How to kill a process which won't die?

VanguardLH on Tue, 20 Feb 2018 14:01:08 -0600 typed in
alt.windows7.general the following:
pyotr filipivich wrote:

Yippie - mailwasher froze up this morning. ran the batchfile - as
admin - twice.

The first time it reported success. But the splash screen was still
there.

the second time I got an error message:

ERROR: The process with PID 2856 (Child Process of PID 3828) could not
be terminated.
Reason: there is no running instance of the task.

Except that Taskmanager still lists it.

Looks like your batch file doesn't list all the processes on which to
use taskkill. There are 2 processes listed in the 2nd run of your batch
file: 2856 and 3828. Either you have to kill the parent process using
the /t switch in the taskkill or you need to use a taskkill on each
process name, first killing the children and lastly the parent.

I ran the batch file to kill Mailwasher.exe:

C:\Windows\System32\taskkill.exe /IM mailwasher.exe /T /F

The first time, like I said, it claimed success - but the splash
screen stayed up.

Am I missing that I need to include the PID as in

C:\Windows\System32\taskkill.exe /IM mailwasher.exe 2856 /T /F

?

And if I right click in a winder to create a new text file - nothing.
I can open an existing text file in notepad, and can wader through
the tree and start notepad, but not "create a new text document."

"Abort, Retry, Fail?" Yes!

Don't what you're trying to describe. Doesn't sound like anything to do
with Mailwasher's splash screen.

No it doesn't. That was a "my dumb" - I could not find the newly
created text files, because there on the desktop.

like I said, now to wait for me to get in a hurry and try to start
Mailwasher before Windows has had its first cup of coffee.
--
pyotr filipivich
Next month's Panel: Graft - Boon or blessing?

pyotr filipivich wrote:

VanguardLH on Tue, 20 Feb 2018 14:01:08 -0600 typed in
alt.windows7.general the following:
pyotr filipivich wrote:

Yippie - mailwasher froze up this morning. ran the batchfile - as
admin - twice.

The first time it reported success. But the splash screen was still
there.

the second time I got an error message:

ERROR: The process with PID 2856 (Child Process of PID 3828) could not
be terminated.
Reason: there is no running instance of the task.

Except that Taskmanager still lists it.

Looks like your batch file doesn't list all the processes on which to
use taskkill. There are 2 processes listed in the 2nd run of your batch
file: 2856 and 3828. Either you have to kill the parent process using
the /t switch in the taskkill or you need to use a taskkill on each
process name, first killing the children and lastly the parent.

I ran the batch file to kill Mailwasher.exe:

C:\Windows\System32\taskkill.exe /IM mailwasher.exe /T /F

The first time, like I said, it claimed success - but the splash
screen stayed up.

Am I missing that I need to include the PID as in

C:\Windows\System32\taskkill.exe /IM mailwasher.exe 2856 /T /F

If you kill ALL instances of mailwasher.exe (which taskkill.exe should
do based on the image name, not the PID) but the window remains then
mailwasher.exe is not the owner of that windows.

Use SysInternals' Process Explorer. After installing that, you'll
notice what looks like a spider web icon in its toolbar. Click and drag
that toolbar icon onto the window in question. Process Explorer will
then highlight the owner process of that window.

Are you running taskkill.exe (in the batch file) with administrator
privileges? Create a shortcut to the batch file and set its Advanced
config to run with admin privileges. Taskkill needs admin privs.

VanguardLH on Wed, 21 Feb 2018 02:47:54 -0600 typed in
alt.windows7.general the following:
pyotr filipivich wrote:

VanguardLH on Tue, 20 Feb 2018 14:01:08 -0600 typed in
alt.windows7.general the following:
pyotr filipivich wrote:

Yippie - mailwasher froze up this morning. ran the batchfile - as
admin - twice.

The first time it reported success. But the splash screen was still
there.

the second time I got an error message:

ERROR: The process with PID 2856 (Child Process of PID 3828) could not
be terminated.
Reason: there is no running instance of the task.

Except that Taskmanager still lists it.

Looks like your batch file doesn't list all the processes on which to
use taskkill. There are 2 processes listed in the 2nd run of your batch
file: 2856 and 3828. Either you have to kill the parent process using
the /t switch in the taskkill or you need to use a taskkill on each
process name, first killing the children and lastly the parent.

I ran the batch file to kill Mailwasher.exe:

C:\Windows\System32\taskkill.exe /IM mailwasher.exe /T /F

The first time, like I said, it claimed success - but the splash
screen stayed up.

Am I missing that I need to include the PID as in

C:\Windows\System32\taskkill.exe /IM mailwasher.exe 2856 /T /F

If you kill ALL instances of mailwasher.exe (which taskkill.exe should
do based on the image name, not the PID) but the window remains then
mailwasher.exe is not the owner of that windows.

Okay, as an experiment, I just ran the same batch file (Run as
Administrator) - and it killed mailwasher.
Reported:

"SUCCESS: the process with PID 2200 child process of PID 1996) has
been terminated.

FWI PID 1996 is listed as Explorer.exe (I'm using Process Hacker
also from SysInternal). .


Just for grins and giggles, ran the batchfile a second time and
was informed that process mailwasher.exe not found.




Use SysInternals' Process Explorer. After installing that, you'll
notice what looks like a spider web icon in its toolbar. Click and drag
that toolbar icon onto the window in question. Process Explorer will
then highlight the owner process of that window.

Are you running taskkill.exe (in the batch file) with administrator
privileges?

yes.

Create a shortcut to the batch file and set its Advanced
config to run with admin privileges. Taskkill needs admin privs.


I'm going to have to wait for mailwasher to hang again to see what
else shows up this time.
--
pyotr filipivich
Next month's Panel: Graft - Boon or blessing?

SysInternals' Process Explorer will show a tree list of processes. That
makes it easy to see who is the parent of which process(es). For
example, PE lists the following for some child processes:

taskhost.exe
'--- explorer.exe Windows Explorer (also the desktop mgr)
|-- outlook.exe MS Outlook
|--- dialog.exe 40tude Dialog (newsreader)
|--- procexp64.exe Process Explorer
'--- chrome.exe Google Chrome
|--- chrome.exe \
|--- ... |-- 12 child instances
'--- chrome.exe /

Outlook (outlook.exe) was started using a shortcut in my Startup folder.
40tude Dialog (dialog.exe), my newsreader here, was started using a
shortcut in a folder (group) in the Taskbar. Google Chrome (chrome.exe)
was started using a shortcut also in a taskbar group or using the
address bar in the taskbar. Process Explorer (procexp64.exe) was
started by entering "process explorer" in the Start Menu's search box
and selecting the correct entry in the search list. In each case,
Windows Explorer (explorer.exe, which is also the desktop manager) got
used to load those programs. taskhost.exe is a host process used for
loading DLL-based services; i.e., those processes are entry points (aka
functions) defined in a DLL file. This is similar to how svchost.exe is
used to roll up several services under one process.

So how does Mailwasher get loaded? Is it upon startup of Windows (as a
service)? Is it a per-account startup program (in the Startup folder,
Logon event, Task Scheduler event, or other per-account startup
locations which SysInternals' AutoRuns will show you)? Do you start it
manually using a shortcut (on the desktop, in the taskbar, using the
Start Menu's search box, using Start Menu's Run dialog, or a shortcut in
the Start Menu)?

You need to have SysInternals' Process Explorer already installed to be
prepared when the Mailwasher window problem reappears. Then, as
mentioned, you can use PE to select that window and have PE highlight
which process owns that window.

Also make sure you elect to see ALL processes in Task Manager; else, all
you see are user processes for your particular Windows account.

Note: Process Hacker is *NOT* from SysInternals. That is an alternative
to Task Manager that has some features similar to Process Explorer which
is from SysInternals. While Process *Hacker* can probably show
hierarchy of parent and child processes, I don't know that it has the
feature where you have it select a window to have it highlight the
owning process of that window.

Another feature that Process *Hacker* may not have is to show the
current scan by VirusTotal on a process' loader (executable). In
Process *Explorer*, you can enable the VirusTotal option to add a column
which, when online, will submit the file for each process to VirusTotal
to get malware status on that process. VirusTotal.com has an API that
software can use to submit samples for analysis. They use many
anti-virus programs to scan a file. This lets you determine is a
process is suspect; however, just because the result is not "0/68" (zero
positives against 68 AVs) doesn't mean it is bad. Some of the AVs that
VirusTotal uses have a history of high[er] false positives. From the
online images of Process *Hacker*, I don't see it supports scanning
processes with VirusTotal.

Wen Jia Liu (aka wj32) Process Hacker
https://processhacker.sourceforge.io/
or
https://sourceforge.net/projects/processhacker/

SysInternals (Microsoft) Process Explorer
https://docs.microsoft.com/en-us/sys...ocess-explorer
(SysInternals was acquired by Microsoft when Russinovich went there
but is still using the SysInternals brand for its software tools.)

Different tools, different authors, different feature sets. You are
trying to find which process owns the window that does not disappear
when you kill all instances of mailwasher.exe.

Before going through all of this, and something I just thought of, when
you run your batch file to kill Mailwasher but the window remains, have
you right-clicked on the desktop and selected Refresh? If a refresh
(re-paint) of the desktop gets rid of the window then there was no
process running that owned that window. A refresh that gets rid of a
window means there is a problem in painting (updating) the desktop.