The KnownDLLs registry location doesn’t mention the directory path for the DLLs ( i.e., C:\Windows\System32 or C:\Windows\SysWOW64), as you can see from the screenshot below:įor each entry/file listed under the above registry key, Autoruns simply looks if the files are in System32 and SysWOW64 folders. The Windows-On-Windows-64 (WOW64) support DLLs are present only in the System32 directory and Autoruns will report “file not found” for the corresponding SysWOW64 directory entries. The WOW64 emulator consists of the following DLLs:Īs you see, some files are meant to be on 64-bit systems only, and others are supposed to be available only on ARM64 systems. The yellow-highlighted entries in Autoruns’s “KnownDLLs” tab (as shown in the above image) are WOW64 emulator modules. Why does Autoruns show that some KnownDLLs are missing? Are these files supposed to be present? Autoruns: KnownDlls wow64cpu, wowarmhw, wow64, xtajit, wow64win Missing In other words, the KnownDLLs registry key prevents DLLs from being loaded from the applications folder. It’s a security measure that prevents bogus/rogue copies of core system DLLs from being loaded from an applications folder. The files referenced under the KnownDLLs key can be loaded only from the C:\Windows\System32 or C:\Windows\Syswow64 folders. The known DLLs on the computer are populated in the following registry key in Windows: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs (The warning appears regardless of the version/ bitness of Autoruns you’re running - Autoruns.exe or Autoruns64.exe) C:\WINDOWS\Syswow64\wow64win.dll ( wow64win).C:\Windows\Syswow64\xtajit.dll ( _xtajit).C:\Windows\System32\xtajit.dll ( _xtajit).C:\Windows\System32\wowarmhw.dll ( _wowarmhw).C:\Windows\Syswow64\wow64cpu.dll ( _wow64cpu).
0 kommentar(er)
