What is SysWOW64 folder in Windows? (2021 update)

SysWOW64 virus Removal Guide

What is SysWOW64 virus?

SysWOW64 is a subsystem used for handling 32-bit programs on 64-bit Windows versions

SysWOW64 processSysWOW64 is a folder placed on a system of Windows OS supporting devices that might be corrupted if causes memory issues.

SysWOW64 is not a virus. It is a legitimate folder filled with system files, utilized to run 32-bit programs on Windows 64-bit version. This process goes along with System32 Microsoft Windows directory which is responsible for managing 64-bit files. The main reason why users have been calling SysWOW64 virus because sometimes it takes lots of system's memory (40 GB or so).[1] However, we do not recommend removing this folder from the system because that's why you can run 32-bit applications on 64-bit Windows version. If you have serious doubts about this folder, make sure you double check your computer system with reliable anti-spyware to see what is hiding on it. There is a chance that malware developers decided to misuse SysWOW64's name to hide their malware, e.g. crypto miners,[2] on the system.

Name SysWOW64
Type Library directory
Belongs to Microsoft Windows operating system
related files and folders System32, cmd.exe, odbcad32.exe, Svchost.exe
Causes attention because Sometimes takes up a generous amount of system's resources
Can be found on Windows Vista, Windows 7, 8, 8.1, and Windows 10
misused for Malware developers might find this file name useful to hide malicious programs such as cryptocurrency miners
Malware termination If you suspect that the executable might be infected with malware, perform a full system scan with a reputable anti-malware software
System fix If SysWOW64 is taking too much memory on your computer, there might be several technical issues causing this behavior. To fix Windows issues automatically, we recommend using a PC repair tool FortectIntego

In short, the main purpose of SysWOW64 subsystem is to create a 32-bit environment that helps 32-bit applications run on 64-bit Windows without modifying anything. It contains .dll and .exe files that are pointed to needed directions without user's interruption. For this procedure, Windows is using file system redirector.[3]

WOW64 uses several DLLs to implement various features:

  • wow64.dll – the core interface that translates between 32-bit and 64-bit calls;
  • wow64win.dll – provides entry-points for applications;
  • wow64cpu.dll – helps to switch the process from 32-bit to 64-bit mode.

However, as we have already mentioned, people tend to complain about the size of the SysWOW64 folder. While in most of the cases it takes only a few gigabytes of the PC's memory, several users have complained that C:\Windows\SysWOW64 is up to 40GB. As a result, the computer can start running slow or sometimes even crash down.

There is a possibility that malware developers have misused the name of this system's component to help their malware to stay undetected. However, a full system scan with a reliable anti-spyware or anti-virus program will help you determine the real intentions of this component. However, you should not remove SysWOW64 if it is legitimate and part of the system, as it will simply break. If you are having troubles with the this subsystem, we suggest you scan the computer with FortectIntego – it can fix various Windows issues automatically.

SysWOW64 removal might be dangerous for the system's normal functionality since this is a legitimate folder used by the Windows operating system. If the scan comes up with a list of viruses, take care of them at first, reboot your computer and check your computer's state. If you can still find this folder after letting the anti-virus take care of malware hiding on your computer, you can be sure that it is safe.

SysWOW64 SysWOW64 is a process that runs on Windows and is legitimate, so cannot be easily deleted. But you need to examine the folder and process further if you have CPU or memory issues because of it.

Usually, Trojan horses are one of the most common malware forms that are distributed throughout original-looking files. If such infection has been misusing the name of SysWOW64, be aware that you might experience some unexpected changes in your computer system such as other rogue processes running, system and software sluggishness, etc.

Furthermore, if its SysWOW64 virus that has been bothering you lately, you will supposedly experience high usage of your5 system resources. For example, when a crypto mining trojan is working on the infected machine, the CPU[4] level might go over even 90% of its power level. This might be disruptive for the computer and software in it.

Nevertheless, malicious programs such as SysWOW64 virus might cause even more damage and losses. For example, if there is ransomware hiding under this folder name, then be ready to face file encryption and ransom demands. Also, many types of malware are capable of overrunning all security systems and software on the targeted PC/laptop.

However, identification of SysWOW64 is always necessary as this folder might not be the cause of all of your troubles after all. You should investigate the entire system before taking any actions towards the removal. If anti-malware says that this file is malicious and if you see two of the same processes running in the task manager, then you should put the elimination process of SysWOW64 folder as your first priority.

SysWOW64 folderSysWOW64 is a non-harmful system file, however, if compromised, it might be misused to hide dangerous malware

Malicious actors misuse names of legitimate files to hide their malware

Since the executable files and DLLs can be found running in the background, users can spot the malicious program, e.g., crypto miner, on their computer. To prevent this from happening, cybercriminals have started using the names of legitimate files to help their viruses masquerade and avoid the termination.

Researchers[5] note that not every process running on the Task Manager is safe and you need to be concerned if the file takes a lot of space or uses a visible amount of your computer's CPU. It is highly advisable to scan the system with updated anti-spyware to check the trustworthiness of the file.

Most often, these files infiltrate systems unnoticed after tricking the victim into clicking the malicious link or ad. Additionally, the system can be infected thru spam email attachments which are typically presenting themselves as business reports or important notifications from financial/governmental authorities. Once downloaded, these files launch a certain code responsible for downloading the threat to the system. Keep your anti-malware tools up to date and try to scan every downloaded file before opening to prevent unexpected infiltration!

SysWOW64 elimination can be harmful to the OS. Don't do that!

Do not remove SysWOW64 from the system if you want to avoid issues related to your Windows OS functionality. Typically, Windows uses several guards to prevent users from doing that. If you are having issues without your PC system, you need to scan the device with SpyHunter 5Combo Cleaner, Malwarebytes, or another reputable security software and see what is hiding there.

If there is any malware on your computer, it is probably using an almost identical name to this folder because it is seeking to hide from your eye and prevent removal. In this case, remove all components reported after the scan but don't touch the original SysWOW64 folder. Otherwise, you can run into serious issues regarding the whole performance of your PC.

If you are still thinking about SysWOW64 removal, you can try performing a clean boot via system configuration.

do it now!
Fortect Happiness
Intego Happiness
Compatible with Microsoft Windows Compatible with macOS
What to do if failed?
If you failed to fix virus damage using Fortect Intego, submit a question to our support team and provide as much details as possible.
Fortect Intego has a free limited scanner. Fortect Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Fortect, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

Getting rid of SysWOW64 virus. Follow these steps

Manual removal using Safe Mode

If some type of malware managed to get into the computer system through SysWOW64 folder, you should reboot the system to Safe Mode with Networking in order to stop malicious processes from continuing:

Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.

Step 1. Access Safe Mode with Networking

Manual malware removal should be best performed in the Safe Mode environment. 

Windows 7 / Vista / XP
  1. Click Start > Shutdown > Restart > OK.
  2. When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
  3. Select Safe Mode with Networking from the list. Windows 7/XP
Windows 10 / Windows 8
  1. Right-click on Start button and select Settings.
  2. Scroll down to pick Update & Security.
    Update and security
  3. On the left side of the window, pick Recovery.
  4. Now scroll down to find Advanced Startup section.
  5. Click Restart now.
  6. Select Troubleshoot. Choose an option
  7. Go to Advanced options. Advanced options
  8. Select Startup Settings. Startup settings
  9. Press Restart.
  10. Now press 5 or click 5) Enable Safe Mode with Networking. Enable safe mode

Step 2. Shut down suspicious processes

Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Click on More details.
    Open task manager
  3. Scroll down to Background processes section, and look for anything suspicious.
  4. Right-click and select Open file location.
    Open file location
  5. Go back to the process, right-click and pick End Task.
    End task
  6. Delete the contents of the malicious folder.

Step 3. Check program Startup

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Go to Startup tab.
  3. Right-click on the suspicious program and pick Disable.

Step 4. Delete virus files

Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:

  1. Type in Disk Cleanup in Windows search and press Enter.
    Disk cleanup
  2. Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
  3. Scroll through the Files to delete list and select the following:

    Temporary Internet Files
    Recycle Bin
    Temporary files

  4. Pick Clean up system files.
    Delete temp files
  5. You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):


After you are finished, reboot the PC in normal mode.

Remove SysWOW64 using System Restore

Use the System Restore option if some dangerous cyber threat has reached your computer system. Opting for this feature will allow you to prevent further malicious actions:

  • Step 1: Reboot your computer to Safe Mode with Command Prompt
    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of SysWOW64. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with FortectIntego and make sure that SysWOW64 removal is performed successfully.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from SysWOW64 and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes

How to prevent from getting system tools

Choose a proper web browser and improve your safety with a VPN tool

Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online. One of the basic means to add a layer of security – choose the most private and secure web browser. Although web browsers can't grant full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features. However, if you want true anonymity, we suggest you employ a powerful Private Internet Access VPN – it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.


Lost your files? Use data recovery software

While some files located on any computer are replaceable or useless, others can be extremely valuable. Family photos, work documents, school projects – these are types of files that we don't want to lose. Unfortunately, there are many ways how unexpected data loss can occur: power cuts, Blue Screen of Death errors, hardware failures, crypto-malware attack, or even accidental deletion.

To ensure that all the files remain intact, you should prepare regular data backups. You can choose cloud-based or physical copies you could restore from later in case of a disaster. If your backups were lost as well or you never bothered to prepare any, Data Recovery Pro can be your only hope to retrieve your invaluable files.

About the author
Gabriel E. Hall
Gabriel E. Hall - Passionate web researcher

If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Gabriel E. Hall
About the company Esolutions

Removal guides in other languages