Windows shutdown is what is killing the process

Learn together, the principle of Windows shutdown:

1.After the user initiates the shutdown instruction, the program that initiates the shutdown instruction will notify the Windows subsystem, and after receiving the notification, it will exchange data with it, and then the notification will start the process of shutting down the system.

2.After receiving the notification, the user processes with the top-level window are queried in turn and those user processes are exited. If a user process does not exit within a default timeout of 5000 milliseconds (which can be set by modifying the registry key Hkey Current User Cont Rol Panel Desktop HungappTimeout), Windows displays an End Task dialog that asks the user if to end the task.

By default, this dialog box is displayed and remains on hold without automatically closing. For console programs, the basic situation is similar, except that Windows uses the HK ey Current User Control Panel Desktop WaitToKillAppTimeout value to set the timeout period.

3.Then it's time to terminate the system process. System processes include, among others.

When Windows terminates a system process, it does not prompt the user if it cannot be terminated within the specified time, as is the case with the user process, but skips the process and performs the termination of the next system process. The timeout used is the same as the time used in step 2.

The above 3 steps are the most time-consuming part of the entire Windows shutdown process, and most of the reasons for slow shutdown are caused by these 3 steps. After completing the first three steps, the fourth and final stage of the shutdown operation begins.

4.Call a native API function, ntshutdownsystem(), to command the system to perform the rest of the sweep. In this phase, the Windows execution subsystem completes the final shutdown operation, for example:

The equipment driver completes some special operations of the driver setting in this stage; It is also at this stage that the configuration management system will be modified and the registry data will be written to disk. After all subsystems except power management are exited, the power management completes the final operations, such as restarting, shutting down, etc.

1: It's easy to kill the process, just find a tool. For example, icesword.

The key is to find how this process starts, otherwise it will come out again the next time you restart it. By the way, I will teach you a ruthless trick. Its built-in Windows tools can kill most processes:

c:>ntsd -c q -p pid

Only system、And can't kill。 The first two are pure kernel state, and the last one is the win32 subsystem, which is required by NTSD itself. NTSD has been a user-mode debugging tool since 2000.

Processes attached to the debugger exit with the debugger, so they can be used to terminate the process from the command line. Using ntsd automatically gives you the debug permission, which kills most processes. ntsd will open a new debugging window, which is not controllable from the pure command line, but if it is just a simple command, such as exit (q), you can pass it from the command line with the -c argument.

NTSDNTSD is also conventionally available to software developers. Only system developers use this command. For more information, see the help file attached to the NTSD.

Usage: Open a window, type:

ntsd -c q -p pid

Change the last PID to the ID of the process you want to terminate. If you don't know the ID of the process, Task Manager > Process Tab > check > Select Column > tick"PID (Process Identifier)."and then you can see it.

A2: There are two good tasklists under XP and can list all the processes and the corresponding information. tskill can detect and kill processes, and the syntax is very simple: tskill program name!!

It needs to be completed under the system.

Here's how:

1. Right-click on the taskbar and click "Task Manager".

2. Check the program in the process and find the program you want to close.

3. Right-click the program you want to close and select "End Task" to close the process.