Help no longer needed, but still read the rest incase it helps you in a time of need....

Hi all, I like to keep up to date with whats running on my laptop and Ive just checked my Task Manager and noticed two new processes running,

_wowexec.exe where the underscore is a space(which shows up blank on Mem usage -)

and ntvdm.exe which shows as using 5000k usage.

Im a bit suspicious of these files running as I dont think there should be a space infront of the name (Edit, just realised its used for 16bit processes but Im still wary). I thik that wowexec is used as a virtual machine for NT apps and doesnt end itself after the program it was called from ends, and ntvdm is associated with it however I have never seen these before on my system running.

So, I ended the process wowexec and ntvdm went too. Then I ran _wowexec.exe from new task and it popped back up in the processes with ntvdm.

I also have done a search in my windows folder for "wow" and found wowexec.exe in the system32 folder as well as wowdeb.exe. But there is no _wowexec.exe.

All Im wondering is if someone can do me a favour and see if running _wowexec.exe brings up that and ntvdm.exe, and showing wowexec as using no memory, and also having a space infront of wowexec so I can check if mine is a possible virus/trojan.

Thank you!!

***Update, after trawling through Microsoft's knowledge base Ive found my answer, apparantly it has no PID, no memory and a space to enable users to easily identify it as a 16bit program!***

DOH!

Don't worry, nothing wrong with those

You were running a 16 bit app.

WOW stands for "windows on windows" - i.e. a 16 bit Windows app running in a 32 bit environment.

NTVDM is NT Virtual Dos Machine - the DOS infrastructure required for 16 bit command line apps or to support 16 bit Windows apps.

With the advent of 64 bit windows there's another layer called WOW64 that lets 32 bit apps run in the 64 bit address space. And so it goes on ...