What is ntvdm.exe?

Ntvdm.exe is NTVDM (Windows NT Virtual DOS Machine).

The ntvdm.exe file is part of Microsoft® Windows® Operating System and is developed by Microsoft Corporation. It’s a system and hidden file. Ntvdm.exe is usually located in the %WINDOWS% sub-folder and its usual size is 395,024 bytes.

The ntvdm.exe process belongs to Windows 16-bit Virtual Machine. It provides the environment for running legacy DOS and 16-bit Windows programs on a 32-bit platform. Ntvdm.exe is an important Windows process and should not be terminated unless absolutely necessary.

The NTVDM is present in all 32-bit NT-based versions of Windows OS for 16-bit applications to be able to run. All 16-bit applications run in their own separate threads that are incorporated into a single pre-emptively multithreaded 32-bit NTVDM process. By default, the 16-bit processes are cooperatively multitasked unless the "Run in separate memory space" option is enabled in the Run box or the application's shortcut file.

The ntvdm.exe process emulates BIOS calls and tables as well as the Windows 3.1 kernel and 16-bit API stubs. 32-bit DOS emulation is present in DOS Protected Mode Interface (DPMI) and 32-bit memory access. The function of this layer is to convert the necessary extended and expanded memory calls for DOS functions into Windows NT memory calls.

In January 2010, a serious Windows NT's VDM security flaw was revealed. It was discovered that unprivileged users could escalate their privileges to SYSTEM level. The security flaw was present in all versions of the Windows NT kernel since 1993. This included all 32-bit versions of Windows NT, 2000, XP, Server 2003, Vista, Server 2008, and Windows 7. Microsoft fixed this security issue and released a patch. This security flaw did not affect 64-bit versions of Windows, since they don’t include the NTVDM subsystem.

Important: sometimes viruses and malware pretend to be the ntvdm.exe process. Scan your PC with Auslogics Antivirus to make sure it's not infected.

How to Fix Ntvdm.exe 100% CPU Usage

100% ntvdm.exe CPU usage is a very common problem that occurs when users run 16-bit applications. Quite often the ntvdm.exe process takes too long to respond, which makes it consume a lot of system resources including CPU. Typically, 100% CPU usage by ntvdm.exe is a sign that the process has frozen.

Luckily, there is an easy way to stop ntvdm.exe using 100% CPU when launching a DOS program via a shortcut:

Right-click on the shortcut and select Properties

1. Go to Misc and locate Always Suspended
2. Set the idle sensitivity to High
3. Save the new setting and exit.

This prevents ntvdm.exe from using too much system resources when it’s in an idle state.

If you don’t use any 16-bit DOS applications, you can stop the ntvdm.exe file launching on system startup. Here is how:

Click on Start, type msconfig in the Search bar and press Ctrl+Shift+Enter. XP users will need to click on Start – Run and type msconfig there.

1. Go to the Startup tab
2. Locate ntvdm.exe and uncheck the checkbox next to it.
3. Click Apply and then click OK
4. Reboot your PC