Results 1 to 7 of 7

Thread: _wowexec.exe and _monwow.exe

  1. #1
    Junior Member
    Join Date
    Jul 2004
    Posts
    5

    _wowexec.exe and _monwow.exe

    I think the two processes listed above are worms that have infected my computer. I know they appear to be normal Windows proceeses, but there is a space in front of them when listed in the Task Manager which I've been told shouldn't be there.

    I did a system restore and they're still there, or maybe were downloaded with an infected driver or something. Norton doesn't find them, and neither does Adaware.

    Any ideas?

  2. #2
    Head Honcho Administrator Reverend's Avatar
    Join Date
    Apr 2002
    Location
    England
    Posts
    14,044
    Download and run Spybot Search & Destroy:

    http://www.techzonez.com/forums/showthread.php?t=9966

    when you open Spybot click the "Search for Updates" button to get the latest detections,and then run it when they are installed.

    =========== Please Read The Forum Rules ===========

  3. #3
    Titanium Member
    Join Date
    Jul 2002
    Location
    blk helo target, WA
    Posts
    3,415
    Description:
    wowexec.exe is a part the operating system, and supports the use of 16-bit procseses.This program is important for the stable and secure running of your computer and should not be terminated.
    Description:
    monwow.exe is a process from Symantec. It monitors the installation process for new software to be able to help you uninstall these software successfully.
    Should be in C:\WINDOWS\system32\dllcache and C:\WINDOWS\system32\ - if anywhere else then yes, you may have problems. BTW, I see a space as well.
    Last edited by lynchknot; April 19th, 2005 at 22:49 PM.

  4. #4
    Head Honcho Administrator Reverend's Avatar
    Join Date
    Apr 2002
    Location
    England
    Posts
    14,044
    Yes, wowexec.exe & monwow.exe are part of windows, but if they are prefixed with the underscore,(as in the thread title), it is spyware.

    There is normally a space before the genuine processes:

    " wowexec.exe" & " monwow.exe"

    and these spaces get replaced with the underscores.

    "_wowexec.exe" & "_monwow.exe"

    =========== Please Read The Forum Rules ===========

  5. #5
    Titanium Member
    Join Date
    Jul 2002
    Location
    blk helo target, WA
    Posts
    3,415
    reported from elsewhere but no response:

    Indented wowexec is normal, however _wowexec is a trojan.
    I've never seen monwow run in my PC though * edit - I searched - I don't even have mom on my computer
    Last edited by lynchknot; April 19th, 2005 at 22:58 PM.

  6. #6
    Junior Member
    Join Date
    Jul 2004
    Posts
    5

    now guess what...

    I see - so the space is OK but not an underscore. Thanks!

    Now that I'm home my computer's got an even worse problem -- PWSteal.Trojan, which has infected the nsvc.dll file in Windows. I used Norton to scan the computer in safe mode and it got rid of it. But as soon as I restarted back in normal mode it popped up again. I can't delete the file (tried that), how do I get rid of it?

  7. #7
    Head Honcho Administrator Reverend's Avatar
    Join Date
    Apr 2002
    Location
    England
    Posts
    14,044

    =========== Please Read The Forum Rules ===========

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •