SysWOW64 folder

Can anyone please advise of the nature of the sub folder 'SysWOW64' on a
Window Vista 64bit computer. It would seam to have attracted a large amount
of viruses, but only to this area.

Regards

Carl

On 04/10/2010 02:32 AM, Carl Larner wrote:
> Can anyone please advise of the nature of the sub folder 'SysWOW64' on a
> Window Vista 64bit computer. It would seam to have attracted a large amount
> of viruses, but only to this area.
>
> Regards
>
> Carl

Probably more than you are looking for, but:

Everything You Need To Know To Start Programming 64-Bit Windows Systems
http://msdn.microsoft.com/en-us/magazine/cc300794.aspx

Basically you have two (2) system folders, one for legacy 32bit
dlls/coding [sysWoW64 - "W"indows "o"n "W"indows"64"], the other for
64bit [system32 - old carry-over].


What AV/anti-malware application(s) are you using and what are they
supposedly finding?

Is the system fully updated?

64bit malware is a bit "newer" and requires a bit more to work
effectively, so most likely you have 32bit malware/crimeware [not that
that makes any difference now]..

So what EXACTLY is it that you have found?


Standard response would be to suggest posting in one of the specialty
forums:
Register, and read its posting FAQ *BEFORE* posting.


http://aumha.net/viewtopic.php?t=4075 - Posting FAQ
http://aumha.net/viewforum.php?f=30
http://www.bleepingcomputer.com/forums/forum22.html
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/...splay.php?f=25
http://www.geekstogo.com/forum/Malwa..._Here-f37.html
http://www.malwarebytes.org/forums/i...hp?showforum=7
http://gladiator-antivirus.com/forum...?showforum=170
http://spywarewarrior.com/viewforum.php?f=5
http://forums.techguy.org/54-security/
http://forums.tomcoyote.org/
http://www.thespykiller.co.uk/index.php?board=3.0
http://forums.subratam.org/index.php?showforum=7

--
MEB
http://peoplescounsel.org/ref/windows-main.htm
Windows Info, Diagnostics, Security, Networking
http://peoplescounsel.org
The "real world" of Law, Justice, and Government
___---

[Crosspost to Win64-bit newsgroup]

Always state your full Windows version (e.g., WinXP SP3; WinXP 64-bit SP2;
Vista SP1; Vista 64-bit SP2; Win7; Win7 64-bit) when posting in a forum or
newsgroup. Please do so in your next reply.

What anti-virus application or security suite is installed and is your
subscription current? What anti-spyware applications (other than Defender)?
What third-party firewall (if any)?

Has a(another) Norton or McAfee application ever been installed on the
computer (e.g., a free-trial version that came preinstalled when you bought
it)?

A description of the differences between 32-bit versions of Windows Vista
and 64-bit versions of Windows Vista:
http://support.microsoft.com/kb/946765
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002


Carl Larner wrote:
> Can anyone please advise of the nature of the sub folder 'SysWOW64' on a
> Window Vista 64bit computer. It would seam to have attracted a large
> amount
> of viruses, but only to this area.

Robert is going after your basic virus questions, but to answer your
question about what the SysWOW64 folder is -- it's the 32-bit version of the
"system32" folder in a 64-bit version of Windows. Any 32-bit Windows
applications, DLLs, etc, on your 64-bit Windows computer go in that folder.
So it has 32-bit versions of CMD.EXE, for example, along with lots of other
system applications. When you are running a 32-bit application, the SysWOW64
folder _appears_ to be located at \Windows\system32, not at
\Windows\SysWOW64. Only a 64-bit application can tell that the folder is
located at SysWOW64.

It is highly likely that you got infected by something nasty that was only
32-bit aware.

--
Charlie.
http://msmvps.com/blogs/russel




"PA Bear [MS MVP]" <(E-Mail Removed)> wrote in message
news:uf%(E-Mail Removed)...
> [Crosspost to Win64-bit newsgroup]
>
> Always state your full Windows version (e.g., WinXP SP3; WinXP 64-bit SP2;
> Vista SP1; Vista 64-bit SP2; Win7; Win7 64-bit) when posting in a forum or
> newsgroup. Please do so in your next reply.
>
> What anti-virus application or security suite is installed and is your
> subscription current? What anti-spyware applications (other than
> Defender)? What third-party firewall (if any)?
>
> Has a(another) Norton or McAfee application ever been installed on the
> computer (e.g., a free-trial version that came preinstalled when you
> bought it)?
>
> A description of the differences between 32-bit versions of Windows Vista
> and 64-bit versions of Windows Vista:
> http://support.microsoft.com/kb/946765
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Client - since 2002
>
>
> Carl Larner wrote:
>> Can anyone please advise of the nature of the sub folder 'SysWOW64' on a
>> Window Vista 64bit computer. It would seam to have attracted a large
>> amount
>> of viruses, but only to this area.
>

[Who's this Robert person, Charles? <wink>]

Charlie Russel - MVP wrote:
> Robert is going after your basic virus questions, but to answer your
> question about what the SysWOW64 folder is -- it's the 32-bit version of
> the
> "system32" folder in a 64-bit version of Windows. Any 32-bit Windows
> applications, DLLs, etc, on your 64-bit Windows computer go in that
> folder.
> So it has 32-bit versions of CMD.EXE, for example, along with lots of
> other
> system applications. When you are running a 32-bit application, the
> SysWOW64
> folder _appears_ to be located at \Windows\system32, not at
> \Windows\SysWOW64. Only a 64-bit application can tell that the folder is
> located at SysWOW64.
>
> It is highly likely that you got infected by something nasty that was only
> 32-bit aware.
>
>
> "PA Bear [MS MVP]" <(E-Mail Removed)> wrote in message
> news:uf%(E-Mail Removed)...
>> [Crosspost to Win64-bit newsgroup]
>>
>> Always state your full Windows version (e.g., WinXP SP3; WinXP 64-bit
>> SP2;
>> Vista SP1; Vista 64-bit SP2; Win7; Win7 64-bit) when posting in a forum
>> or
>> newsgroup. Please do so in your next reply.
>>
>> What anti-virus application or security suite is installed and is your
>> subscription current? What anti-spyware applications (other than
>> Defender)? What third-party firewall (if any)?
>>
>> Has a(another) Norton or McAfee application ever been installed on the
>> computer (e.g., a free-trial version that came preinstalled when you
>> bought it)?
>>
>> A description of the differences between 32-bit versions of Windows Vista
>> and 64-bit versions of Windows Vista:
>> http://support.microsoft.com/kb/946765
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>
>>
>> Carl Larner wrote:
>>> Can anyone please advise of the nature of the sub folder 'SysWOW64' on a
>>> Window Vista 64bit computer. It would seam to have attracted a large
>>> amount
>>> of viruses, but only to this area.

Sigh. I really wasn't having a good day, Robear. My apologies.

--
Charlie.
http://msmvps.com/blogs/russel




"PA Bear [MS MVP]" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> [Who's this Robert person, Charles? <wink>]
>
> Charlie Russel - MVP wrote:
>> Robert is going after your basic virus questions, but to answer your
>> question about what the SysWOW64 folder is -- it's the 32-bit version of
>> the
>> "system32" folder in a 64-bit version of Windows. Any 32-bit Windows
>> applications, DLLs, etc, on your 64-bit Windows computer go in that
>> folder.
>> So it has 32-bit versions of CMD.EXE, for example, along with lots of
>> other
>> system applications. When you are running a 32-bit application, the
>> SysWOW64
>> folder _appears_ to be located at \Windows\system32, not at
>> \Windows\SysWOW64. Only a 64-bit application can tell that the folder is
>> located at SysWOW64.
>>
>> It is highly likely that you got infected by something nasty that was
>> only
>> 32-bit aware.
>>
>>
>> "PA Bear [MS MVP]" <(E-Mail Removed)> wrote in message
>> news:uf%(E-Mail Removed)...
>>> [Crosspost to Win64-bit newsgroup]
>>>
>>> Always state your full Windows version (e.g., WinXP SP3; WinXP 64-bit
>>> SP2;
>>> Vista SP1; Vista 64-bit SP2; Win7; Win7 64-bit) when posting in a forum
>>> or
>>> newsgroup. Please do so in your next reply.
>>>
>>> What anti-virus application or security suite is installed and is your
>>> subscription current? What anti-spyware applications (other than
>>> Defender)? What third-party firewall (if any)?
>>>
>>> Has a(another) Norton or McAfee application ever been installed on the
>>> computer (e.g., a free-trial version that came preinstalled when you
>>> bought it)?
>>>
>>> A description of the differences between 32-bit versions of Windows
>>> Vista
>>> and 64-bit versions of Windows Vista:
>>> http://support.microsoft.com/kb/946765
>>> --
>>> ~Robear Dyer (PA Bear)
>>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>>
>>>
>>> Carl Larner wrote:
>>>> Can anyone please advise of the nature of the sub folder 'SysWOW64' on
>>>> a
>>>> Window Vista 64bit computer. It would seam to have attracted a large
>>>> amount
>>>> of viruses, but only to this area.
>