I see a process in task manager called "System", and I couldn't find any kind of relevant explanation about it on the net. Task manager shows its description to be "NT Kernel & System". Could someone explain what is this process and how does it relate to the other core processes of windows 7? Thanks!
migrated from stackoverflow.com Dec 14 '12 at 2:44
This question came from our site for professional and enthusiast programmers.
From Windows Internals 6th ed. Part 1. page 69
System Process and System Threads
The System process (process ID 4) is the home for a special kind of thread that runs only in kernel mode a kernel-mode system thread. System threads have all the attributes and contexts of regular user-mode threads (such as a hardware context, priority, and so on) but are different in that they run only in kernel-mode executing code loaded in system space, whether that is in Ntoskrnl.exe or in any other loaded device driver. In addition, system threads don't have a user process address space and hence must allocate any dynamic storage from operating system memory heaps, such as a paged or nonpaged pool.
If the process is called System with PID of 4 then it is the "Web Deployment Agent Service"
If it's not with pid 4, occupying port 80 then it's just a part of the kernel handling the drivers that interact with the system hardware. Killing it will make your computer BSOD as well, as you experienced. I don't have any official microsoft reference right now, maybe someone could dig it up.
If the process is called System.exe:
Most likely it's a trojan backdoor + keylogger. I've had it in the past as well.
Here's a description from Kaspersky that should fit - hopefully. If it's not a variant of these viruses, still check the registry keys. I have added the description of PSW-Delf just so you can have a general guideline on how to remove it and handle the registry as well.
Before performing any manual checks I recommend downloading / updating antivirus + spyware/malware programs and running a full scan (boot scan, memory scan, file+registry scans).
|show 8 more comments|