Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What happens when a process in Windows is suspended by Process Explorer or similar software (e.g., Process Hacker)? I've read somewhere on the web that the Sysinternals authors recommend suspending the process first before terminating it.

Is there any difference if I terminate the process directly instead?

share|improve this question
up vote 9 down vote accepted

No, it's not necessary. However, if you have malware on your system that uses multiple processes that act as watchdogs for each other, then you would suspend them all first before terminating any of them.

share|improve this answer
+1 In case of Malware Cleaning, suspending the protection helps shut down the protected process. – Tom Wijsman Aug 20 '11 at 20:20

In Process Explorer, the process is suspended using the NtSuspendProcess syscall. See this page for several other possible methods.

There is no difference whether a process is suspended or running at time of termination – in both cases, TerminateProcess Win32 API is used, giving no chance for cleanup.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .