_wowexec.exe and _monwow.exe

[chefgirl30]

I think the two processes listed above are worms that have infected my computer. I know they appear to be normal Windows proceeses, but there is a space in front of them when listed in the Task Manager which I've been told shouldn't be there.

I did a system restore and they're still there, or maybe were downloaded with an infected driver or something. Norton doesn't find them, and neither does Adaware.

Any ideas?

[Reverend]

Download and run Spybot Search & Destroy:

http://www.techzonez.com/forums/showthread.php?t=9966

when you open Spybot click the "Search for Updates" button to get the latest detections,and then run it when they are installed.

[lynchknot]

Description:
wowexec.exe is a part the operating system, and supports the use of 16-bit procseses.This program is important for the stable and secure running of your computer and should not be terminated. Description:
monwow.exe is a process from Symantec. It monitors the installation process for new software to be able to help you uninstall these software successfully.

Should be in C:\WINDOWS\system32\dllcache and C:\WINDOWS\system32\ - if anywhere else then yes, you may have problems. BTW, I see a space as well.

[Reverend]

Yes, wowexec.exe & monwow.exe are part of windows, but if they are prefixed with the underscore,(as in the thread title), it is spyware.

There is normally a space before the genuine processes:

" wowexec.exe" & " monwow.exe"

and these spaces get replaced with the underscores.

"_wowexec.exe" & "_monwow.exe"

[lynchknot]

reported from elsewhere but no response:

Indented wowexec is normal, however _wowexec is a trojan.

I've never seen monwow run in my PC though * edit - I searched - I don't even have mom on my computer

[chefgirl30]

I see - so the space is OK but not an underscore. Thanks!

Now that I'm home my computer's got an even worse problem -- PWSteal.Trojan, which has infected the nsvc.dll file in Windows. I used Norton to scan the computer in safe mode and it got rid of it. But as soon as I restarted back in normal mode it popped up again. I can't delete the file (tried that), how do I get rid of it?

[Reverend]

http://www.techzonez.com/forums/showthread.php?t=14912