Off to do a couple of scans, as this unusual item has appeared in task manager.

wowexec.exe



The unusual thing is the space before it, and the zero mem usage.

Googling comes up with various different views about this, so although it's probably harmless, it's probably not doing any good either.

Mind, the old Firefox looks a bit plump there.

Little bit of info here dennis, what have you come up with?

http://help.lockergnome.com/windows/wowexe...pict556825.html

Very similar Hazel.

Scans came up with nothing.

However, in sys32 there are 5 different wow** files, to do with 16 bit applications and windows 3.1 fax drvs.

Launched Task Manager and unchecked "show 16 bit tasks", and it vanished.

Checked the same menu item, and it obviously reappeared, so it appears that I must have launched a 16 bit application recently, in line with your link. (Thanks)

Stopped process in task manager with no problems, and I'm just realising that I've installed my oldish Epson printer this afternoon, the software for which is Win 95/98/NT4.0/2000.

Could this be the 16 bit application?

We originally used this printer with an old win95 machine.

Although googling gave many entries on wowexec.exe trojan, I don't think thats the case here.

What do you think?

Hi Dennis. You probably found these, but:

http://www.itamer.com/wowexeexe/6/feed/

http://www.neuber.com/taskmanager/process/wowexec.exe.html

On my system (apparently bug free) in c:\windows\system32 and in dllcache I have
1. wow32.dll
2. wowdeb.exe
3. wowexec.exe
4. wowfax.dll
5. wowfaxui.dll

I think it's your printer Dennis, also I found this which may be of interest to you.

Wowexec.exe (Windows on Windows subsystem) and Ntvdm.exe (NT Virtual DOS
Machine) are used to run 16-bit programs (DOS programs) in a virtual
environment. If they are being used you will see the programs indented
under the Ntvdm.exe entry in the Task Manager. Ntvdm.exe and
Wowexec.exe will remain in memory after you close the 16-bit
application, "in case" you want to launch another 16-bit program. If
these items are started when you boot the computer, but no associated
program is shown under them, check your startup items, some 16-bit
program is set to start and do something when the computer starts. That
"16-bit something" could be anything.

Yep, got the same. Thanks for the input.


Found that same quote last night Hazel, and stopped the process with task manager.

Definitely the printer. Haven't used it again since yesterday, and the task manager entry hasn't returned, and the printer is the only thing that's changed in my startup, which I keep a regular check on.

Have you seen this site:- TaskList.org.

Over 18,000 processes!

It's not surprising that out of that many some of them are falsely flagged as suspicious.

Thanks for your help.