6

What happens when a process in Windows is suspended by Process Explorer or similar software (e.g., Process Hacker)? I've read somewhere on the web that the Sysinternals authors recommend suspending the process first before terminating it.

Is there any difference if I terminate the process directly instead?

2 Answers 2

9

No, it's not necessary. However, if you have malware on your system that uses multiple processes that act as watchdogs for each other, then you would suspend them all first before terminating any of them.

1
  • 2
    +1 In case of Malware Cleaning, suspending the protection helps shut down the protected process. Aug 20, 2011 at 20:20
7

In Process Explorer, the process is suspended using the NtSuspendProcess syscall. See this page for several other possible methods.

There is no difference whether a process is suspended or running at time of termination – in both cases, the TerminateProcess Win32 API is used, giving no chance for cleanup.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .