When I kill
wininit.exe, Windows 7 suddenly shuts down. Can someone explain this using Windows mechanics?
I feel like this might because the process provides something important, or this might be a security feature.
Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.Visit Stack Exchange
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
From Windows Internals, Part 1
Windows Initialization Process (Wininit.exe)
This is correct.
wininit.exe is flagged as critical.
and killing critical system processes is not allowed and Windows will bugcheck the system with CRITICAL_OBJECT_TERMINATION
A post on groovypost.com explains the origin of
winit.exe ("Windows Initialize") and that today it primarily acts as a launcher for the majority of the background applications that are always running.
Look at the screenshot in that blog post which explains that killing the
wininit.exe process will also affect anything that was launched by that process:
[...] wininit.exe is a critical system process the Windows requires in order to function. Ending this process will likely result in a critical system error in which you’ll need to restart your computer. As you can see in the chart below, wininit.exe is at the top of the process tree for all of windows services, including svchost.exe.
wininit.exe process is the windows start up application which is found in the
%systemroot%\system32 folder (in most systems, %systemroot% maps to C:\Windows).
During boot, the smss.exe process creates wininit, which in turn create the lsass.exe (Local Security Authority Subsystem), services.exe (the services controller manager), and lsm.exe (Local Session Manager).
csrss.exe process, termination of the wininit.exe process will crash the machine with STOP Code 0xF4 (CRITICAL_OBJECT_TERMINATION) (but interestingly, suspending the process is possible).
Since wininit.exe is in the system32 folder, if wininit.exe is found outside of it's folder (in C:\Windows\ or in your application data folder), then it is most likely malicious.
wininit.exe(a system process) causing a crash is not at all a surprise, so you may want to explain why you have asked the question at all. It is analogous to asking Hey, why does my system turn off when I yank out the power cord?; there is a perfectly good, but too obvious answer, so some people may think it is silly and pointless. My best guess why you are asking is because you think it is supposed to be only part of the boot process because of the name, and so you expect it to not be used after a successful boot up.
wininit.exeis a high-priority, protected,
SYSTEMprocess and not easily ended, so it should not be a surprise that it causes problems if killed.