RE: Win2K and Lview.exe -- am I infected?

From: Vachon, Scott (Scott.Vachon@Paymentech.com)
Date: 12/11/01 

From: "Vachon, Scott" <Scott.Vachon@Paymentech.com>
To: security-basics@securityfocus.com
Date: Tue, 11 Dec 2001 10:47:01 -0600

>I discovered that I can go to Task Manager -- Processes, and kill the
>process " wowexec.exe" (with the leading space) and everything will be
>restored to normal behavior.

>Any idea if I have been infected with something and what I can do about
>it?

I don't think you are infected. The wowexec.exe is used (and my explanation
may be somewhat off) to run legacy (or 16 bit) programs on the newer
Microsoft OS's. As it was explained to me, it is a virtual dos window to run
the program in. Unfortunately, this doesn't always function well and you get
a lock up or slow down (I believe it accesses the kernel directly and thus
the effect on the entire system). If you watch the processes tab of the task
manager window when you open the program, you will see the CPU spike to
95-100 percent utilization ! You should find a version of the program you
are running that is compatible with the OS and/or 32 bit vs. 16 bit.

Disclaimer: My own two cents, probably a little off but, in the ballpark.

~S~

Relevant Pages

  • outlook is causing high utilization
    ... When I lanch Outlook 2000 my system seem's to lock and when checking my ... does not work at this point and I have to kill it in task manager. ...
    (microsoft.public.outlook.general)
  • Re: Adjusting a services "CanStop" on the fly?
    ... I posted this question to the .Net framework, but I will repost in win32 ... >> who is trying to kill the service. ... >> (Via Task Manager) on the fly? ... I know if OnStart throws an exception the starting of the ...
    (microsoft.public.dotnet.languages.vb)
  • Re: Cant Remove Mystery Service
    ... Since it is already running even in safe mode, ... go into your task manager and kill it like you said. ... Now since you stopped it running in the task manager, ... it into the folder. ...
    (microsoft.public.windowsxp.general)
  • Re: Windows service Rights question
    ... try to kill the process, ... Steve ... > different login will require functionality that the task manager does ... > in the service control manager then there is a problem with your code. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Task Manager
    ... >Charles wrote: ... >> be able to create a vb program that can 1st kill ... >> task manager. ... >> I want the kill function of the .exe's from the task ...
    (microsoft.public.vb.winapi)