_wowexec.exe and _monwow.exe

**chefgirl30** · April 19th, 2005, 21:25 PM

I think the two processes listed above are worms that have infected my computer. I know they appear to be normal Windows proceeses, but there is a space in front of them when listed in the Task Manager which I've been told shouldn't be there.

I did a system restore and they're still there, or maybe were downloaded with an infected driver or something. Norton doesn't find them, and neither does Adaware.

Any ideas?

**Reverend** · April 19th, 2005, 21:42 PM

Download and run Spybot Search & Destroy:

http://www.techzonez.com/forums/showthread.php?t=9966

when you open Spybot click the "Search for Updates" button to get the latest detections,and then run it when they are installed.

**lynchknot** · April 19th, 2005, 23:23 PM

Quote:

Description:
wowexec.exe is a part the operating system, and supports the use of 16-bit procseses.This program is important for the stable and secure running of your computer and should not be terminated.

Quote:

Description:
monwow.exe is a process from Symantec. It monitors the installation process for new software to be able to help you uninstall these software successfully.

Should be in C:\WINDOWS\system32\dllcache and C:\WINDOWS\system32\ - if anywhere else then yes, you may have problems. BTW, I see a space as well.

**Reverend** · April 19th, 2005, 23:39 PM

Yes, wowexec.exe & monwow.exe are part of windows, but if they are prefixed with the underscore,(as in the thread title), it is spyware.

There is normally a space before the genuine processes:

" wowexec.exe" & " monwow.exe"

and these spaces get replaced with the underscores.

"_wowexec.exe" & "_monwow.exe"

**lynchknot** · April 19th, 2005, 23:52 PM

reported from elsewhere but no response:

Quote:

Indented wowexec is normal, however _wowexec is a trojan.

I've never seen monwow run in my PC though * edit - I searched - I don't even have mom on my computer

**chefgirl30** · April 20th, 2005, 06:21 AM

I see - so the space is OK but not an underscore. Thanks!

Now that I'm home my computer's got an even worse problem -- PWSteal.Trojan, which has infected the nsvc.dll file in Windows. I used Norton to scan the computer in safe mode and it got rid of it. But as soon as I restarted back in normal mode it popped up again. I can't delete the file (tried that), how do I get rid of it?

**Reverend** · April 20th, 2005, 19:43 PM

http://www.techzonez.com/forums/showthread.php?t=14912

April 19th, 2005, 21:25 PM	#1
chefgirl30 Junior Member Join Date: Jul 2004 Posts: 5	_wowexec.exe and _monwow.exe I think the two processes listed above are worms that have infected my computer. I know they appear to be normal Windows proceeses, but there is a space in front of them when listed in the Task Manager which I've been told shouldn't be there. I did a system restore and they're still there, or maybe were downloaded with an infected driver or something. Norton doesn't find them, and neither does Adaware. Any ideas?

April 19th, 2005, 21:42 PM	#2
Reverend Head Honcho Administrator Join Date: Apr 2002 Location: England Posts: 10,934	Download and run Spybot Search & Destroy: http://www.techzonez.com/forums/showthread.php?t=9966 when you open Spybot click the "Search for Updates" button to get the latest detections,and then run it when they are installed. __________________ =========== Please Read The Forum Rules ===========

April 19th, 2005, 23:39 PM	#4
Reverend Head Honcho Administrator Join Date: Apr 2002 Location: England Posts: 10,934	Yes, wowexec.exe & monwow.exe are part of windows, but if they are prefixed with the underscore,(as in the thread title), it is spyware. There is normally a space before the genuine processes: " wowexec.exe" & " monwow.exe" and these spaces get replaced with the underscores. "_wowexec.exe" & "_monwow.exe" __________________ =========== Please Read The Forum Rules ===========

April 20th, 2005, 06:21 AM	#6
chefgirl30 Junior Member Join Date: Jul 2004 Posts: 5	now guess what... I see - so the space is OK but not an underscore. Thanks! Now that I'm home my computer's got an even worse problem -- PWSteal.Trojan, which has infected the nsvc.dll file in Windows. I used Norton to scan the computer in safe mode and it got rid of it. But as soon as I restarted back in normal mode it popped up again. I can't delete the file (tried that), how do I get rid of it?

April 20th, 2005, 19:43 PM	#7
Reverend Head Honcho Administrator Join Date: Apr 2002 Location: England Posts: 10,934	http://www.techzonez.com/forums/showthread.php?t=14912 __________________ =========== Please Read The Forum Rules ===========

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode