The Sysinternals Autoruns utility may highlight some entries in yellow, indicating to the user that some files (referenced in the
KnownDLL registry key) are missing from the system. The file names are below:
- C:\Windows\Syswow64\wow64cpu.dll (
- C:\Windows\System32\wowarmhw.dll (
- C:\Windows\Syswow64\wowarmhw.dll (
- C:\Windows\System32\xtajit.dll (
- C:\Windows\Syswow64\xtajit.dll (
- C:\WINDOWS\Syswow64\wow64.dll (
- C:\WINDOWS\Syswow64\wow64win.dll (
(The warning appears regardless of the version/bitness of Autoruns you’re running — Autoruns.exe or Autoruns64.exe)
The known DLLs on the computer are populated in the following registry key in Windows:
The files referenced under the
KnownDLLs key can be loaded only from the
C:\Windows\Syswow64 folders. In other words, the KnownDLLs registry key prevents DLLs from being loaded from the applications folder. It’s a security measure that prevents bogus/rogue copies of core system DLLs from being loaded from an applications folder.
Autoruns: KnownDlls wow64cpu, wowarmhw, wow64, xtajit, wow64win Missing
Why does Autoruns show that some KnownDLLs are missing? Are these files supposed to be present?
The yellow-highlighted entries in Autoruns’s “KnownDLLs” tab (as shown in the above image) are WOW64 emulator modules. The WOW64 emulator consists of the following DLLs:
- Wow64Cpu.dll (x64 only)
- IA32Exec.bin (Intel Itanium only)
- Wowia32x.dll (Intel Itanium only)
- xtajit.dll (ARM64 only)
- wowarmw.dll (ARM64 only)
As you see, some files are meant to be on 64-bit systems only, and others are supposed to be available only on ARM64 systems.
The Windows-On-Windows-64 (WOW64) support DLLs are present only in the System32 directory and Autoruns will report “file not found” for the corresponding SysWOW64 directory entries. This is normal.
KnownDLLs registry location doesn’t mention the directory path for the DLLs ( i.e.,
C:\Windows\SysWOW64), as you can see from the screenshot below:
For each entry/file listed under the above registry key, Autoruns simply looks if the files are in
SysWOW64 folders. Some DLLs are missing from the
System32 path because they are only 32-bit files (and so are in the
SysWOW64 folder), while others are 64-bit and are in the
System32 folder. Some files are missing on 32-bit and 64-bit computers because they are supposed to be only on ARM64-based systems.
Whereas Windows ships with both 32-bit and 64-bit versions of a file (such as
advapi32.dll). However, it’s not necessary that there should be a 32-bit version equivalent for every 64-bit module, or vice versa. You don’t need to run DISM or SFC for this.
Therefore, you can safely ignore the Autoruns “File not found” warning (yellow highlighting of the WOW emulator files) in the
One small request: If you liked this post, please share this?One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!