Windows – non-existent process in windows

processwindowswindows 7windows-explorer

I was trying to kill one of my processes named code.exe on my windows 7 box. So, I opened process explorer to see the process details. I went into "Image" tab on its properties window. I saw that its parent is something <Non-existent Process>(7960)as shown below:

I went back to check the parent process but there was no process with process ID (PID) 7960. I went to task manager and checked the "Show processes from all uses" but still I got no process with PID 7960. I ran the following command tasklist /FI "PID eq 7960" /FO TABLE on command prompt but it returns below error message:

INFO: No tasks are running which match the specified criteria.

So, I want to know who is this <Non-existent Process>(7960)? My speculation is that it is explorer.exe but not sure. Why this process is entirely hidden from my view?

Best Answer

It really is a "non-existent process" as stated in this answer in SysInternals forums:

If a process shows "<Non-existent Process>" as its parent process in Process Explorer, it means that the parent process has exited.

If you check the next Process Creation Tree for Code.exe, you can see that:

The original Code.exe process creates a lot of new processes, and this ones open an closes cmd.exe processes, getmac.exe, and more Code.exe.

After all the chain of events, you have several Code.exe running, some of them orphans from a cmd.exe opened by another Code.exe.

There is your "Non-existent process" for Code.exe

Related Solutions

Windows: Fastest way of killing a process running on a specific port

Is there any thing like a pipe or similar that I can use on Windows OS to run this command in one line?

Both cmd.exe and PowerShell support pipes from one command to another. In PowerShell something like (this should be on a single line on the command line, or use ` to escapte newlines in a script):

netstat -ano
 | select -skip 4 
 | % {$a = $_ -split ' {3,}'; New-Object 'PSObject' -Property @{Original=$_;Fields=$a}} 
 | ? {$_.Fields[1] -match '15120$'}
 | % {taskkill /F /PID $_.Fields[4] }

Where:

Select -skip 4 skips the first four header lines. (Select is short for Select-Object used to perform SQL SELECT like projects of objects.
% is short for Foreach-Object which performs a script block on each object ($_) in the pipeline and outputs the results of the script block to the pipeline. Here it is first breaking up the input into an array of fields and then creating a fresh object with two properties Original the string from netstat and Fields the array just created.
? is short for Where-Object which filters based on the result of a script block. Here matching a regex at the end of the second field (all PowerShell containers a zero based).

(All tested except the last element: I don't want to start killing processes :-)).

In practice I would simplify this, eg. returning just 0 or the PID from the first foreach (which would be designed to ignore the headers) and filter on value not zero before calling taskkill. This would be quicker to type but harder to follow without knowing PowerShell.

Linux – How an unprivileged user could kill a process she didn’t start

Oracle runs its SID sub-processes as Real UID of database owner (hri here), while the Effective UID is Oracle's (oracle). Which is why hri was able to kill what was actually its own processes.

You can use ps axf -O ruid,ruser,euid,euser to display side-by-side both RUID and EUID.

Best Answer

Related Solutions

Windows: Fastest way of killing a process running on a specific port

Linux – How an unprivileged user could kill a process she didn’t start

Related Question