Program file
ntvdm.exe: the Windows NT DOS Virtual Machine
ntvdm.exe is the Windows NT DOS Virtual Machine, a genuine Microsoft process that handles a single DOS environment for 16-bit programs. It starts with the first 16-bit program and stays in memory afterwards. It lives in C:\Windows\System32 and exists only on 32-bit (IA-32) Windows.
Prefer to check it yourself? The manual checks follow.
ntvdm.exe in C:\Windows\System32 on a 32-bit Windows is a legitimate Microsoft process. Do not end it by force while a 16-bit program is running.
A copy in another folder, or any ntvdm.exe on a 64-bit Windows that has no NTVDM, is not this component. Check the location and scan it.
- Full name
- Windows NT DOS Virtual Machine
- Publisher
- Microsoft, part of the Windows operating system
- Normal folder
- C:\Windows\System32
- Runs
- A single DOS environment for 16-bit programs
- Where it exists
- IA-32 (32-bit) editions of Windows NT; 64-bit Windows has no NTVDM
- Starts
- When you start a 16-bit program; it remains in memory after you quit it
- Needed by Windows
- Only for running 16-bit programs; old reports call it essential for normal functioning
What ntvdm.exe does
ntvdm.exe is a legitimate system process that belongs to the Microsoft Windows operating system. It is also called the Windows NT DOS Virtual Machine, because it is used to handle a single DOS environment.
It typically starts when you start a 16-bit program on your computer and remains in memory after you quit that program, in case you start another 16-bit program later. Like many other legitimate processes, ntvdm sits in the folder C:\Windows\System32.
NTVDM is part of the IA-32 editions of Windows NT, so it belongs to 32-bit Windows. 64-bit editions of Windows do not include it and cannot run 16-bit programs directly. The old report notes that this is so "if you are lucky": it depends on the edition you run.
Experts describe it as a core system file that, once executed, might take a lot of CPU power to run.
About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.
How to check ntvdm.exe
Check the folder first, then the Windows edition.
- Check the folder Open Task Manager (Ctrl + Shift + Esc), choose the Details tab, right-click ntvdm.exe and choose Open file location. The genuine file is in C:\Windows\System32.
- Check that your Windows is 32-bit Open Settings > System > About and read System type. NTVDM exists only on 32-bit Windows, so a 64-bit system should not have it.
- Check the digital signature Right-click the file, choose Properties > Digital Signatures and confirm that the signer is Microsoft Windows and the signature is valid.
- Scan the file Run a Microsoft Defender full scan from Windows Security > Virus & threat protection > Scan options. A thorough system scan is needed when the file behaves strangely.
A signed file in System32 on 32-bit Windows is genuine. Strange behaviour of the file can be a sign of a fake or corrupted version.
Do you need ntvdm.exe?
Yes, if you run 16-bit programs; it is a Windows component, not a program you uninstall.
- Leave it running Terminating the process is not recommended because ntvdm.exe is essential for the normal functioning of the PC and of any 16-bit program.
- Wait for the 16-bit program to finish The process stays in memory after the program closes. It does not need to be ended by hand.
- If it slows the PC, check it first Slowdowns can be caused by the genuine file or by a virus using a legitimate Windows name. Verify the folder and run a Microsoft Defender scan before doing anything else.
- If the file is fake, remove it Run Microsoft Defender full and offline scans (Windows Security > Virus & threat protection > Scan options). Use anti-malware for the removal when you suspect a virus.
Warning signs
| What you see | What it means |
|---|---|
| ntvdm.exe outside C:\Windows\System32 | Not the Windows component. Check it and scan it. |
| ntvdm.exe on a 64-bit Windows | 64-bit Windows has no NTVDM, so the file is not genuine. |
| High CPU use when no 16-bit program is running | High CPU may not come from the genuine file; some viruses use randomly named processes for suspicious activity. |
| Strange behaviour of the file | A sign of a fake or corrupted version; a thorough system scan is required. |
Everyday problems
NTVDM.EXE has encountered a problem and needs to close
Users reported several issues about this process, and the most frequent one was the message "NTVDM.EXE has encountered a problem and needs to close. We are sorry for the inconvenience."
The most common cure was uninstalling the updates KB2707511 and KB2709162. On Windows XP, users removed those updates in Add/Remove Programs, after enabling the Show updates option to see them. Windows XP is history: ended support on 8 April 2014.
ntvdm.exe uses a lot of CPU
Users who had high CPU levels fixed the issue by uninstalling the troublesome Windows updates. Typically that is all it takes, and the computer works normally again.
High CPU does not have to be caused by the legitimate file. Some viruses use randomly named processes for suspicious activity on victims' computers, so pay attention to the file's location and scan the PC with Microsoft Defender if you suspect malware.
Questions people ask
What is ntvdm.exe?
ntvdm.exe is the Windows NT DOS Virtual Machine, a legitimate Microsoft process that handles a single DOS environment. It starts when you start a 16-bit program and stays in memory after you quit it, in case you start another one. It belongs to IA-32 (32-bit) Windows.
Is ntvdm.exe a virus?
No, the genuine file is a Windows system component located in C:\Windows\System32. Some viruses use names of legitimate Windows programs, though. If the file is in another folder, sits on a 64-bit Windows, or behaves strangely, scan it with Microsoft Defender, because it can be a fake or corrupted version.
Can I end or delete ntvdm.exe?
Terminating it is not recommended because ntvdm.exe is essential for the normal functioning of the PC and its 16-bit programs. It leaves memory when Windows restarts. Delete only a copy that sits outside System32 or that a scan identifies as malicious.
Why does ntvdm.exe use so much CPU?
The genuine file, once executed, might take a lot of CPU power. Users with high CPU found that uninstalling troublesome Windows updates fixed it. If that does not help, check the folder and scan, since some viruses use randomly named processes to do suspicious things on victims' computers.
How do I fix "NTVDM.EXE has encountered a problem and needs to close"?
The most common cure was uninstalling the updates KB2707511 and KB2709162. On Windows XP this was done through Add/Remove Programs with the Show updates option enabled. If the error continues, scan the PC, because a fake file can cause similar crashes.
Why is there no ntvdm.exe on my Windows?
NTVDM belongs to the 32-bit (IA-32) editions of Windows NT. 64-bit editions do not include it, so the file does not exist there and 16-bit programs cannot run directly. If you find an ntvdm.exe on a 64-bit Windows, it is not the Microsoft component and should be scanned.
Sources
- NTVDM on Wikipedia
- Microsoft Learn: Windows 10 and Windows 11 support lifecycle (Windows XP end of support)
Version data read on Oct 5, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…