WIN2K: funlove virus and wowexec.exe

[syf3r]

two separate questions which are somewhat related. i received several images today inside a .uue encoded file, one of which had the .shs extension after the .jpg extension. i decoded all of them before i realized that one had the .shs on it. i never viewed that image, but instead simply highlighted it, and shift-deleted it. i *think* that when i highlighted it, the .shs disappeared. i'm wondering if, since windows explorer under 2k allows you to view thumbnails of images, might that feature have activated the virus even if i didn't have that feature activated?
also, is it normal for wowexec.exe to show up in the task manager? i have wowexec.exe showing up with a space in front of it, and there is no process id or any other info such as cpu time, mem usage, etc etc... i don't seem to recall this process ever being there before my little mishap with the funlove .shs file... any ideas..?

one more thing... can funlove even infect a 2000 machine, or is it only 9x and nt machines..?


-syf3r.

 

[GT1999]

I'm not sure about the virus, but wowexec.exe is used in Win2000 to operate certian applications. I've heard it's for 16-bit apps, but sometimes I see it there when I don't have any open. Don't worry about, it's supposed to be there.

A comment on viruses in general, though: run a virus scanner with the latest virus definitions. If it doesn't catch anything, and you don't notice anything abnormal from the system, don't worry about it. Sure, you could have a virus, but what's the use in worrying over it if it isn't causing any harm, an a virus scanner isn't catching it. If you are suspicious of a program, simply delete it.


G|T

 

[PowerJoe]

wow = Windows On Windows. It's a mechanism that enables Win2000 to run Win16 apps. wowexec kicks in whenever you run a Win16 prog, and remains there until... don't know when.

-PJ