I noticed a couple of strange applications running in my Task Manager (Gow2o & Vkprz1) when I click "end task", it ends that application but starts up another one. I wnt into my windows system directory and there are quite a few of these applications listed throughout the directory (Gow2o.exe etc.) The properties state that they are all version 1.00 and were created yesterday and today on my system. Their value is either Kern32 or wowex.32. What are they? How did they get here? Can I just delete them?

wammy, You may have picked up a virus/trojan so update your virus definitions and run a full virus scan. If you don't have a AV program go to the link below and run the Free online Housecall virus scan. Housecall The link below is a sampling for Kern32. Kern32 Search Tufenuf

If virus checker finds nothing then download "Ad-Aware" and/or "Spybot Search & Destroy". This finders/fixers sometimes unearth things that anti-virus progs miss. Derek

I have already done the above two suggestions. My scans have detected no viruses and my Spybot scan hasn't solved the problem either.

Despite all you stay I still think this is some trojan/malware or other that for some reason is not being detected. I've posted a link to this from the Security & Virus forum to see if anyone there knows what it's about. Derek

It sounds like Trojan.Peper. Download 'Hijack This!'. Unzip, doubleclick HijackThis.exe, and hit "Scan". When the scan is finished, click "Save Log", and copy and paste it in a reply. HijackThis!

Hi, I know this is someone else's question, but I have the same problem and have already downloaded hijackthis, along w/ spyware blaster, winpatrol, ad-aware, spybot, and registry mechanic...all did something to put a dent into this too far gone machine, but I'm still having a problem w/ wowex, which I agree must be a virus. So anyway, here's my hijackthis log. Logfile of HijackThis v1.97.7 Scan saved at 9:36:46 PM, on 11/28/2003 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Unable to get Internet Explorer version! Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.exe C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe C:\WINDOWS\Explorer.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe C:\WINDOWS\System32\MDM.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe C:\WINDOWS\System32\Qmy7M.exe C:\WINDOWS\System32\Oyhp.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\John Cardell\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.enter.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.enter.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Enter.Net O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /QS O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe O4 - HKLM\..\Run: [38@HKLC3N@EADR] C:\WINDOWS\System32\GzbH5X.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll O14 - IERESET.INF: START_PAGE_URL=http://www.enter.net O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/d052c1d7d32ead/housecall.antivirus.com/housecall/xscan53.cab