Xatrix Security

[Xcellerator]

Here is a task list I got from a new computer with RM installed (won't be pure RM cos it has other random junk on it that comes with new PCs... I'll update when I get a pure one (won't be until wednesday ) but here ya go!

Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 28 K
System 4 Console 0 256 K
smss.exe 680 Console 0 432 K
csrss.exe 728 Console 0 5,336 K
winlogon.exe 752 Console 0 2,168 K
services.exe 796 Console 0 7,108 K
lsass.exe 808 Console 0 8,872 K
svchost.exe 976 Console 0 5,480 K
svchost.exe 1056 Console 0 4,796 K
svchost.exe 1152 Console 0 25,436 K
svchost.exe 1232 Console 0 3,624 K
svchost.exe 1348 Console 0 4,040 K
ccSetMgr.exe 1404 Console 0 4,240 K
ccEvtMgr.exe 1452 Console 0 3,444 K
SPBBCSvc.exe 1556 Console 0 2,932 K
spoolsv.exe 1604 Console 0 5,564 K
SMManager.exe 1888 Console 0 16,036 K
ASFAgent.exe 1312 Console 0 3,368 K
DefWatch.exe 2000 Console 0 5,184 K
lms.exe 340 Console 0 5,004 K
RMClientEvtService.exe 1932 Console 0 7,824 K
RMEventForwardingService. 468 Console 0 2,700 K
PolicyMergerS.exe 492 Console 0 1,392 K
RMClientSecurityModule.ex 524 Console 0 5,848 K
RMPrinterWrapper.exe 704 Console 0 2,840 K
SeaPort.exe 1236 Console 0 8,924 K
Rtvscan.exe 2096 Console 0 123,952 K
TdmService.exe 2116 Console 0 16,728 K
UNS.exe 2196 Console 0 8,416 K
VCDSecS.exe 2368 Console 0 2,056 K
searchindexer.exe 2452 Console 0 39,592 K
alg.exe 2928 Console 0 3,596 K
wmiprvse.exe 3552 Console 0 19,292 K
searchprotocolhost.exe 2088 Console 0 7,180 K
wmiprvse.exe 4036 Console 0 6,236 K
PolicyMerger.exe 4676 Console 0 1,984 K
explorer.exe 2440 Console 0 20,516 K
runplugin.exe 1744 Console 0 4,436 K
smax4pnp.exe 2612 Console 0 4,656 K
jusched.exe 1096 Console 0 2,812 K
PrivacyIconClient.exe 2460 Console 0 23,996 K
WavXDocMgr.exe 3304 Console 0 4,692 K
SecureUpgrade.exe 5732 Console 0 8,668 K
Dell.ControlPoint.exe 2616 Console 0 35,408 K
BcmDeviceAndTaskStatusSer 3784 Console 0 21,024 K
Dell.UCM.exe 4176 Console 0 40,200 K
PDVDDXSrv.exe 4724 Console 0 5,824 K
VCDPlay.exe 1868 Console 0 6,580 K
reader_sl.exe 4908 Console 0 3,048 K
RMSmartCacheClient.exe 3496 Console 0 3,348 K
ccApp.exe 3228 Console 0 7,152 K
VPTray.exe 2844 Console 0 8,344 K
securusn.exe 4368 Console 0 8,704 K
rmlogoff.exe 1800 Console 0 4,448 K
SafeVol.exe 5492 Console 0 3,620 K
UserTypeIndicator.exe 4472 Console 0 2,600 K
ctfmon.exe 1644 Console 0 3,580 K
DCPSysMgr.exe 360 Console 0 6,500 K
WindowsSearch.exe 4532 Console 0 11,160 K
securusn.exe 4664 Console 0 2,564 K
searchfilterhost.exe 2416 Console 0 5,780 K
searchprotocolhost.exe 5876 Console 0 6,524 K
cmd.exe 556 Console 0 2,808 K >>>>>>This is me
tasklist.exe 5288 Console 0 4,720 K >>>>>>So's this

I can kill command with taskkill, so any ideas for useful processes to kill would be fantastic!
If I kill RMSmartCacheClient.exe will I have no internet or no filtering? I'm still connected to their proxy just not running RMSmartCacheClient.exe?

[PDN]

Very interesting list there, I was in need of a list like that a few days ago. Does anyone know how the print credits are manged, is it via one of the processes here or something else?

With regards to your question about RMSmartCacheClient.exe I think by exiting that you loose your internet connection. I think I did kill it once with process explorer and I am sure I could no longer connect to the internet.

[Xcellerator]

Yeah, your right, I need the fake RM spoofer, I'll need to cut the real one, replace it with the fake one and then log off and then on again... Could be tricky, but will probably work...
In answer to your question, printer credits are managed by the RMPrinterWrapper.exe process I believe, or maybe StausReporter.exe...

[PDN]

I shall try killing those processes tomorrow. On the CC3 virtual image from Binky the print credits are configured via the Management Console so perhaps there is deep integration between the the RM MMC and the processes you mentioned so I wonder if killing will affect my already dwindling print credits. (I started from 300 at the start of this year)

[Xcellerator]

yeah, think you may be right there, because the printing credits is the only thing stopping you from printing something when you hit 0. So RMPrinterWrapper.exe and StatusReporter.exe must work together with RMMC which is integrated into all accounts...

Cutting them, could work..

[cheesepuff]

Or its a database...
We should make a whitepaper on Printer credits..

[Xcellerator]

yeah that sounds like a good idea...

I don't know anything about a database, but surely even if it was, if it you were to cut the clients to the 'database', i.e RMPrinterWrapper.exe and possibly client32.exe, the database would be useless on you...

BTW, I am taking a stab in the dark here, I only say RMPrinterWrapper.exe because it has the word printer in it...

[TJ_2k7]

Printer credits probably uses a SQL Database.
If thats so, stopping the process could either stop printing all together since it can't check or it would just let you print.

I'd say it wasn't the latter since my school doesn't use printer credits and in statue reporter it always say 'Cannot connect to database'

[Xcellerator]

Hmmm.... I'll try that at lunch time tommorrow...

[PDN]

I was going to use fronter today to install Process Explorer but the internet is being slow again so I tried to do a shortcut like this:

Code: Select all

tskill *process*.exe

Problem is I don't think it worked because RMPrinterWrapper.exe and StatusReporter.exe need to be given their path in the shortcut like
C:Program Files\RM\Cheese\cheese.exe

but I don't know what the path is. Does anybody know what the respective paths to apps are?