What is ntvdm.exe?

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the ntvdm.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for ntvdm.exe related errors

Ntvdm.exe file information

Windows Task Manager with ntvdm
Ntvdm.exe process in Windows Task Manager

The process belongs to software Microsoft Windows Operating System or OIN or MediaTickets by OIN by Microsoft (

Description: Ntvdm.exe is an important part of Windows, but often causes problems. The file ntvdm.exe is located in the C:\Windows\System32 folder. Known file sizes on Windows 10/8/7/XP are 526,848 bytes (76% of all occurrences), 520,704 bytes or 520,192 bytes. 
It is a Windows core system file. The file is a Microsoft signed file. The program has no visible window. Therefore the technical security rating is 5% dangerous, however you should also read the user reviews.

Recommended: Identify ntvdm.exe related errors

If ntvdm.exe is located in a subfolder of "C:\Program Files\Common Files", the security rating is 64% dangerous. The file size is 73,216 bytes. There is no file information. The program is not visible. The process starts when Windows starts (see Registry key: Run). It is not a Windows system file. Ntvdm.exe is able to monitor applications.

External information from Paul Collins:

Important: Some malware disguises itself as ntvdm.exe, particularly when not located in the C:\Windows\System32 folder. Therefore, you should check the ntvdm.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

Windows 16-bit Virtual Machine is used to run DOS programs
16bit application layer for Windows NT based operating systems (NT, 2k, XP,...)
  Pieter-Jan Gunst  
Hosts 16-bit Windows apps and DOS apps under NT, Windows 2000 and XP
This link provides detailed description
Although it is a Windows program, it seams to be using 100% of my CPU and the only way I can get rid of it is to constantly delete it through Task Manager. An iritating nusance...
I recommend going to the Task Manager and stopping ntvdm.exe when installing our software Skyline Property Management from I also stop MMC.exe--these two seem to those the install of our 3rd party software Pervasive DB and Crystal Runtime.
  Dale Randle   (further information)
ntvdm.exe causes chasm the rift to not play on my computer
dos system, makes xp a bit less USeless
found it in more than ten folders on my computer
The virus Alureon may camoflage itself as this file
  David Brown   (further information)
ntvdm is pulling up the docs32.exe file as soon as internet connects and executes the file infmgr.exe from %systemroot% \system32.
  Ronald M  
it uses 100% of CPU
  jignesh vadera  
It Sarts GETMODULE 30.exe a virus so i realy thought it was a virus to but its a core file...
  Tyler Bundy  
Invoked by Windows as VM running a DOS program. So "needed" is relative.
needed to run dos applications and some games
  Big Smoke  
do not delete or rename this file or you will have big problems.
  Larry Carter  
adwatch kills it by default, which causes SysSuite8 diskfixer to fail
It is a screen that keeps poping up saying there is a problem with it on our comptuer
NT Virtual Dos Machine, is in itself not a harmful program. It can become a problem if it is replaced by a malicious version as always. In addition, badly written or a malicious dos applications which is run by ntvdm can be harmful
I was at startup, And a bunch of "NTVDM"s poped up in my windows task manager, They were opening and closing and it was right after I scanned my computer..
Fan started running continuously so checked task manager and ntvdm was using 50% cpu so ended process. Fan slowed and system ran fine afterward. Happened only once. Win XP
source code of ntvdm.exe file
  robert collins  
seems to be stopping my older DOS programs from running.
it's a windows system file but not essential.and harmful too
using 100% of my CPU
When this opens, wow.exe opens with it as a sub program. When I close ntvdm.exe from Task Manager, wow.exe closes also. I believe the wow.exe is some sort of spyware. I do not run Word of Warcraft. Computer also slows down quite a bit.
It uses a lot of cpu time and really slows my system when it is not caught by McAfee security software
Ntvdm.exe is used for running 16 bit applications on a 32 bit system. It is not dangerous but it will max out your CPU because of the conversions it does.
It uses a lot of CPU when I run QBasic
  Zarquon the magnificent  
Consumes an entire core of my Core 2 Duo E8400
  Kevin Kim  
When I execute a batch that runs in a loop, I can see ntvdm.exe running. It consumes about 80% of one of my cores.
  Edward L  
It can be stopped using Process Blocker(try both version 4rm: ). I am pretty confident it'll work for you too.
It is used Only when the computer user runs C/C++/C# programs
  Shaik Shoeb windows file it uses 100 percent of cpu usage to stop this file open ur task manager open process right click on ntvdm.exe then click on end process tree
essential for Windows
I closed my dos window and ntvdm.exe closed , was taking 30% cpu
  Bob Joy  
use 99% of my CPU. Only invoked when trying to run a very old dos game
when i open my laptop 20 minutes later x2 ntvdl.exe are appeared at my task manager and my cpu goes up to 100% then i have to stop them manually... plz i need help to fix it...
  dj pol  
for installation of gre powerprep it needs
ntvdm.exe will startup when you start up qb.exe version 1.1 or 4.5 . Strangely enough though when starting qb.exe version 1.1 , ntvdm uses a lot less cpu time.
  Leendert Schouten  
it started in the background and used lots of cpu recource and ended as i closed turbo c compiler v3 for C++
Windows Virtual DOS Machine, runs old 16-bit DOS or Windows 3.1 software. In the Task Manager, you will also see wow.exe- this is short for "Windows On Windows", emulating the older 16 bit Windows 3.1.....
  Bill Matthews  
I ended it and my CPU went from 80%-100% to 30%-60%. My fan made less noise and nothing bad happened.
when i downloaded 3 windows updates for XP ,NTVDM.exe used 100% of my CPU so i ended the prosses in task manager and hid the updates to stop them downloading ever again
when you download some application like online games,utilities,appsware,etc. it is perfect.No problem available...when u use it for a few times...NTVDM.EXE appear then said it cant be open because of some error.I dont think its an error.its like controlling it or eat the system.
  syafiq zamri  
It distracts the browser from sending and receiving data
  Richard Keep  
cannot open any application or softwares.....and even cannot delete it from system 32 directory
ntvdm.exe used to be a pipeline for malware, don't know if this still applies, blocking its execution with a good firewall creates no application problems out of well over 400 apps on my XP box.
  Dave Abbott  
You need it, but it stays running unless you restart or close the process(es). No damage to end process but be sure you aren't installing or running a DOS program.
seems to hog less time if you right click on it & set it to low priority - am using qbasic and need it
  Scott Woods  
saw it first time today as I prep for DOS work...file size is 411K, a 15K dll accompanies. Firewall freaked out so blocked for now...
Comodo firewall rates it as unsafe
It's a virtual environment for DOS programs to run in; nothing more. It's only active when DOS is in use. When you terminate the DOS program, NTVDM should turn off immediately.
  your name  
essential for window
Virtual DOS machine, to enable running 16 bit apps on 32 bit OS.
it is display when you type edit command with any file in cmd
NDM process create an error file named Remind.exe and it closes and opens and close and open and ........ I have to end the process of NDM.exe it also slows my computer it's dangerous.
ntvdm.exe is must be execution before to run it. but it is done. so you not need installing before of them. the exe to be needed to run your computer.
  Muhammad Adi Nugroho  
NTVDM means NT Virtual DOS Machine. It is a MS-DOS emulator (kind of like Dosbox) used to run 16-bit programs.

Rating chart

Summary: Average user rating of ntvdm.exe: based on 72 votes with 59 user comments. 27 users think ntvdm.exe is essential for Windows or an installed application. 15 users think it's probably harmless. 12 users think it's neither essential nor dangerous. 11 users suspect danger. 7 users think ntvdm.exe is dangerous and recommend removing it. 8 users don't grade ntvdm.exe ("not sure about it").

Do you have additional information?
What do you know about ntvdm.exe:
How would you rate it:
Link for more info:
Your Name:

Best practices for resolving ntvdm issues

A clean and tidy computer is the key requirement for avoiding problems with ntvdm. This means running a scan for malware, cleaning your hard drive using cleanmgr and sfc /scannow, uninstalling programs that you no longer need, checking for Autostart programs (using msconfig) and enabling Windows' Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the ntvdm.exe process on your computer, the following programs have proven to be helpful: Security Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

ntvdm.exe [all]