Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I see a process in task manager called "System", and I couldn't find any kind of relevant explanation about it on the net. Task manager shows its description to be "NT Kernel & System". Could someone explain what is this process and how does it relate to the other core processes of windows 7? Thanks!

share|improve this question

migrated from stackoverflow.com Dec 14 '12 at 2:44

This question came from our site for professional and enthusiast programmers.

    
Start Task Manager -> "Processes" tab-> click on View (menu) -> "Select Columns", select "Path to Image". And I see "NTOSKRNL.EXE" on my Win 7. Simply. – Jet Jun 24 '13 at 10:38
up vote 4 down vote accepted

From Windows Internals 6th ed. Part 1. page 69

System Process and System Threads

The System process (process ID 4) is the home for a special kind of thread that runs only in kernel mode a kernel-mode system thread. System threads have all the attributes and contexts of regular user-mode threads (such as a hardware context, priority, and so on) but are different in that they run only in kernel-mode executing code loaded in system space, whether that is in Ntoskrnl.exe or in any other loaded device driver. In addition, system threads don't have a user process address space and hence must allocate any dynamic storage from operating system memory heaps, such as a paged or nonpaged pool.

share|improve this answer

If the process is called System with PID of 4 then it is the "Web Deployment Agent Service"

If it's not with pid 4, occupying port 80 then it's just a part of the kernel handling the drivers that interact with the system hardware. Killing it will make your computer BSOD as well, as you experienced. I don't have any official microsoft reference right now, maybe someone could dig it up.

If the process is called System.exe:

Most likely it's a trojan backdoor + keylogger. I've had it in the past as well.

Here's a description from Kaspersky that should fit - hopefully. If it's not a variant of these viruses, still check the registry keys. I have added the description of PSW-Delf just so you can have a general guideline on how to remove it and handle the registry as well.

Before performing any manual checks I recommend downloading / updating antivirus + spyware/malware programs and running a full scan (boot scan, memory scan, file+registry scans).

share|improve this answer
    
-1, this seems unlikely and cursory Googling suggests that this is a legitimate process. – cha0site Dec 5 '12 at 14:20
    
@cha0site can you provide a link if you downvote? Or refrain from downvoting unless we get a virus scan report from the poster? – LonWolf Dec 5 '12 at 14:24
    
Try support.microsoft.com/kb/295714 – cha0site Dec 5 '12 at 14:36
1  
@johnye2e msdeploy (or recently known as webdeploy) is included in the full visual studio bundles as well. I had to install it manually due to Express Versions. Most likely it got configured at install time specifically if you got the ultimate versions. If you can perform a web deploy from the visual studio IDE of a web application, then you already got it for sure. You can also check it's presence using the web platform installer. – LonWolf Dec 5 '12 at 15:08
2  
-1 because SYSTEM is not the "Web Deployment Agent Service". It's the kernel system thread container. – SecurityMatt Dec 5 '12 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .