[Last Call] Learn how to a build a cloud-first strategyRegister Now


Removing  wowexec.exe

Posted on 2005-04-25
Medium Priority
Last Modified: 2010-05-19
I have a Windows 2000 SP4 PC that has a process running called _wowexec.exe. There is a space in front of the "w" and I'm not sure if this is a valid process or not?I have seen this process before associated with 16 bit programs, but never with the preceding space.  If this is not a valid process I would like to know how to get rid of it? I have run the folowing programs: Spy Sweper, SAV, spybot , and adaware.
Question by:Notageek69
LVL 25

Expert Comment

ID: 13861612
is there a space in front of wowexec.exe or is there and underscore. you say space, but then you displayed an underscore???

If you have the underscore (which i think you do) then it is indeed spyware. did you run updated versions spybot and adaware? they should have picked it up.  Hijackthis should pick it up.

LVL 25

Expert Comment

ID: 13861637
if you dont know where/how do run hijackthis, here it is:

Download HijackThis from here, run it and Save the LOG file:

Then Post that log at this site >> http://www.hijackthis.de/index.php?langselect=english
and it will automatically analyze it for u,,, Fix the entries which it labels as Nasty :)
To Fix, check the lines and click on Fix Checked !!

Expert Comment

ID: 13862187

check this link: http://www.liutilities.com/products/wintaskspro/processlibrary/wowexec/

"wowexec.exe is a part the operating system, and supports the use of 16-bit procseses.This program is important for the stable and secure running of your computer and should not be terminated."

I've seen (if I remeber right) the same process run on my PC, with name " wowexec.exe" (notice the space) and if i remeber right, the process is just under "NTVDM.exe" on Task Manager's Process List like:


Which means just that your PC is running some 16bit applications (with wowexec.exe) that run _inside_ NT's 16bit Virtual Machine (NTVDM.exe).
Prep for the ITIL® Foundation Certification Exam

December’s Course of the Month is now available! Enroll to learn ITIL® Foundation best practices for delivering IT services effectively and efficiently.

LVL 32

Expert Comment

ID: 13862214
Yes, a space in front of wowexec.exe is quite normal. Normally you'd see something like this:


where app16bit.exe is the 16-bit app that needs wowexec.exe
LVL 25

Accepted Solution

mikeleebrla earned 2000 total points
ID: 13866402
wowexec.exe is part of the OS, _wowexec.exe however is malicious spyware.  Come on guys, that is the oldest trick in the book. (making a malicious filename similar the a valid filename so you won't think it's malicious.  Since he put _wowexec.exe in the question we will have to assume that the file name does in fact have an underscore infront of it, which means it is malicious.

Author Comment

ID: 13866711
After further investigation there were actually two processes running. There was a wowexec.exe with a preceding space that seemed to be valid, and an _wowexec.exe that was also running. I ran avast as was suggested. It did not pick this up, but picked up a couple of other things that it removed. So, I went into the registry did a search and deleted all values containing the _wowexec.exe and also did the same thing on the hard drive. It's gone. Thanks for all of your help. I apologize for not doing my homework on wowexec. I am familiar with liiutilities and should have looked there first.  
Thanks Again!
LVL 31

Expert Comment

by:Wayne Barron
ID: 15722995
No comment has been added to this question in more than 21 days, so it is now classified as abandoned..
I will leave the following recommendation for this question in the Cleanup topic area:
[Accept: mikeleebrla]

Any objections should be posted here in the next 4 days. After that time, the question will be closed.

EE Cleanup Volunteer

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Tech giants such as Amazon and Google have sold Alexa and Echo to such an extent that they have become household names. And soon they are expected to be used by commoners in their homes, ordering takeout, picking out a song, answering trivia questio…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
Please read the paragraph below before following the instructions in the video — there are important caveats in the paragraph that I did not mention in the video. If your PaperPort 12 or PaperPort 14 is failing to start, or crashing, or hanging, …
Suggested Courses
Course of the Month18 days, 6 hours left to enroll

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question