Subscribe to Windows IT Pro

 

Get Newsletters

  • Get the Latest News
  • Product Updates
  • Helpful Tricks
  • Productivity Tips

Subscribe Now!

April 01, 1998 12:00 AM

Optimizing NT's WOW Subsystem

Windows IT Pro
InstantDoc ID #3022
Rating: (2)
Put a little WOW in your 16-bit Windows applications

In the midst of a 32-bit software era (with 64-bit applications on the horizon), a surprising number of organizations continue to run legacy 16-bit Windows applications. Some of these applications are mission-critical utilities, whereas others are ancillary components that still perform useful functions. These applications might be hanging around for various reasons. For example, the software manufacturer (usually a vertical-market developer) might be behind in updating the application to a 32-bit version. Worse, the software developer might have gone out of business, which might make a migration or conversion to a competitive product cost-prohibitive for the company using the original software. Whatever the reason, many Windows NT systems administrators must deal with 16-bit Windows applications daily. If you're in this situation, you can use a few tips to optimize NT's Win16 on Win32 (WOW) subsystem and the applications that use it.

The Anatomy of WOW
The WOW subsystem is closely related to the Virtual DOS Machine (VDM) that NT uses to execute 16-bit DOS applications. WOW is an application environment that runs as a user-mode program (the filename is wowexec.exe) and invokes one VDM for all Win16 applications to run in. On RISC-based systems, you can alter the amount of memory WOW allocates for its VDM. On Intel or RISC-based systems, you can edit the command-line parameters the system issues when NT initializes the WOW environment and VDM. By default, all Win16 applications run in the same VDM, using separate threads. This behavior differs from that of standard DOS applications, each of which runs in a separate VDM.

Microsoft designed the WOW subsystem to make the differences between 16-bit and 32-bit applications transparent. WOW, combined with NT's native x86 emulation, lets RISC-based systems (i.e., Alpha, MIPS, and PowerPC) run Win16 applications without specialized hardware or advanced emulation software such as Digital Equipment's FX!32 (for information about FX!32, see Brian Gallagher, "FX!32," page 80). A Win16 VDM includes two system threads: the wowexec.exe thread that starts Win16 applications and a heartbeat thread that emulates timer interrupts to WOW-based applications. Each Win16 VDM also includes a separate thread for each Win16 application running within the WOW process.

Controlling WOW Behavior
To reduce system overhead and increase efficiency, NT waits to load the WOW subsystem until the first time the operating system (OS) invokes a Win16 application. As a result, the first Win16 application takes longer to start than subsequent Win16 applications you execute during the same session. You can reduce the start time for the first Win16 application by forcing NT to preload WOW (use this tip only if you frequently run Win16 applications). To force NT to preload WOW, add a wowexec.exe file shortcut to the Startup group. If you place the wowexec.exe in the per-machine (i.e., common) program group, WOW automatically loads for all users on the machine. If you place the wowexec.exe in the per-user (i.e., personal) program group for one user, WOW automatically loads for just that user.

One of WOW's shortcomings is that WOW remains in memory (even after you close all Win16 applications) until you shut down the system or log off. You can free up the memory and CPU resources NT has allocated to WOW by manually terminating the wowexec.exe process after you finish running all Win16 applications during a session. To terminate the wowexec.exe process, press Ctrl+Alt+Del or right-click an empty space on the taskbar and click Task Manager to run the NT Task Manager. On the Processes tab, locate the instance of the ntvdm.exe process containing wowexec.exe (no other applications should appear under this instance of ntvdm.exe; if they do, you need to close them before proceeding), as Screen 1 shows. Finally, select this instance of the ntvdm.exe process, and click End Process. NT will issue a warning about terminating processes this way; click Yes to terminate the wowexec.exe process. (You can use other methods to kill processes. For example, the kill.exe utility from the Microsoft Windows NT Server 4.0 Resource Kit lets you kill a process by name or process ID.) Shutting down the wowexec.exe process can free a significant amount of memory (a basic VDM plus wowexec.exe session takes about 3MB of system memory). If you won't be running any other Win16 applications soon, the system or other applications can make better use of this memory.

If one or more Win16 applications are running in their memory spaces, multiple instances of ntvdm.exe and the wowexec.exe process will appear in the Processes window. However, only one instance will remain after you exit all Win16 applications.

Never terminate the ntvdm.exe process (and its child wowexec.exe process) unless you are positive that no active applications are running within the WOW subsystem. Applications running within WOW appear as indented entries underneath ntvdm.exe in the Processes window.

Related Content:

ARTICLE TOOLS

Comments
  • Anonymous User
    7 years ago
    Feb 09, 2005

    Do we know for sure that _wowexec.exe is a trojan? Because Ad-aware and SpyS&D didn't find it. I found a copy of it in the Taskmgr processes list.

    How can I get rid of it for good?

    Many thanks.

  • Anonymous User
    7 years ago
    Jan 14, 2005

    Indented wowexec is normal, however _wowexec is a trojan.

  • Anonymous User
    8 years ago
    Dec 14, 2004

    yes we did conclude the space in front is okay:
    "Applications running within WOW appear as indented entries underneath ntvdm.exe in the Processes window."

  • Anonymous User
    8 years ago
    Dec 05, 2004

    excellent explanation.

    Thankyou for your expertise.

  • Anonymous User
    8 years ago
    Nov 14, 2004

    did we decide that wowexec.exe with a space in front was good or bad?

You must log on before posting a comment.

Are you a new visitor? Register Here

advertisement

advertisement

White Papers

Get your Windows 7 deployment off to the right start by implementing PC lockdown. A locked-down environment is easier and cheaper to support since users are less likely to make unnecessary changes to the core system configuration - read more here!

Essential Guides

Is your iSCSI "lossy"? The reality is that most off-the-shelf Ethernet hardware deployed for iSCSI can lose packets, resulting in slow performance or application downtime. Learn how to assess your current iSCSI infrastructure and engineer an advanced iSCSI SAN infrastructure.

Web Seminars

What's the best way to keep your network safe from malware? In this web seminar, security expert Greg Shields suggests an alternative method to the traditional blacklisting approach that is common with anti-virus and anti-malware solutions.

eLearning Series

We bring the experts direct to you to share their real-world perspective and expertise. During each event, three sessions stream in real time, so you can learn, ask questions, and get solutions.
Upcoming event: Getting the Most with Exchange 2010 with Paul Robichaux

Subscribe to Windows IT Pro!

Windows is a trademark of the Microsoft group of companies. Windows IT Pro is used by Penton Media Inc. under license from owner.