Jump to content

exec.exe ?


DennisD

Recommended Posts

  • Moderators

Off to do a couple of scans, as this unusual item has appeared in task manager.

 

wowexec.exe

 

Poss.Malware.jpg.xs.jpg

 

The unusual thing is the space before it, and the zero mem usage.

 

Googling comes up with various different views about this, so although it's probably harmless, it's probably not doing any good either.

 

Mind, the old Firefox looks a bit plump there.

Link to comment
Share on other sites

  • Moderators

Very similar Hazel.

 

Scans came up with nothing.

 

However, in sys32 there are 5 different wow** files, to do with 16 bit applications and windows 3.1 fax drvs.

 

Launched Task Manager and unchecked "show 16 bit tasks", and it vanished.

 

Checked the same menu item, and it obviously reappeared, so it appears that I must have launched a 16 bit application recently, in line with your link. (Thanks)

 

Stopped process in task manager with no problems, and I'm just realising that I've installed my oldish Epson printer this afternoon, the software for which is Win 95/98/NT4.0/2000.

 

Could this be the 16 bit application?

 

We originally used this printer with an old win95 machine.

 

Although googling gave many entries on wowexec.exe trojan, I don't think thats the case here.

 

What do you think?

Link to comment
Share on other sites

Hi Dennis. :) You probably found these, but:

 

http://www.itamer.com/wowexeexe/6/feed/

 

http://www.neuber.com/taskmanager/process/wowexec.exe.html

 

On my system (apparently bug free) in c:\windows\system32 and in dllcache I have

1. wow32.dll

2. wowdeb.exe

3. wowexec.exe

4. wowfax.dll

5. wowfaxui.dll

The CCleaner SLIM version is always released a bit after any new version; when it is it will be HERE :-)

Pssssst: ... It isn't really a cloud. Its a bunch of big, giant servers.

Link to comment
Share on other sites

  • Moderators

I think it's your printer Dennis, also I found this which may be of interest to you.

 

Wowexec.exe (Windows on Windows subsystem) and Ntvdm.exe (NT Virtual DOS

Machine) are used to run 16-bit programs (DOS programs) in a virtual

environment. If they are being used you will see the programs indented

under the Ntvdm.exe entry in the Task Manager. Ntvdm.exe and

Wowexec.exe will remain in memory after you close the 16-bit

application, "in case" you want to launch another 16-bit program. If

these items are started when you boot the computer, but no associated

program is shown under them, check your startup items, some 16-bit

program is set to start and do something when the computer starts. That

"16-bit something" could be anything.

CCleaner documentation can be found here

https://www.ccleaner.com/docs/ccleaner

Support contact

https://support.piriform.com/hc/en-us/requests/new

support@ccleaner.com

 

Link to comment
Share on other sites

  • Moderators
Hi Dennis. :) You probably found these, but:

 

http://www.itamer.com/wowexeexe/6/feed/

 

http://www.neuber.com/taskmanager/process/wowexec.exe.html

 

On my system (apparently bug free) in c:\windows\system32 and in dllcache I have

1. wow32.dll

2. wowdeb.exe

3. wowexec.exe

4. wowfax.dll

5. wowfaxui.dll

Yep, got the same. Thanks for the input.

 

I think it's your printer Dennis, also I found this which may be of interest to you.

 

Wowexec.exe (Windows on Windows subsystem) and Ntvdm.exe (NT Virtual DOS

Machine) are used to run 16-bit programs (DOS programs) in a virtual

environment. If they are being used you will see the programs indented

under the Ntvdm.exe entry in the Task Manager. Ntvdm.exe and

Wowexec.exe will remain in memory after you close the 16-bit

application, "in case" you want to launch another 16-bit program. If

these items are started when you boot the computer, but no associated

program is shown under them, check your startup items, some 16-bit

program is set to start and do something when the computer starts. That

"16-bit something" could be anything.

Found that same quote last night Hazel, and stopped the process with task manager.

 

Definitely the printer. Haven't used it again since yesterday, and the task manager entry hasn't returned, and the printer is the only thing that's changed in my startup, which I keep a regular check on.

 

Have you seen this site:- TaskList.org.

 

Over 18,000 processes!

 

It's not surprising that out of that many some of them are falsely flagged as suspicious.

 

Thanks for your help.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.