Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What happens when a process in Windows is suspended by Process Explorer or similar software (e.g., Process Hacker)? I've read somewhere on the web that the Sysinternals authors recommend suspending the process first before terminating it.

Is there any difference if I terminate the process directly instead?

share|improve this question

2 Answers 2

up vote 8 down vote accepted

No, it's not necessary. However, if you have malware on your system that uses multiple processes that act as watchdogs for each other, then you would suspend them all first before terminating any of them.

share|improve this answer
1  
+1 In case of Malware Cleaning, suspending the protection helps shut down the protected process. –  Tom Wijsman Aug 20 '11 at 20:20

In Process Explorer, the process is suspended using the NtSuspendProcess syscall. See this page for several other possible methods.

There is no difference whether a process is suspended or running at time of termination – in both cases, TerminateProcess Win32 API is used, giving no chance for cleanup.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.