What is system32.exe?

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the system32.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for system32.exe related errors

System32.exe file information

Windows Task Manager with system32
System32.exe process in Windows Task Manager

The process known as Photo Editor belongs to software Sistema operacional Microsoft Windows or Photo Editor by Microsoft ( or Photo Editor.

Description: System32.exe is not essential for Windows and will often cause problems. System32.exe is located in the C:\Windows\System32 folder. Known file sizes on Windows 8/7/XP are 381,952 bytes (12% of all occurrences), 3,994,624 bytes and 22 more variants. 
There is no information about the author of the file. The file is not a Windows system file. The program is not visible. The system32.exe file is located in the Windows folder, but it is not a Windows core file. The process is loaded during the Windows boot process (see Registry key: MACHINE\Run, Run, Winlogon\Shell, MACHINE\RunServices, MACHINE\User Shell Folders, DEFAULT\Run, DEFAULT\Runonce, exefile, User Shell Folders, RunOnce, MACHINE\RunOnce). System32.exe is able to record keyboard and mouse inputs, monitor applications, connect to the Internet and hide itself. Therefore the technical security rating is 70% dangerous, however you should also read the user reviews.

Recommended: Identify system32.exe related errors

External information from Paul Collins:
There are different files with the same name:

Important: Some malware also uses the file name system32.exe, for example Trojan:MSIL/Bladabindi.F or Worm:Win32/Cabresov.A (detected by Microsoft), and HEUR:Trojan.Win32.Generic or Trojan.Win32.Cosne.aamu (detected by Kaspersky). Therefore, you should check the system32.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

Backdoor.SdBot.aa checked with Kapersky online virus scanner installs itself in the registry: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\WINNT\System32\System32.exe" original entry is only "Explorer.exe"
  Martin Gwosdz   (further information) (further information)
I know that it Locks the Task manager, Regedit, and msconfig. It always replacces itself in the WINDOWS folder and so far, can't be deleted.
  Vincent C  
It´s a part from a Virus or Worm! Must be deleted! I had problems with it.
Teil des PC Security Test 2005
Very difficult so far to remove.
it only does that for a selected amount of time, it will eventurally quit, and you'll be fast
smart card reader
  tonis sander  
its a virus and its been known to bog down the internet too
  dr. awsome  
the system 32 is the folder that contains all the stuff to keep windows running anyway windows wont let you delete it because it keeps windows working.If you did delete it window will crash
It's a very dangerous virus that can slowly but surely delete your other core files
  Gregory Lulz  
Your system32 folder is pretty mutch your computer and if It's removed from your computer you will need to re format your computer
My pc is currently not working due to me deleting all files including the root system 32 , this was due to me wanting to load an upgrade. My pc is now telling me that I have to upload the system 32
  dave, scotland  
Get rid of it! It's a virus! One of the most lethal of them all!
It took over my Norton security and would not allow me to quarantine it, It also locked me out as the adminstrator and took over my entire system. Even after a system recovery it was still there.
A virus, said by avast! Anti-Virus.
  Raiko K   (further information)
%windir%\system32 - the pathway for the system directory on a windows partition
  Colin Brennan  
An outdated driver used for running 32 bit magnetic tape style discs
  Dr. Virgil Pryor  
systems32 is a folder containing core files. Use a trusted virus scanner to detect if anything may have gotten in there.
Appears to be worm, Computer kept freezing especially Explorer.exe while AV protection was enabled. Stopped system.32 from starting with PC via MSConfig and deleted registry entries for system32.exe rebooted machine. EXE vanished now running a full system search for that file but PC seems to be responding alot better now.
It sits in your computer and sooner or later it shuts your computer down.
The system 32 subfolder located in C:\\ Windows\System 32 is not a virus but your computer. The application System 32.exe is a virus or a worm. I recommend removing it if possible( not the folder System 32).
pasword brake fiel on system 32
Virus! Lost all of my music and movies because of it!
  A.N. Hero  
am trying to know it, best part of system to hack, this is used
  santhosh pavan  
System.32.exe was located in C:\winnt\system32\Lavan\ Starts IpcScan.exe. Beware: don´t confuse the file SYSTEM32.EXE with the folder C:\winnt\system32\ !!!
it pops up evrytime the pc is started
  Harry Layne  
This file is extremely important, removing it will cause your computer to be renderd useless (untill it has been reformated)
  Jamie Lyon, Iraq  
It seems to be unsafe, i was hacked recently and lost all my MSN contacts information. The hacker turned out to be some one just having fun, but he advised me to remove system32 as this was how he got access
all window tools
It's important. Don't delete it, or you'll break your computer,
system 32.exe is stopping me re installing after crashing it will not allow windows to start or load vista
  david tattam  
its a virus :)
It is definetly not needed, you have a folder of system32 in Windows that IS required, but the executable is not
  Deleté NonWinFiles  
WINDOWS\system32 is extremely important. If you delete that entire directory, you will be forced to re-format. On the other hand, WINDOWS\system32\system32.exe is a worm/advanced virus. Use virus scanners(that detect trojans & worms,as well)to make sure that it isn't in the WINDOWS
Do not remove system32
  mark hancock  
its needed for windows to work
it shutsdown my computer all of a sudden,and it keeps poping out when i turn on my PC
Apparently eats up alot of CPU power. Most likely a virus.

Rating chart

Summary: Average user rating of system32.exe: based on 49 votes with 40 user comments. 17 users think system32.exe is essential for Windows or an installed application. 3 users think it's probably harmless. 11 users suspect danger. 18 users think system32.exe is dangerous and recommend removing it. 8 users don't grade system32.exe ("not sure about it").

Do you have additional information?
What do you know about system32.exe:
How would you rate it:
Link for more info:
Your Name:

Best practices for resolving system32 issues

A clean and tidy computer is the key requirement for avoiding problems with system32. This means running a scan for malware, cleaning your hard drive using cleanmgr and sfc /scannow, uninstalling programs that you no longer need, checking for Autostart programs (using msconfig) and enabling Windows' Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off doing a repair of your installation, or in the case of Windows 8, executing the DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the system32.exe process on your computer, the following programs have proven to be helpful: Security Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

system32.exe [all]