1

I see a process in task manager called "System", and I couldn't find any kind of relevant explanation about it on the net. Task manager shows its description to be "NT Kernel & System". Could someone explain what is this process and how does it relate to the other core processes of windows 7? Thanks!

1
  • Start Task Manager -> "Processes" tab-> click on View (menu) -> "Select Columns", select "Path to Image". And I see "NTOSKRNL.EXE" on my Win 7. Simply.
    – Jet
    Jun 24, 2013 at 10:38

2 Answers 2

4

From Windows Internals 6th ed. Part 1. page 69

System Process and System Threads

The System process (process ID 4) is the home for a special kind of thread that runs only in kernel mode a kernel-mode system thread. System threads have all the attributes and contexts of regular user-mode threads (such as a hardware context, priority, and so on) but are different in that they run only in kernel-mode executing code loaded in system space, whether that is in Ntoskrnl.exe or in any other loaded device driver. In addition, system threads don't have a user process address space and hence must allocate any dynamic storage from operating system memory heaps, such as a paged or nonpaged pool.

-1

If the process is called System with PID of 4 then it is the "Web Deployment Agent Service"

If it's not with pid 4, occupying port 80 then it's just a part of the kernel handling the drivers that interact with the system hardware. Killing it will make your computer BSOD as well, as you experienced. I don't have any official microsoft reference right now, maybe someone could dig it up.

If the process is called System.exe:

Most likely it's a trojan backdoor + keylogger. I've had it in the past as well.

Here's a description from Kaspersky that should fit - hopefully. If it's not a variant of these viruses, still check the registry keys. I have added the description of PSW-Delf just so you can have a general guideline on how to remove it and handle the registry as well.

Before performing any manual checks I recommend downloading / updating antivirus + spyware/malware programs and running a full scan (boot scan, memory scan, file+registry scans).

13
  • -1, this seems unlikely and cursory Googling suggests that this is a legitimate process.
    – cha0site
    Dec 5, 2012 at 14:20
  • @cha0site can you provide a link if you downvote? Or refrain from downvoting unless we get a virus scan report from the poster?
    – LonWolf
    Dec 5, 2012 at 14:24
  • Try support.microsoft.com/kb/295714
    – cha0site
    Dec 5, 2012 at 14:36
  • 1
    @johnye2e msdeploy (or recently known as webdeploy) is included in the full visual studio bundles as well. I had to install it manually due to Express Versions. Most likely it got configured at install time specifically if you got the ultimate versions. If you can perform a web deploy from the visual studio IDE of a web application, then you already got it for sure. You can also check it's presence using the web platform installer.
    – LonWolf
    Dec 5, 2012 at 15:08
  • 2
    -1 because SYSTEM is not the "Web Deployment Agent Service". It's the kernel system thread container. Dec 5, 2012 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .