Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I see a process in task manager called "System", and I couldn't find any kind of relevant explanation about it on the net. Task manager shows its description to be "NT Kernel & System". Could someone explain what is this process and how does it relate to the other core processes of windows 7? Thanks!

share|improve this question

migrated from stackoverflow.com Dec 14 '12 at 2:44

This question came from our site for professional and enthusiast programmers.

    
Start Task Manager -> "Processes" tab-> click on View (menu) -> "Select Columns", select "Path to Image". And I see "NTOSKRNL.EXE" on my Win 7. Simply. –  Jet Jun 24 '13 at 10:38

2 Answers 2

up vote 4 down vote accepted

From Windows Internals 6th ed. Part 1. page 69

System Process and System Threads

The System process (process ID 4) is the home for a special kind of thread that runs only in kernel mode a kernel-mode system thread. System threads have all the attributes and contexts of regular user-mode threads (such as a hardware context, priority, and so on) but are different in that they run only in kernel-mode executing code loaded in system space, whether that is in Ntoskrnl.exe or in any other loaded device driver. In addition, system threads don't have a user process address space and hence must allocate any dynamic storage from operating system memory heaps, such as a paged or nonpaged pool.

share|improve this answer

If the process is called System with PID of 4 then it is the "Web Deployment Agent Service"

If it's not with pid 4, occupying port 80 then it's just a part of the kernel handling the drivers that interact with the system hardware. Killing it will make your computer BSOD as well, as you experienced. I don't have any official microsoft reference right now, maybe someone could dig it up.

If the process is called System.exe:

Most likely it's a trojan backdoor + keylogger. I've had it in the past as well.

Here's a description from Kaspersky that should fit - hopefully. If it's not a variant of these viruses, still check the registry keys. I have added the description of PSW-Delf just so you can have a general guideline on how to remove it and handle the registry as well.

Before performing any manual checks I recommend downloading / updating antivirus + spyware/malware programs and running a full scan (boot scan, memory scan, file+registry scans).

share|improve this answer
    
-1, this seems unlikely and cursory Googling suggests that this is a legitimate process. –  cha0site Dec 5 '12 at 14:20
    
@cha0site can you provide a link if you downvote? Or refrain from downvoting unless we get a virus scan report from the poster? –  LonWolf Dec 5 '12 at 14:24
    
Try support.microsoft.com/kb/295714 –  cha0site Dec 5 '12 at 14:36
1  
@johnye2e msdeploy (or recently known as webdeploy) is included in the full visual studio bundles as well. I had to install it manually due to Express Versions. Most likely it got configured at install time specifically if you got the ultimate versions. If you can perform a web deploy from the visual studio IDE of a web application, then you already got it for sure. You can also check it's presence using the web platform installer. –  LonWolf Dec 5 '12 at 15:08
2  
-1 because SYSTEM is not the "Web Deployment Agent Service". It's the kernel system thread container. –  SecurityMatt Dec 5 '12 at 21:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.