Re: Fork issue on W10 WOW

[Marco Atzeri <marco dot atzeri at gmail dot com>]

Am 14.07.2018 um 21:03 schrieb Brian Inglis:
> On 2018-07-14 11:58, Achim Gratz wrote:
> > Marco Atzeri writes:
> > Anyway, the only time I've seen similar behaviour was when some other
> > library was occupying the address space the systems libraries should
> > have occupied, and the they get some extremely random address assigned
> > until the next reboot.  To do this the other library must however be
> > loaded pretty early in the boot process.  If you wrote the mail on said
> > laptop, this
> > > Diese E-Mail wurde von AVG auf Viren geprüft.
> > might be an explanation for the whole thing.  AVG is well known for
> > intercepting things already during boot and loading a bunch of their
> > libraries early.  Some of it is still done even if you switch it off
> > completely and some changes to the registry might even survive a
> > deinstallation.
>
> +1 for AVG BLODA - had to deinstall that years ago, and was slow; only reason I
> still run an AV is to catch stuff, either in Windows binaries from download
> sources about which little info is publicly available, or in email which folks I
> trust forward once in a blue moon, from their greedy or gullible infected
> friends, who are in the main, clueless or in denial about it.

In this case AVG is innocent.
I removed all AV and the lottery is still there

63DF0000-63DF1000
74F40000-74F41000
5DE20000-5DE21000

it seems the WOW64*.dll can be anywhere between
50000000-7F000000

The 32 applications present at boot are:

HP Cool Sense
HP Audio Switch
HP Jump Start
HP Message Service
Microsoft OneDrive
Lavasof Webcompanion
Wordweb Dictionary

and also Lavasoft seems innocent as after removal

5C900000-5C901000
5EE70000-5EE71000

I will wait until 1803 is installed, download is in progress,
before making new trials/experiments

Regards
Marco





--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple