Notageek69
asked on
Removing wowexec.exe
I have a Windows 2000 SP4 PC that has a process running called _wowexec.exe. There is a space in front of the "w" and I'm not sure if this is a valid process or not?I have seen this process before associated with 16 bit programs, but never with the preceding space. If this is not a valid process I would like to know how to get rid of it? I have run the folowing programs: Spy Sweper, SAV 9.0.1.1000, spybot , and adaware.
if you dont know where/how do run hijackthis, here it is:
Download HijackThis from here, run it and Save the LOG file:
http://tools.radiosplace.com/HijackThis.exe
Then Post that log at this site >> http://www.hijackthis.de/index.php?langselect=english
and it will automatically analyze it for u,,, Fix the entries which it labels as Nasty :)
To Fix, check the lines and click on Fix Checked !!
Download HijackThis from here, run it and Save the LOG file:
http://tools.radiosplace.com/HijackThis.exe
Then Post that log at this site >> http://www.hijackthis.de/index.php?langselect=english
and it will automatically analyze it for u,,, Fix the entries which it labels as Nasty :)
To Fix, check the lines and click on Fix Checked !!
hmmm....
check this link: http://www.liutilities.com/products/wintaskspro/processlibrary/wowexec/
"wowexec.exe is a part the operating system, and supports the use of 16-bit procseses.This program is important for the stable and secure running of your computer and should not be terminated."
I've seen (if I remeber right) the same process run on my PC, with name " wowexec.exe" (notice the space) and if i remeber right, the process is just under "NTVDM.exe" on Task Manager's Process List like:
...
NTVDM.exe
wowexec.exe
...
Which means just that your PC is running some 16bit applications (with wowexec.exe) that run _inside_ NT's 16bit Virtual Machine (NTVDM.exe).
check this link: http://www.liutilities.com/products/wintaskspro/processlibrary/wowexec/
"wowexec.exe is a part the operating system, and supports the use of 16-bit procseses.This program is important for the stable and secure running of your computer and should not be terminated."
I've seen (if I remeber right) the same process run on my PC, with name " wowexec.exe" (notice the space) and if i remeber right, the process is just under "NTVDM.exe" on Task Manager's Process List like:
...
NTVDM.exe
wowexec.exe
...
Which means just that your PC is running some 16bit applications (with wowexec.exe) that run _inside_ NT's 16bit Virtual Machine (NTVDM.exe).
Yes, a space in front of wowexec.exe is quite normal. Normally you'd see something like this:
:
ntvdm.exe
wowexec.exe
app16bit.exe
:
where app16bit.exe is the 16-bit app that needs wowexec.exe
:
ntvdm.exe
wowexec.exe
app16bit.exe
:
where app16bit.exe is the 16-bit app that needs wowexec.exe
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
After further investigation there were actually two processes running. There was a wowexec.exe with a preceding space that seemed to be valid, and an _wowexec.exe that was also running. I ran avast as was suggested. It did not pick this up, but picked up a couple of other things that it removed. So, I went into the registry did a search and deleted all values containing the _wowexec.exe and also did the same thing on the hard drive. It's gone. Thanks for all of your help. I apologize for not doing my homework on wowexec. I am familiar with liiutilities and should have looked there first.
Thanks Again!
Thanks Again!
No comment has been added to this question in more than 21 days, so it is now classified as abandoned..
I will leave the following recommendation for this question in the Cleanup topic area:
[Accept: mikeleebrla]
Any objections should be posted here in the next 4 days. After that time, the question will be closed.
Carrzkiss
EE Cleanup Volunteer
I will leave the following recommendation for this question in the Cleanup topic area:
[Accept: mikeleebrla]
Any objections should be posted here in the next 4 days. After that time, the question will be closed.
Carrzkiss
EE Cleanup Volunteer
If you have the underscore (which i think you do) then it is indeed spyware. did you run updated versions spybot and adaware? they should have picked it up. Hijackthis should pick it up.
http://www.techzonez.com/forums/showthread.php?t=14910