1

Topic: The zombie processes

Who can noted when the program in windows since 8.1 Windows creates one more process with the same name but not having any flows hangs up. Whether there is somewhere a documentation of this business?

2

Re: The zombie processes

Hello, _NN _, you wrote: _NN> who Can noted when the program in windows since 8.1 Windows creates one more process with the same name but not having any flows hangs up. Whether _NN> there is somewhere a documentation of this business? I suspect that it Window Ghosting is called, and no processes are documented, there is only a documentation for function DisableProcessWindowsGhosting. (And process, probably, any also is not present, it Task Manager so shows it only, because what process without flows)

3

Re: The zombie processes

Hello, Alexander G, you wrote: AG> I Suspect that it Window Ghosting is called, and no processes are documented, there is only a documentation for function DisableProcessWindowsGhosting. There is a suspicion that is other mechanism. AG> (and process, probably, any also is not present, it Task Manager so shows it only because what process without flows) Process is. At it is PID and it is possible to look through Process Explorer.

4

Re: The zombie processes

Hello, _NN _, you wrote: _NN> who Can noted when the program in windows since 8.1 Windows creates one more process with the same name but not having any flows hangs up. Whether _NN> there is somewhere a documentation of this business? In book Windows Internals 7 this mechanism is described in section Process Reflection (see ntdll! RtlCreateProcessReflection). If it is short, in the presence of problems with some process in it the thread which causes ntdll is implemented! RtlCloneUserProcess which clones address space of problem process. Then new process can be used for creation .

5

Re: The zombie processes

Hello, EreTIk, you wrote: ETI> In book Windows Internals 7 this mechanism is described in section Process Reflection (see ntdll! RtlCreateProcessReflection). If it is short, in the presence of problems with some process in it the thread which causes ntdll is implemented! RtlCloneUserProcess which clones address space of problem process. Then new process can be used for creation . Thanks for , were esteemed by section. Knowingly the book ordered as soon as quitted Is still Process Snapshotting by the way: https://msdn.microsoft.com/en-us/library/dn469412 (v=vs.85).aspx

6

Re: The zombie processes

Hello, _NN _, you wrote: _NN>... _NN> Knowingly the book ordered as soon as quitted Offtop And is somewhere "Windows Internals 7th Edition" in electronic form? Microsoft Press suggests to buy eBook for $20, but I for some attempts and could not transit "quest" on their site, all time throws out on page with an error...

7

Re: The zombie processes

Hello, okman, you wrote: O> Hello, _NN _, you wrote: _NN>>... _NN>> Knowingly the book ordered as soon as quitted O> Offtop O> And is somewhere "Windows Internals 7th Edition" in electronic form? O> I suggest to buy Microsoft Press eBook for $20, but for some attempts and This which here? https://www.microsoftpressstore.com/sto … 0735684188 Can it is necessary to them to write to support (at the very bottom mail) O> could not transit "quest" on their site, all time throws out on page with an error... There is also variant Kindle for 31$: https://www.amazon.com/Windows-Internal … =mt_kindle

8

Re: The zombie processes

Hello, _NN _, you wrote: we Addressed in MS to find out more. As there was this not documentary behavior Windows Error Reporting as well as it was supposed initially.