File description |
Wowexec.exe with description Windows Win16 Application Launcher is a process file from company Microsoft Corporation belonging to product Microsoft® Windows(TM) Operating System.
The file is
not digitally signed.
What is wowexec.exe?
Despite the suspicious-looking name, this is a legitimate system process. It is the Windows on Windows Process, which allows 16-bit applications to run under 32-bit Windows.
This process is an essential system process but does not (and should not) always be running. It only runs when you are running a 16-bit application under a Windows NT-based operating system. Terminating the process through the task manager will terminate any 16-bit process you may have running. You should not delete or otherwise permanently disable this executable, as system instability may result. The screenshot below illustrates how it should appear in the task manager:
In the above screenshot, you can see that wowexec.exe is indented. Typically, the name of the 16-bit application you are running will be shown above the indented wowexec.exe. That cannot be seen here as in this example, the Windows on Windows Process was run directly. If wowexec.exe is not indented, it is very likely that your system is infected with malware.
Dangers of wowexec
As this is a relatively common legitimate process with a name that does not sound legitimate, it is common for virus writers and spyware vendors to disguise their malware as the genuine one.
Some malicious files will have the same name but will be stored somewhere other than in %SystemRoot%\System32. Other malware will use a name that appears similar to that of the legitimate one but with slight differences in spelling or with appended digits. The following malware is known to disguise itself as wowexec.exe:
- _wowexec.exe
- If you see wowexec.exe preceded by an underscore, your system is infected with a Trojan. Run a virus scan immediately.
There is typically only one instance of this process running at a given time; however, there could be more if multiple 16-bit applications are running. The presence of multiple instances may be but is not necessarily an indicator of a malware infection. If you are not running any 16-bit applications, however, this process should not be running. In this case, it is likely that your system is infected with malware.
Common problems
- This process uses 100% CPU time
- Because of the nature of wowexec.exe, this is probably caused by a 16-bit application that you are running. Asus Probe is among the 16-bit software known to hang with wowexec.exe using 100% of the CPU.
- This process continues to run after closing all 16-bit applications
- This is not a problem and is by design. You may opt to kill wowexec.exe via the Task Manager if you wish to free up the resources it uses.
|
Automatic startup locations |
 |
001 Running Processes |
 |
003 Autorun registry entries Current User |
|
Digital signatures found for this file |
| This file is not signed by it's author |
|
MD5 security rating in our database |
 |
 |
|
1 |
files (Not yet rated
and
not
signed) |
 |
|
1 |
files (Safe
and
digitally
signed) |
|
|
|
Some versions of this filename have not yet been checked for safety.
|
| Warning: Some malware might rename itself to wowexec.exe. Always make sure that your file is from a verified publisher. |
|
Application errors |
|
| User comments. |
There are no comments yet.
|
|
Database statistics
Top process list
