole cpu), I
> >> found
> >> and removed in HKLM\software\microsoft\user media\tool user, the comand
> >> c:\windows\tasks\ipfqykg\crfyNpnoo.dat (I checked that this occurred each
> >> time before ntvdm.exe). I do not know if there is some correlation, but I
> >> suspect some problem with microsoft.net or asp.net. I have not found any
> >> virus or malware.. Thank you in advance for your help.
> >
>
>
>
 >> Stay informed about: some ? in windows register 

An additional comment to Wes: are you sure that c?\ is comparable to \\?\ ,
as indicated in the Microsoft link you suggested, for cases >260 characters?
And why to use this setting for command as
c?\windows\microsoft.net\framework\ v2.0.50727 , where the characters are no
more than 20 or 30..?
Thank you.

"NewScience" wrote:

> And I've checked all our systems here and cannot find:
>
> HKLM\software\microsoft\user media\tool user
>
> in the registry on any of them.
>
> "Wesley Vogel" <123WVogel955 DeleteThis @comcast.net> wrote in message
> news:OOg29mmFHHA.5000@TK2MSFTNGP03.phx.gbl...
> > c:\windows\tasks is where .job files are located. .Job files are Windows
> > Task Scheduler Task Objects. .Job files are created when you use the Task
> > Schedule to Schedule something.
> >
> > c:\windows\tasks is where you can find Add Scheduled Task.
> >
> > c:\windows\tasks is where malware sometimes likes to hide.
> >
> > c:\windows\tasks\ipfqykg\crfyNpnoo.dat is probably related to some kind of
> > malware.
> >
> > wowexec.exe is used in conjunction with ntvdm.exe to run old MS-DOS
> > 16-bit applications. ntvdm.exe is NTVirtualDOSMahine. NT is New
> > Technology. Windows XP is really windows NT 5.1.
> >
> > --
> > Hope this helps. Let us know.
> >
> > Wes
> > MS-MVP Windows Shell/User
> >
> > In news:A2EE8782-9AD9-4C35-B674-581A026864C6@microsoft.com,
> > giordi <giordi DeleteThis @discussions.microsoft.com> hunted and pecked:
> >> Ciao,
> >> in my winXP sp2 register, I have found some commands with a "?" after the
> >> disk letter "c", as for example:
> >> c?\windows\microsoft.net\framework\v2.0.50727\Microsfot.Common.tasks .
> >> In other word "?" replaces ":" .
> >> Is there a possible reason or maybe I should correct all of them?
> >> Let you observe in addition that to solve (I hope) a strange problem
> >> (ntvdm.exe started after adsl connection occupying the whole cpu), I
> >> found
> >> and removed in HKLM\software\microsoft\user media\tool user, the comand
> >> c:\windows\tasks\ipfqykg\crfyNpnoo.dat (I checked that this occurred each
> >> time before ntvdm.exe). I do not know if there is some correlation, but I
> >> suspect some problem with microsoft.net or asp.net. I have not found any
> >> virus or malware.. Thank you in advance for your help.
> >
>
>
>
 >> Stay informed about: some ? in windows register 

Then you probably do not have the malware that creates that key.

At least three people have had it.

http://www.google.com/search?hl=en&lr=&as_qdr=all&q=+%22crfyNpnoo.dat%...btnG=Se

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:uLaVExnFHHA.1816@TK2MSFTNGP06.phx.gbl,
NewScience <newscience83.TakeThisOut@usadatanet.net> hunted and pecked:
> And I've checked all our systems here and cannot find:
>
> HKLM\software\microsoft\user media\tool user
>
> in the registry on any of them.
>
> "Wesley Vogel" <123WVogel955.TakeThisOut@comcast.net> wrote in message
> news:OOg29mmFHHA.5000@TK2MSFTNGP03.phx.gbl...
>> c:\windows\tasks is where .job files are located. .Job files are Windows
>> Task Scheduler Task Objects. .Job files are created when you use the
>> Task Schedule to Schedule something.
>>
>> c:\windows\tasks is where you can find Add Scheduled Task.
>>
>> c:\windows\tasks is where malware sometimes likes to hide.
>>
>> c:\windows\tasks\ipfqykg\crfyNpnoo.dat is probably related to some kind
>> of malware.
>>
>> wowexec.exe is used in conjunction with ntvdm.exe to run old MS-DOS
>> 16-bit applications. ntvdm.exe is NTVirtualDOSMahine. NT is New
>> Technology. Windows XP is really windows NT 5.1.
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news:A2EE8782-9AD9-4C35-B674-581A026864C6@microsoft.com,
>> giordi <giordi.TakeThisOut@discussions.microsoft.com> hunted and pecked:
>>> Ciao,
>>> in my winXP sp2 register, I have found some commands with a "?" after
>>> the disk letter "c", as for example:
>>> c?\windows\microsoft.net\framework\v2.0.50727\Microsfot.Common.tasks .
>>> In other word "?" replaces ":" .
>>> Is there a possible reason or maybe I should correct all of them?
>>> Let you observe in addition that to solve (I hope) a strange problem
>>> (ntvdm.exe started after adsl connection occupying the whole cpu), I
>>> found
>>> and removed in HKLM\software\microsoft\user media\tool user, the comand
>>> c:\windows\tasks\ipfqykg\crfyNpnoo.dat (I checked that this occurred
>>> each time before ntvdm.exe). I do not know if there is some
>>> correlation, but I suspect some problem with microsoft.net or asp.net.
>>> I have not found any virus or malware.. Thank you in advance for your
>>> help.
 >> Stay informed about: some ? in windows register 

The three people you cited are always my self (!)
It is time that I am searching a solution..
What about the other question? (i.e. c?\..)

"Wesley Vogel" wrote:

> Then you probably do not have the malware that creates that key.
>
> At least three people have had it.
>
> http://www.google.com/search?hl=en&lr=&as_qdr=all&q=+%22crfyNpnoo.dat%...btnG=Se
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In news:uLaVExnFHHA.1816@TK2MSFTNGP06.phx.gbl,
> NewScience <newscience83 RemoveThis @usadatanet.net> hunted and pecked:
> > And I've checked all our systems here and cannot find:
> >
> > HKLM\software\microsoft\user media\tool user
> >
> > in the registry on any of them.
> >
> > "Wesley Vogel" <123WVogel955 RemoveThis @comcast.net> wrote in message
> > news:OOg29mmFHHA.5000@TK2MSFTNGP03.phx.gbl...
> >> c:\windows\tasks is where .job files are located. .Job files are Windows
> >> Task Scheduler Task Objects. .Job files are created when you use the
> >> Task Schedule to Schedule something.
> >>
> >> c:\windows\tasks is where you can find Add Scheduled Task.
> >>
> >> c:\windows\tasks is where malware sometimes likes to hide.
> >>
> >> c:\windows\tasks\ipfqykg\crfyNpnoo.dat is probably related to some kind
> >> of malware.
> >>
> >> wowexec.exe is used in conjunction with ntvdm.exe to run old MS-DOS
> >> 16-bit applications. ntvdm.exe is NTVirtualDOSMahine. NT is New
> >> Technology. Windows XP is really windows NT 5.1.
> >>
> >> --
> >> Hope this helps. Let us know.
> >>
> >> Wes
> >> MS-MVP Windows Shell/User
> >>
> >> In news:A2EE8782-9AD9-4C35-B674-581A026864C6@microsoft.com,
> >> giordi <giordi RemoveThis @discussions.microsoft.com> hunted and pecked:
> >>> Ciao,
> >>> in my winXP sp2 register, I have found some commands with a "?" after
> >>> the disk letter "c", as for example:
> >>> c?\windows\microsoft.net\framework\v2.0.50727\Microsfot.Common.tasks .
> >>> In other word "?" replaces ":" .
> >>> Is there a possible reason or maybe I should correct all of them?
> >>> Let you observe in addition that to solve (I hope) a strange problem
> >>> (ntvdm.exe started after adsl connection occupying the whole cpu), I
> >>> found
> >>> and removed in HKLM\software\microsoft\user media\tool user, the comand
> >>> c:\windows\tasks\ipfqykg\crfyNpnoo.dat (I checked that this occurred
> >>> each time before ntvdm.exe). I do not know if there is some
> >>> correlation, but I suspect some problem with microsoft.net or asp.net.
> >>> I have not found any virus or malware.. Thank you in advance for your
> >>> help.
>
>
 >> Stay informed about: some ? in windows register 

giordi,

dtyxw.exe is probably some sort of malware. I would delete it, but first...

In your Windows folder, right click dtyxw.exe | Properties | Version tab

There should be a description on both General and Version tabs.

This info is part of the file and not all files have real good info.
Especially if it is spyware or a virus. Or whoever put it together was lazy
or secretive.

On the Version tab.

Click a category on the left to display the information on the right.

Other version information
Item Name:
Company
File Version
Internal Name
Language
Original File Name
Product Name
Product Version

Sometimes, if someone was really industrious, there is info under the
Summary tab also.

16-bit programs do not have a Version tab.
-----

rasphone.exe is Remote Access Phonebook and is a 32 bit program on my
machine.

rasphone.exe should not start ntvdm.exe.

rasphone.exe is related to the Remote Access Connection Manager service.
rasphone.exe will not start if the Remote Access Connection Manager service
is not running.

My GUESS is that you got some kind of malware that might have installed a
dialer.

See Fraudulent dialers
http://en.wikipedia.org/wiki/Dialer#Fraudulent_dialers
-----

c:\windows\tasks\ipfqykg\crfyNpnoo.dat

I would delete the ipfqykg folder.

Apparently you have posted before.
ping to google
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=...rosoft.

From that post...

ntdvm.exe -f -i1

Ntdvm.exe is a Trojan. Ntvdm.exe is a legit XP file.

Unless Ntdvm.exe was a typo, do a Search on your machine for Ntdvm.exe.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:8683D581-0AF4-4ADC-A064-875C63D54042@microsoft.com,
giordi <giordi.TakeThisOut@discussions.microsoft.com> hunted and pecked:
> Thank you very much for your answers:
> As I said, using a lot of antivirus/antispy it was not possible to find
> any malware. However, in the windows directory I found also a ".exe" with
> random name (like dtyxw..exe) that was referring to the register key
> "video streaming", present at the same level of "user media". In "video
> streaming" a numerical value was settled to the string "license expire
> data" and I removed also this value. Initially I suspected of some
> troubles caused by Windows Desktop Live that was located in
> c:\windows\tasks as well, and I removed it too. By using Norton GoBack I
> have seen that ntvdm.exe started after the adsl connection
> (rasphone.exe): then a ping to the google site occurs, and some "random"
> .exe are launched up to the final one
> "c:\windows\tasks\ipfqykg\crfyNpnoo.dat": then ntvdm.exe started.
> Yesterday, I found that c:\windows\tasks\ipfqykg\crfyNpnoo.dat was present
> in "HKLM\software\microsoft\user media\tool user" and I removed this
> command. For the moment, it seems that ntvdm.exe does not start more, but
> it is not clear what caused the problem and if it is really solved.
> Do you think I should delete "user media" and "video streaming" in the
> windows register? Thank you for your additional comments.
>
> "NewScience" wrote:
>
>> And I've checked all our systems here and cannot find:
>>
>> HKLM\software\microsoft\user media\tool user
>>
>> in the registry on any of them.
>>
>> "Wesley Vogel" <123WVogel955.TakeThisOut@comcast.net> wrote in message
>> news:OOg29mmFHHA.5000@TK2MSFTNGP03.phx.gbl...
>>> c:\windows\tasks is where .job files are located. .Job files are
>>> Windows Task Scheduler Task Objects. .Job files are created when you
>>> use the Task Schedule to Schedule something.
>>>
>>> c:\windows\tasks is where you can find Add Scheduled Task.
>>>
>>> c:\windows\tasks is where malware sometimes likes to hide.
>>>
>>> c:\windows\tasks\ipfqykg\crfyNpnoo.dat is probably related to some kind
>>> of malware.
>>>
>>> wowexec.exe is used in conjunction with ntvdm.exe to run old MS-DOS
>>> 16-bit applications. ntvdm.exe is NTVirtualDOSMahine. NT is New
>>> Technology. Windows XP is really windows NT 5.1.
>>>
>>> --
>>> Hope this helps. Let us know.
>>>
>>> Wes
>>> MS-MVP Windows Shell/User
>>>
>>> In news:A2EE8782-9AD9-4C35-B674-581A026864C6@microsoft.com,
>>> giordi <giordi.TakeThisOut@discussions.microsoft.com> hunted and pecked:
>>>> Ciao,
>>>> in my winXP sp2 register, I have found some commands with a "?" after
>>>> the disk letter "c", as for example:
>>>> c?\windows\microsoft.net\framework\v2.0.50727\Microsfot.Common.tasks .
>>>> In other word "?" replaces ":" .
>>>> Is there a possible reason or maybe I should correct all of them?
>>>> Let you observe in addition that to solve (I hope) a strange problem
>>>> (ntvdm.exe started after adsl connection occupying the whole cpu), I
>>>> found
>>>> and removed in HKLM\software\microsoft\user media\tool user, the comand
>>>> c:\windows\tasks\ipfqykg\crfyNpnoo.dat (I checked that this occurred
>>>> each time before ntvdm.exe). I do not know if there is some
>>>> correlation, but I suspect some problem with microsoft.net or asp.net.
>>>> I have not found any virus or malware.. Thank you in advance for your
>>>> help.
 >> Stay informed about: some ? in windows register 

Read this whole thread.
http://groups.google.com/group/microsoft.public.windowsxp.general/brow...frm/thr

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:814E7B96-348E-4B9B-A061-17FF6EB4A85A@microsoft.com,
giordi <giordi.DeleteThis@discussions.microsoft.com> hunted and pecked:
> An additional comment to Wes: are you sure that c?\ is comparable to \\?\
> , as indicated in the Microsoft link you suggested, for cases >260
> characters? And why to use this setting for command as
> c?\windows\microsoft.net\framework\ v2.0.50727 , where the characters are
> no more than 20 or 30..?
> Thank you.
>
> "NewScience" wrote:
>
>> And I've checked all our systems here and cannot find:
>>
>> HKLM\software\microsoft\user media\tool user
>>
>> in the registry on any of them.
>>
>> "Wesley Vogel" <123WVogel955.DeleteThis@comcast.net> wrote in message
>> news:OOg29mmFHHA.5000@TK2MSFTNGP03.phx.gbl...
>>> c:\windows\tasks is where .job files are located. .Job files are
>>> Windows Task Scheduler Task Objects. .Job files are created when you
>>> use the Task Schedule to Schedule something.
>>>
>>> c:\windows\tasks is where you can find Add Scheduled Task.
>>>
>>> c:\windows\tasks is where malware sometimes likes to hide.
>>>
>>> c:\windows\tasks\ipfqykg\crfyNpnoo.dat is probably related to some kind
>>> of malware.
>>>
>>> wowexec.exe is used in conjunction with ntvdm.exe to run old MS-DOS
>>> 16-bit applications. ntvdm.exe is NTVirtualDOSMahine. NT is New
>>> Technology. Windows XP is really windows NT 5.1.
>>>
>>> --
>>> Hope this helps. Let us know.
>>>
>>> Wes
>>> MS-MVP Windows Shell/User
>>>
>>> In news:A2EE8782-9AD9-4C35-B674-581A026864C6@microsoft.com,
>>> giordi <giordi.DeleteThis@discussions.microsoft.com> hunted and pecked:
>>>> Ciao,
>>>> in my winXP sp2 register, I have found some commands with a "?" after
>>>> the disk letter "c", as for example:
>>>> c?\windows\microsoft.net\framework\v2.0.50727\Microsfot.Common.tasks .
>>>> In other word "?" replaces ":" .
>>>> Is there a possible reason or maybe I should correct all of them?
>>>> Let you observe in addition that to solve (I hope) a strange problem
>>>> (ntvdm.exe started after adsl connection occupying the whole cpu), I
>>>> found
>>>> and removed in HKLM\software\microsoft\user media\tool user, the comand
>>>> c:\windows\tasks\ipfqykg\crfyNpnoo.dat (I checked that this occurred
>>>> each time before ntvdm.exe). I do not know if there is some
>>>> correlation, but I suspect some problem with microsoft.net or asp.net.
>>>> I have not found any virus or malware.. Thank you in advance for your
>>>> help.
 >> Stay informed about: some ? in windows register 

I see that now.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:DA50F17B-971F-42A0-B983-F49A913EC2A3@microsoft.com,
giordi <giordi.DeleteThis@discussions.microsoft.com> hunted and pecked:
> The three people you cited are always my self (!)
> It is time that I am searching a solution..
> What about the other question? (i.e. c?\..)
>
> "Wesley Vogel" wrote:
>
>> Then you probably do not have the malware that creates that key.
>>
>> At least three people have had it.
>>
>>
http://www.google.com/search?hl=en&lr=&as_qdr=all&q=+%22crfyNpnoo.dat%...btnG=Se
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news:uLaVExnFHHA.1816@TK2MSFTNGP06.phx.gbl,
>> NewScience <newscience83.DeleteThis@usadatanet.net> hunted and pecked:
>>> And I've checked all our systems here and cannot find:
>>>
>>> HKLM\software\microsoft\user media\tool user
>>>
>>> in the registry on any of them.
>>>
>>> "Wesley Vogel" <123WVogel955.DeleteThis@comcast.net> wrote in message
>>> news:OOg29mmFHHA.5000@TK2MSFTNGP03.phx.gbl...
>>>> c:\windows\tasks is where .job files are located. .Job files are
>>>> Windows Task Scheduler Task Objects. .Job files are created when you
>>>> use the Task Schedule to Schedule something.
>>>>
>>>> c:\windows\tasks is where you can find Add Scheduled Task.
>>>>
>>>> c:\windows\tasks is where malware sometimes likes to hide.
>>>>
>>>> c:\windows\tasks\ipfqykg\crfyNpnoo.dat is probably related to some kind
>>>> of malware.
>>>>
>>>> wowexec.exe is used in conjunction with ntvdm.exe to run old MS-DOS
>>>> 16-bit applications. ntvdm.exe is NTVirtualDOSMahine. NT is New
>>>> Technology. Windows XP is really windows NT 5.1.
>>>>
>>>> --
>>>> Hope this helps. Let us know.
>>>>
>>>> Wes
>>>> MS-MVP Windows Shell/User
>>>>
>>>> In news:A2EE8782-9AD9-4C35-B674-581A026864C6@microsoft.com,
>>>> giordi <giordi.DeleteThis@discussions.microsoft.com> hunted and pecked:
>>>>> Ciao,
>>>>> in my winXP sp2 register, I have found some commands with a "?" after
>>>>> the disk letter "c", as for example:
>>>>> c?\windows\microsoft.net\framework\v2.0.50727\Microsfot.Common.tasks .
>>>>> In other word "?" replaces ":" .
>>>>> Is there a possible reason or maybe I should correct all of them?
>>>>> Let you observe in addition that to solve (I hope) a strange problem
>>>>> (ntvdm.exe started after adsl connection occupying the whole cpu), I
>>>>> found
>>>>> and removed in HKLM\software\microsoft\user media\tool user, the
>>>>> comand c:\windows\tasks\ipfqykg\crfyNpnoo.dat (I checked that this
>>>>> occurred each time before ntvdm.exe). I do not know if there is some
>>>>> correlation, but I suspect some problem with microsoft.net or asp.net.
>>>>> I have not found any virus or malware.. Thank you in advance for your
>>>>> help.
 >> Stay informed about: some ? in windows register