is wowexec.exe my problem?

S

silkman

Expert Member
Joined
Aug 20, 2005
Messages
1,861
Reaction score
37
I need urgent help please. I have a medical program that suddenly just closes (I'm running XP)- it runs for a few seconds and then closes
I backed up the program and database and tried it on another pc and it works ok.
I opened task manager and the 2 processes that start when I open the program are:
wowexec.exe and fox2600.esl
fox2600 is located in the program's main folder.
Could wowexec be the problem? How can I fix it. Thanks in advance people.
 
Do you see anything in the Event Viewer?
 
Is this medical program by any chance ancient? Cause wowexec.exe is window's 16bit emulation layer which only kicks in if there is something seriously outdated running.

Program-OS compatibility is unfortunately a nightmare to troubleshoot, so I can't help you much. Try running the app in a Virtualbox VM with Win 98.
 
Might be a virus. Then again, might not be.

Do as havoc suggested.

You can also try Microsoft Virtual PC 2004 (free), it'll pick up and assign a product key to Windows98 correctly.
 
it's not that anicent- I have been running it on XP for 6 years with no problems.
sorry for the noob question but What is Event Viewer?
Ok I found event viewer but I don't know how to read it.
 
Last edited:
ok when I was shutting down my pc at now a warning flashed briefly. I glimpsed that it said there was an error in ?????.dll and then it shut down.
I guess it's the 16bit prgoram issue that's ausing this.
How do I solve this?
 
try running the .exe in compatible mode to (your tried settings).Ok to do this right click the icon on your desktop and go to properties..You will see run as in the context menu and some other goodies.try different setting and see what happens.Pity you not running win7 or vista,the process would be so much easier.
 
I tired running it in compatibiliy mode but the problem persists.
The error that I get when shutting down is:
"dwwin.exe the application failed to materialise
 
As I've said before: Nobody here will be able to give you a quick fix for this. You'll have to either reinstall the OS & hope it works, install an older OS or run it in a VM like I suggested.

To get 16bit components to even work under XP forced Microsoft to implement a sketchy band aid solution (The wow layer). If that goes haywire then chances of fixing the band aid fix are slim.
 
If you've still got your XP installation CD, you could try to restore the damaged file by going to command prompt and typing, "sfc". It's the system file checker. It will replace current modified/corrupted files with the files on the installation CD. Worth a try.
 
Thanks to all for the help. I renamed all spware/malware.exe as i couldn't run it otherwise -it would terminate as well.
I figured the problem was not wowexex
log report:


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4214

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

2010/06/19 09:03:26 AM
mbam-log-2010-06-19 (09-03-26).txt

Scan type: Full scan (C:\|)
Objects scanned: 217528
Time elapsed: 23 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 21
Registry Values Infected: 4
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-AwareAdmin.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsvchst.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrtstub.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\A2GUARD.EXE (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\A2START.EXE (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKWCTL.EXE (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2service.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ad-aware.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avk.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\conime.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrt.exe (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prevx.exe (Security.Hijack) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdAgent.exe\debugger (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe\debugger (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe\debugger (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe\debugger (Security.Hijack) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableConfig (Windows.Tool.Disabled) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\User\My Documents\HEALTHBRIDGEFOLDER\HealthbridgeInstallationCD\bin\HSINSTALL\Bin\RADMIN\admdll.dll (PUP.RemoteAdmin) -> No action taken.
C:\Documents and Settings\User\My Documents\HEALTHBRIDGEFOLDER\HealthbridgeInstallationCD\bin\HSINSTALL\Bin\RADMIN\raddrv.dll (PUP.RemoteAdmin) -> No action taken.

I cleaned all of them and it looks ok-thanks to all
 
Haha, I'm glad you're sorted. I still don't understand where people get all these infections though. I live a pretty risky internet lifestyle but NOD32 keeps me safe (I hope).
 
I am stumped as to where I got it- to top it all I had no ADSL line last week- I was using my pda as a modem on MTN- maybe that's where the problem cam from?
I didn't visit ANY sites I normally don't visit.
Nods32 blocked some sites 195.149.74.zip or something like that but how the worm got in is a mystery
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X