Windows XP Task Manager Process Shutdown Method

Windows XP/2000 Task Manager is a very useful tool that allows you to see which programs (processes) are running on the system, as long as you usually look at the Task Manager In the list of processes, familiar with the basic process of the system, you can find suspicious processes at any time, which is beneficial to prevent Trojans and viruses! But there are some suspicious processes, you can't kill them with the task manager. What should I do?

First, which system processes can not be turned off
When Windows is running, multiple processes will be started. As long as you press the "Ctrl+Alt+Del" button to open the task manager, click on the "View"/Select column, check the "PIO (Process Identifier)", and then click on the "Processes" tab to see these processes. . However, there are some processes that are not used by individual users, such as Systray.exe (display system tray small speaker icon), Ctfmon.exe (Microsoft Office input method), Winampa.exe, etc., we can completely ban them, this will not Affect the normal operation of the system.

Second, how to close the process that the task manager can't kill
If you can't close a suspicious process in the task manager, you can use the following method to force the shutdown, be careful not to kill the process table System core process:

1. Using Windows XP/2000's own tools

Starting with Windows 2000, Windows system comes with a user-mode debugging tool Ntsd, which can kill most of the process, because the process attached by the debugger will follow The debugger exits together, so as long as you use Ntsd to invoke a process on the command line, then exit Ntsd to terminate the process, and Ntsd will automatically get Debug permissions, so Ntsd can kill most of the process.

Operation: Click "Start" /Programs /Accessories /Command Prompt, enter the command: ntsd -c q -p PID (change the last PID to the PID of the process you want to terminate). In the process list, you can find the PID of a process. For example, if we want to close the Explorer.exe process in Figure 1, type: ntsd -c q -p 408.

The above parameter -p means that the process PID is followed, -c q means to execute the debug command to exit Ntsd, and pass the above parameters from the command line.

2. Use specialized software to kill processes that can't be killed by the Task Manager. You can use dedicated software to shut down. There are a lot of software that can kill processes, such as process killer, IceSword (downloadable to down.45it.com), Kingsoft Internet Security Process Manager, Kill process, etc.