What is c:\Windows\System32\GWX\GWX.exe?

Hot to fix GWX.exe problem?

GWX.exe is not a virus. It is a part of Microsoft advertising program: Get Windows 10!
You can fix “GWX ads” problem using our small utility: GWX Stopper.
GWX Stopper is free of charge!

Download GWX Stopper. Free. No adware. No spyware.

Last update: March 22 2019
GWX Stopper version: 3.3.
Disabled Windows 7 End of Service screen (EOSNotify.EXE) during startup.
Disabled Windows End of Support screen (SIPNOTIFY.EXE after KB4493132) during startup.
Added protection against GWX executing.
GWX Stopper always blocks GWX and other related processes from running.
Added policy blocking auto OS upgrade.
GWX Stopper 3.1 Released to Make Forced Windows 10 Upgrades Impossible!

Why GWX Stopper is better than GWX Control Panel or Never10?

1) GWX Control Panel uses real-time monitoring against GWX.
It takes the computer resources and it is not a bulletproof solution.
You get rid of GWX, but got the GCP.
GWX Stopper does not use real-time monitoring.
It does not consume additional resources.
GWX Stopper sets a trap for all GWX related processes.

If GWX.EXE executes, you will see GWX Stopper window instead of GWX.

2) Never10 relies on Microsoft policy preventing GWX. But it is not good because Microsoft may change “games rules” in any moment. It does not fix GWX tasks and background working.
GWX may still work without displaying something.
GWX Stopper completely protects you against running GWX and it removes GWX background working too.

GWX Stopper is lightweight and simple in use.

Note!
GWX Stopper is a registered trademark of Greatis Software LLC.
GWX Stopper is not related and never been related to GWX Control Panel.

GWX – Full Story

Last updated August 5 2015.

GWX location:
C:\Windows\System32\GWX\GWX.exe

gwx-exe-folder

Usually this file is created on the Windows 7/8/8.1 systems after installing Microsoft updates: KB 3035583.

GWX.exe is digitally signed by Microsoft Corporation (Microsoft Windows).

File name	File version	File size	Date	Time	Platform
Config.xml	Not applicable	17,504	17-Mar-2015	22:24	Not applicable
Gwxgc.exe	6.3.9600.17738	16,896	25-Mar-2015	02:59	x86
Gwx.exe	6.3.9600.17738	392,704	25-Mar-2015	02:59	x86
Gwxconfigmanager.exe	6.3.9600.17738	496,128	25-Mar-2015	02:59	x86
Gwxui.dll	6.3.9600.17738	416,768	25-Mar-2015	03:00	x86
Gwxux.exe	6.3.9600.17738	337,408	25-Mar-2015	02:59	x86
Gwxuxworker.exe	1.0.0.1	295,696	24-Mar-2015	22:16	x86

GWX.exe can cause the following errors/problems:

0x800705aa – ERROR_NO_SYSTEM_RESOURCES
0x80070002 – ERROR_FILE_NOT_FOUND
hard drive consumption
slow Windows boot

GWX.exe enables additional capabilities for Windows Update .
http://support.microsoft.com/en-us/kb/3035583

GWX.exe

G.W.X. (gwx.exe) may be translated as Get Windows X (10) .

If the update is not listed in the installed Windows updates, use the Disk Cleanup Wizard as described in the article: http://support.microsoft.com/en-us/kb/2852386

GWX error messages in the Event log:

Error message: GWX Main: App failed to start hresult: The system cannot find the file specified.
Error message: GWX CompatLib: Failed to retrieve CEIP markers. hresult: The system cannot find the file specified.

GWX information messages:

Information message: GWX Main: Launched by task
Information message: GWX Main: Launched for tray startup

Seems like GWX will display Windows 10 advertising windows.

Information from config.xml:
<GlobalAdTimeOut>30</GlobalAdTimeOut>
<OnlineAdUrl>https://go.microsoft.com/fwlink/?LinkID=526874
<AdWindowSizes>
    <S> <x>350</x> <y>160</y>    </S>
    <M> <x>320</x> <y>210</y>    </M>
    <L> <x>480</x> <y>320</y>    </L>

GWX displays a tray icon regarding of a Windows phase.

<Phases>
    <Phase name=”None”>
<TrayIcon>false</TrayIcon>
       <Advertisement>false</Advertisement>
    <Phase name=”AnticipationUX”>
    <Phase name=”Reservation”>
    <Phase name=”RTM”>
       <TrayIcon>true</TrayIcon>
   <Advertisement>true</Advertisement>

Ads windows will not be displayed in the phases:
UpgradeDetected, UpgradeDownloadInProgress, UpgradeDownloaded, UpgradeReadyToInstall, UpgradeReadySetupInProgress, UpgradeSetupCompatBlock, UpgradeSetupRolledBack, UPgradeSetupFailed, UpgradeSetupComplete.

More info:

How to upgrade to Windows 10 without using GWX?

Download Microsoft Media Creation Tool

This tool has 2 options: setup a new system or upgrade current.

How to easily remove GWX problem?

I suggest you to remove GWX from Windows startup.
I wrote a simple free utility to disable GWX scheduling tasks.
It does not delete any files from your computer.
No adware/spyware.
Use it on your own risk!

Download GWX Stopper. Free. No adware. No spyware.

Download GWX Stopper

Jeremy Bird

I was getting intermittent long boots and couldn’t work out why. After a lot of mucking around and outstanding input and help from Greatis S/W (Dmitry), it turned out that the boot issue started on the day that GWX mysteriously arrived on my system KB3035583 presents as Optional in Windows Updates, can’t remember about KB3031432 but I think it was in the Important list. I did a bit of research and can’t see any reason why I would want either of them. I removed them both and that process removed GWX. All good now. If you don’t know how to uninstall Windows updates, google it for your O/S. There are many ways and they’re all easy.
Uwe Freudenreich

According to Microsoft KB3031432 is supposed to be a security update, that should prevent “an attacker to take advantage of the lack of impersonation-level security checks to elevate privileges during process creation”.

See: https://support.microsoft.com/…

Does it make sense to remove this update and risk that an attacker takes over your PC??
I’d be grateful for any advise in this, because I’m experiencing massive slowdown when booting my Win7 machine as well, since these updates were installed.
Also the search indexer drives me crazy, since it takes more time the fuller the HD gets and I’m thinking about deactivating it.
Many thanks in advance for a short advise.
Dmitrys

Don’t touch KB3031432
Remove only KB 3035583.
On my opinion GWX is really useless. It slows down your computer.
I think it’s a Microsoft way to speedup update to Windows 10.
They used the popup warning utility on the Windows XP.
GWX is a similar tool for Windows 7/Vista.
You can disable GWX service and delete GX folder using administrator account.
Coss71

The GWX is for when Microsoft releases Windows10. That folder is the “remote client” in your system for when the RTM version is released; when it is, the files in GWX will enable it to say bay to MS that the computer it’s on is eligible for the free Win10 upgrade and it will notify you that you can have the free update.
Benoit Chalifoux

GWX=Get Windows 10, Like Coss71 said it’s for when Microsoft releases Win10
http://www.dirtywindows.hu/ Endless Nameless

Illuminati confirmed.
Element of Light

Remove GWX with the Windows Updater the Update names KB3035583 go to: Windows Update -> Installed Updates -> search GWX and remove it.
True Radiant Free

Good info!
Callum

“GWX.EXE is not a virus”. That is 100% incorrect. Programs which do similar things are regularly labelled as malware/adware/virus, therefore KB3035583 is a virus by the same definition. It just happens to have been written by Microsoft, and thats why people say that its not a virus, thats the only difference. Microsoft must really be desperate.
Dmitrys

I agree with you. But Microsoft is an owner of Windows. Seems like they may do all what they want.
Callum

Doesnt make it any less wrong…
Callum

What is the lesson from all this? Get Linux.
陳美慧

There were few window updates notification recently and I updated the window . I used the software to remove the gwx icon. It can also remove the gwx, but the gwx re-install and appear automatically after 2 days. Please update the software in order to remove the gwx permanently, thank you.
Dmitrys

Thanks!
I have updated GWX Stopper 1.2.
Please, try it.
Ken

Well I’d agree with one of your statements… the way Microsoft placed this aggressive program into the KB3035583 “important update”, is a new low for MS. As the full and “complete” removal requires uninstalling and blocking this update, along with editing ones registry to remove any remnants,…or that dam aggressive GWX.exe will find it’s way back. (Many are reporting this on the net)

So GWX.exe is definitely resembling the actions of a hidden virus or aggressive spyware, and even could be considered a type of Trojan for MS to enable when the roll out of Windows 10. Not informing customers that a sneaky aggressive program will be included or installed on ones toolbar advertising an ad for a future product, or even providing the option of “easily” uninstalling this unwanted program is just wrong.
Joe Citizen

No, Microsoft owns the copy right to Windows but they do NOT own windows. That is the same as saying the grocer owns the food you bought from them or the car manufacture owns the car you drive. If you paid for it, YOU own it…

And as the owner you may tweak it, tear it down and decompile it or whatdafuckever you want to do with that copy as it is yours and Microsoft is no longer the owner of that copy of Windows or whatever juckware they sold you…
Shadow Wolpertinger

It’s NOT required for windows 10 because windows 10 is free. You don’t need a system slowing program or a coupon or a recommendation of any kind ect. When win-x comes out it will be free.

Now if only they’d give ALL versions of windows downgrade options.
Instead of just select versions like Professional. I hate windows 8.1
but don’t want to pay for a new OS. Since it’s not pro though I don’t
get the free downgrade options.
marklar

Nice program, thanks
Peter

GWX.exe is an ADWARE!
It started to disturb me with popups to “notify me” about the “free” Windows 10 upgrade.

Once when it shows up first time, I chosen that I didn’t want to upgrade to Windows 10, because this computer is my company’s computer, so the upgrade is not so easy.
Until today it does not disturb me.

Today it started to show popups, that “My Free upgrade is waiting…”
I could not close this popup.
When I close the disturbing popup, in few seconds later it shows up again-and-again.

Thus I mark this program as an adware and I’m going to remove it from the computer.
Callum

It is adware. There is no nice way of saying.
Callum

It is adware. There is no nice way of saying it.
eSage

Apparently someone hasn’t read their EULA. You do NOT own Windows. You did not BUY Windows. What you paid for was the right to USE Windows. That operating system on your computer is still owned by Microsoft.
IT-user

GWX.exe is a Malware and Adware software, developed by the corporate people at Microsoft. There is no other way of saying it. This is the truth.
Dmitrys

GWX Stopper has been updated to version 2.0!
jivadas

good: your GWX works perfectly
bad: next time you update the update returns,
even if you have hidden it
here’s a list of all this crap from overclock.net

WINDOWS 7/8 TELEMETRY & WINDOWS 10 PREPARATION. DO NOT INSTALL/NOT NEEDED.

KB2882822 – Update adds ITraceRelogger interface support.

KB2952664 – Compatibility update for upgrading Windows 7 = Windows 7 nagware patch that touts the Windows 10 upgrade.

KB2976978 – Windows 10 Upgrade preparation for Windows 8.

KB2977759 – Compatibility update for Windows 7 RTM = W10 Diagnostics Compatibility telemetry.

KB2990214 – Update that enables you to upgrade from Windows 7 to a later version of Windows.

KB3012973 – Force Trigger Download and Install of Windows 10.

KB3015249 – Adds telemetry points to consent.exe in Windows 7 & Windows 8.

KB3021917 – Update to Windows 7 SP1 for performance improvements (telemetry)

KB3022345 – Adds telemetry.

KB3035583 – GWX update installs Get Windows 10 app on Win 7 and 8.1

KB3042058 – Microsoft claims its a security update but it contains Winlogon Spying.

KB3044374 – Windows 10 upgrade for Windows 8.

KB3050265 – Windows Update Client for Windows 7: June 2015 = WU service updated to accept upgrade to W10 + other fixes

KB3050267 – Windows 10 upgrade preparation but also adds the option in GPEDIT to disable Windows 10 upgrade altogether.

KB3064683 – Windows 10 upgrade for Windows 8.

KB3065987 – Windows 10 upgrade for Windows 7.

KB3065988 – Windows 10 upgrade for Windows 8.

KB3068708 – Update for customer experience and diagnostic telemetry.

KB3072318 – Windows 10 upgrade preparation for Windows 8.

KB3074677 – Windows 10 upgrade preparation for Windows 7.

KB3075249 – Update that adds telemetry points to consent.exe in Windows 8.1 and Windows 7

KB3075851 – Windows 10 upgrade for Windows 7.

KB3075853 – Windows 10 upgrade for Windows 8.

KB3080149 – Update for customer experience and diagnostic telemetry

KB3081437 – Windows 10 upgrade preparation.

KB3081454 – Windows 10 upgrade preparation.

KB3081954 – Telemetry Update for Windows 7.

KB3083324 – Windows 10 upgrade preparation for Windows 7.

KB3083325 – Windows 10 upgrade preparation for Windows 8.

KB3083710 – Update for the Windows Update client with sketchy details for Windows 7. Windows 10 preparation.

KB3083711 – Update for the Windows Update client with sketchy details for Windows 8. Windows 10 preparation.

KB3088195 – Microsoft Claims it’s a security update but also has a key logger on the Kernel Level.

KB3090045 – Windows 10 Upgrade Update for Windows 7/8.

KB3093513 – Security Update for Windows Shell to Address Remote Code Execution.

KB3093983 – Microsoft claims it’s a security update but it contains IE spying.

KB3102810 – Fixes an issue regarding long wait while searching for Windows Updates but also has Windows 10 upgrade preparation for Windows 7.

KB3102812 – Fixes an issue regarding long wait while searching for Windows Updates but also has Windows 10 upgrade preparation for Windows 8.

KB3112336 – Windows 10 Upgrade for Windows 8.

KB3112343 – Windows 10 Upgrade for Windows 7.

KB3118401 – Allows Windows 10 dependant Universal Runtime apps to run on earlier versions of Windows.

KB3123862 – Updated capabilities to upgrade Windows 8.1 and Windows 7

KB3135445 – Update to Windows Update Client in Windows 7. Windows 10 preparation.

KB3135449 – Windows 10 Upgrade for Windows 8.

KB3138612 – Windows Update Client Update for Windows 7. Windows 10 preparation.

KB3138615 – Windows Update Client Update for Windows 8.1. Windows 10 preparation.

KB3139929 – Security update for IE11 which adds Windows 10 preparation.

KB3146449 – Windows 10 upgrade capabililities for IE11.

KB3148198 – Cumulative update for IE11. Includes previous Windows 10 preparation.

KB3150513 – Windows 10 upgrade for Windows 7 & 8.
jivadas

no
MS is the vendor of my win7
that’s why I have that ridiculous Product Key
I am the owner of the system
and search updates before I install them
win 10 installs updates automatically
Dmitrys

I have updated GWX to version 3.0.
Now it block GWX.EXE and other related processes from running.
If a Windows update reactivates GWX you will see a GWX Stopper window, but GWX will never run.
Ashwaq Hilal

I have removed this one in my laptop using ESET Antivirus. I didnt know that it was an adware until ESET prompts me. This is a relief