Sunday, February 20, 2011

Legacy " wowexec.exe" and "ntvdm.exe" from TopCat.exe?

16-bit screen-mate?
.: Desktop mate or screen-mates is one quick method to enliven up our computer screen, but those tiny widgets can bring harm to our computer too...

Such case happens to me today. After trying one screen-mate - TopCat.exe from Cool on-Screen Fun, two UFI appears..

UFI : " wowexec.exe" and "ntvdm.exe".
UFI? 2 Unindentified Foreign Image-Name appears in my task manager after I close down TopCat.exe. Strange, hurmmmm... I tried to end both of them and it was a success. Lucky it was not some heavy trojans or other computer virus. Just to be sure I double check on the Net to see if somebody has encounter such process before.

Forum analysis:
  • WOWExec as in " wowexec.exe" means Windows16-bit on WindowsNT emulator? And "ntvdm.exe" means NT Virtual DOS Machine.
  • Usually " wowexec.exe" uses nothing, but "ntvdm.exe" use such a tiny fraction of your memory.(refer to picture)
  • These 2 process/utilities will starts automatically when we use or play any 16-bit (legacy) games or DOS programs, which in my case is this TopCat.exe.
  • Both will remain in memory even after we close the 16-bit program, so we need to end it manually.
  • If we still let them running, it takes up a whole lot of resources, blocks IE and Fx, and other programs from running.
  • "wowexec.exe" and " wowexec.exe" can be considered as safe process, but "_wowexec.exe" is still a mystery..

Okay, that should clear my questions for now. It's been 2 months already after I cleaned someone's computer from malwares. Oh I hate malwares, they're pretty clever in hiding and disguising themselves...


Ooigi.blog: "Sometimes you can see it x86, sometimes x64, 32 or 16. 8 is too old. But which one is which?"
:-?
:.

No comments:

Post a Comment