Why 2 Swap Files?

Does anybody know why there are two swap files in Win 9x and Win 2K?

Win 9x: In C:\ and C:\Windows.

Win 2K: In C:\ and C:\Winnt.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

lazyart

that is news to me. i've only seen the swapfile in the root dir...

w^rl0rd

I think you're right with Win 2K, but I swear there are two Win386.swp files on a Win 98 machine.

cheeblie

It might be there for redundancy just in case someone manages to delete it. Kind of like how a .da0 is there to backup a .dat file incase of deletion. That would be my best guess, but like lazyart says, that is news to me as well.

Cheeblie

w^rl0rd

The second swap file on a '98 system is in C:\Windows.
Anyway, I think you're right. It is probably just a backup.

curio

On your 9x boxes try deleting the one in c:\
In your windows 2000 boxes - it's funny cos all WinNT systems use Pagefile.sys as the swap file.

Perhaps you have a trojan - or two, three, four - whatever.

curio

Should also mention that one of the ways of curing kernel.dll errors is to delete the page file, some techs copy the page file elsewhere (in DOS) then restart the system so it will create a new file - this could explain the one in C:\win386.swp. In windows 2000 you can specify one pagefile per drive through advanced configuration - but it appears in the root of the drive - i.e c:\pagefile.sys.

People using trojans often use filenames that correspond to actual files like kernel.dll, win386.swp, win.com so if a junior tech or power user sees them they don't touch them, believing them to be system files.

I hope this helps