Windows 10: Processes stuck in “Suspended” state

memoryprocesswindowswindows 10

I'm running into an issue on Windows 10 where processes remain stuck in the "Suspended" state (visible through the task manager by displaying the "Status" column). Those processes cannot be killed, even with SYSTEM user rights, as Taskkill returns an "Access Denied" error.

When a process is suspended, the locks it has on the Dlls it references are not freed. This becomes problematic if another application attempts to update those Dlls.

Another problematic scenario: if an application is in charge of ensuring that another application is always running, doing API calls to detect running processes returns an exception (for suspended processes).

Here's a 100% repro: create a small .net console application that throws an exception and run it through the command line. The process will become suspended and cannot be terminated.

class Program
{
    static void Main(string[] args)
    {
        if (string.IsNullOrEmpty(args[0]))
        {
        }
    }
}

Anyone else encountered a similar issue ? I know that suspending processes is normal under Windows 8 / 10, the issue here is that they do not resume and cannot be terminated.

Best Answer

The issue was the SN-DBS service. Stopping it killed all pending suspended processes.

Related Solutions

Windows – How to determine if a process on Windows “has no parent”

I am not sure how to do it from command line, but I wrote this to do some filtering of OS related processes from PowerShell. Maybe it will give you an idea. It skips items owned by service, system and null.

gwmi win32_process |select ProcessID,ParentProcessID,Name, @{l="Username";e={$_.getowner().user}}|where {$_.Username -ne "SYSTEM"} | where {$_.Username -ne "LOCAL SERVICE"} | where {$_.Username -ne "NETWORK SERVICE"} | where {$_.Username -ne $null} |Sort-Object ProcessID | ft -AutoSize
#

Output

    ProcessID ParentProcessID Name            Username
    --------- --------------- ----            --------
     2136     3460            notepad.exe     KNUCKLE-DRAGGER
     2504     3460            firefox.exe     KNUCKLE-DRAGGER
     2792      700            dllhost.exe     KNUCKLE-DRAGGER
     2816     4232            conhost.exe     KNUCKLE-DRAGGER
     2916     3460            powershell.exe  KNUCKLE-DRAGGER
     3128     3460            notepad.exe     KNUCKLE-DRAGGER
     3180      576            taskhost.exe    KNUCKLE-DRAGGER
     3196     4308            vmware-tray.exe KNUCKLE-DRAGGER
     3460     4392            explorer.exe    KNUCKLE-DRAGGER
     3644     4636            vmware-vmx.exe  KNUCKLE-DRAGGER
     3696     3460            mplayerc.exe    KNUCKLE-DRAGGER
     4636     3196            vmware.exe      KNUCKLE-DRAGGER
     4828     3460            notepad.exe     KNUCKLE-DRAGGER

Windows – How to determine what is running in DLLHOST.EXE that’s missing /ProcessID switch

I see on my computer dllhost.exe running from C:\Windows\System32, while yours is running from C:\Windows\SysWOW64, which looks somewhat suspicious. But the problem can still be caused by some 32-bit product installed on your computer.
Check also the Event Viewer and post here any suspicious messages.

My guess is that you are infected or that Windows has become very unstable.

The first step is to see whether the problem arrives when booting into Safe mode. If it doesn't arrive there, then the problem is (maybe) with some installed product.

If the problem does arrive in Safe mode, then the problem is with Windows. Try running sfc /scannow to verify system integrity.

If no problems are found, scan using :

If nothing helps, try a boot-time antivirus such as :

To avoid burning real CDs, use Windows 7 USB DVD Download Tool to install the ISOs one-by-one on a USB key to boot from.

If all fails and you do suspect an infection, the safest solution is to format the disk and reinstall Windows, but try all other possibilities first.

Related Question