User question
Hello.
Recently, my laptop began to make a lot of noise and slow down. In the task manager I saw that the "System.exe" process creates a heavy load (it even reaches 40-50%!). What is it, and what can be done with it, how to find the cause of the problem? It wasn't like this before ...
PS Laptop ASUS X501, Windows 10 Pro
Andrew
Good day.
Well, in general, such a system process as "System" exists, but "System.exe" - as far as I know, does not! (and already its very name looks very suspicious, as if disguised). It can be anything: from a virus to a program for mining cryptocurrency (recently, such "add-ons" have become popular).
And so, let's get down to business ...
*
What to do with a "suspicious" process ...
1) Look at its location
The first thing I recommend to do is in the task manager (to run it press Ctrl + Shift + Esc) click on this process with the right mouse button and select "Open file location" (if there is no such link, select "details"). The screenshot below shows an example.
In detail
Next, open the location of the file.
We look at the location of the file
In general, a similar problem with "System.exe" observed several times:
- one reason was "Kms-Auto" used by some logging programs. By removing and closing this "utility" - the problem was completely resolved.
- in another, the process was associated with Windows Media Center. By removing this from the installed programs, such a process no longer loaded the CPU.
Let me remind you that the original "System" refers to the system folder C: \ Windows \ System32 to the file "ntoskrnl.exe".
Addition!
If the "viral" folder or file will not be deleted, use the AVZ antivirus utility and the tips from this article.
2) If the processor is loaded with something, but the task manager does not show this process or file location
This is not uncommon. In this case, I recommend using a special utility from Microsoft. It's about Process Explorer.
Process Explorer
Website: //technet.microsoft.com/ru-ru/bb896653.aspx
This utility helps you find out which program opened a particular file. The program allows you to view information about the handles open by the process and the DLLs loaded by it.
Note that not a single process running on a PC will "leave" it. Much more informative than a regular task manager.
Process Explorer main window
3) How to distinguish a real process from a fake one (which of the processes Svchost, System, etc. is not real)
One of the easiest ways is to use the AVZ antivirus utility (link to the official site). In her arsenal there is a special "Process manager" ( to open it - use the menu "Service / Process Manager") .
The essence of this dispatcher is that he knows how to distinguish between processes that can be trusted (they are marked in green), and processes about which he knows nothing.
For example, you suspect that one of the processes Svchost or System not real - just go through the list of these processes. All "normal" ones will be highlighted in green (plus note the "Description" and "Manufacturer" columns for Microsoft and Windows).
4) Prevention
As a preventive measure (so as not to pick up "like"), you can advise quite banal things:
- do not install various extremely suspicious applications that promise you some money (or look through interesting "photos" received by mail from an unknown addressee);
- download programs from official sites, do not use various keys, etc. (especially now, when many programs have free analogues, trial periods, etc.);
- install one of the modern antiviruses and configure it to be updated regularly. I noted the best products in this article -> 👌.
- and, of course, sometimes make backups of important data. Better yet, set up synchronization of your documents with cloud disk... You can find out what it is and how to use it here: //ocomp.info/kak-podklyuchit-oblachnyiy-disk.html
*
That's all, good luck!
