What happens when a process in Windows is suspended by Process Explorer or similar software (e.g., Process Hacker)? I've read somewhere on the web that the Sysinternals authors recommend suspending the process first before terminating it.

Is there any difference if I terminate the process directly instead?


No, it's not necessary. However, if you have malware on your system that uses multiple processes that act as watchdogs for each other, then you would suspend them all first before terminating any of them.

  • 2
    +1 In case of Malware Cleaning, suspending the protection helps shut down the protected process. – Tamara Wijsman Aug 20 '11 at 20:20

In Process Explorer, the process is suspended using the NtSuspendProcess syscall. See this page for several other possible methods.

There is no difference whether a process is suspended or running at time of termination – in both cases, the TerminateProcess Win32 API is used, giving no chance for cleanup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.