Windows sysinternals

52 Part II Usage Guide
FIGURE 3-6 Dialog box for setting processor affinity on a two-processor system.
■ Set Priority View or set the base scheduling priority for the process.
■ Kill Process You can forcibly terminate a process by choosing Kill Process or by
clicking the Kill Process button in the toolbar. By default, Procexp prompts you for
confirmation before terminating the process. You can disable that prompt by clearing
Confirm Kill in the Options menu.
Warning Forcibly terminating a process does not give the process an opportunity to shut
down cleanly and can cause data loss or system instability. In addition, Procexp does not
provide extra warnings if you try to terminate a system-critical process such as Csrss.exe.
Terminating a system-critical process results in an immediate Windows blue screen crash.
■ Kill Process Tree When Procexp is in the process-tree sorting mode, this menu item
is available and allows you to forcibly terminate a process and all its descendants. If the
Confirm Kill option is enabled, you will be prompted for confirmation first.
■ Restart When you select this item, Procexp terminates the highlighted process (after
optional confirmation) and starts the same image using the same command-line arguments.
Note that the new instance might fail to work correctly if the original process
depended on other operating characteristics, such as the security context, environment
variables, or inherited object handles.
■ Suspend If you want a process to become temporarily inactive so that a system
resource—such as a network, CPU, or disk—becomes available for other processes, you
can suspend the process’ threads. To resume a suspended process, choose the Resume
item from the process context menu.
Tip Suspend can be useful when dealing with “buddy system” malware, in which two or
more processes watch for each other’s termination, with the nonterminated one restarting
its buddy if it dies. To defeat such malware, suspend the processes first and then terminate
them.
www.it-ebooks.info