[Autogenerated] Here, is the object explorer tool.
One of my tools, and these tool allows us to see zombie processes,
and zombie threats.
If I go ahead to the system menu here there.
Is an item for zombie processes.
We can see all the zombie processes.
In the system.
This might not seem too bad.
And In fact, this is a pretty good case for zombie processes.
That's because I'm using a virtual machine here.
That doesn't run too many weird processes,
but there's still a process here that's running these
executable its being held by some other process.
In the this case, Visual Studio process.
Being kept alive even though it doesn't exist anymore.
In the sense, that It can't run any more code But the object,
is still alive because there's just no way.
To destroy it at least while there's at least one handle.
To This process.
In fact, there's just one handle, to This process here.
You can also see some details about that handle here.
Now in order to see, that um, in the kernel debugger For example,
let's see what that looks like.
Let me launch a kernel debugger here, and what I want to show you.
Is what zombie processes look like.
In the kernel debugger How can you identify zombie processes?
In the kernel debugger So let me go ahead.
And Look at the ID here.
So we have the idea Let's grab one of these like 5420.
Let's look for that kind of process.
I'm going to do process, and then 5420 using the process,
ID with decimal notation here.
To find that process.
It has to exist because the object, is still there,
and So you can see several properties here,
that mean that this is In fact, a zombie process,
first you can see there, is no object table there,
are no handles, in the This process at all.
You can also see the there, are no active threats.
The process has no threats which means it cannot run
any more code but it is still alive.
All the V, ad route here, is zero,
the vs are a data set of data structures used to hold
information about the address space of the process.
So essentially the address space no longer exists, but the process itself.
Is still very much alive.
You can also grab the address here.
And give that to the object command.
See what that has to say and There's one handle count.
What about the total reference count?
Let's see what the two reference here.
In fact, probably or maybe be 21 of them held by the kernel Let's see,
and here, we can see the real pointer count the real reference count,
is two which means we have that handle holding onto this object.
There's another one.
That is held by the kernel because the process.
Is still part of the process list obviously not ideal having these
zombie processes around and in the same way.
We can look at zombie threats.
Again, the tool provides that as well.
We can go, to system, and zombie threats,
and see something similar in this case there.
Are many more thread, that are kept alive for no good reason.
And again, you can watch them or look for them.
In the current debugger if you so desire just as a Curiosity notice what
happens if I launch object explorer here on my primary system.
And I look at the set of zombie processes.
You'll notice I have many of those.
In fact, there,
are 11,000 something zombie processes here because they're held
by some leaking processes such as these HP,
prints scan.
Doctor service thingy.
So if I go ahead and open task manager, and kill, that process.
That's a process.
That has that particular name.
Let me find it HP, prints something.
So if I go ahead notice it has lots of handles.
By the way, if I go ahead and kill that By ending the process.
And I refresh the view you, can see that the number of,
of processes here in terms of zombies should be much
more So now we have only 10,000.
Still quite a bit, but at least not as bad as it used.
To be but there.
Is another process here which is kind of bad.
Let me see what's happening here.
I think the it's not refreshing properly.
Let me just launch another Windows That's probably some bug.
I have to take care of.
Um In any case we have another one.
That is Um working in a malicious way, in the that regard,
is game, manage, your service from Razor Let me go ahead.
And kill, that as well.
Here it goes also has many many handles 10, 10, 11,000.
Let me refresh again.
And You'll notice the number has been downsized considerably.
To only 330 zombie processes definitely better than it
used to be but still not ideal you.
Can see exp, core here, is Also holding on to many handles,
to win logon, to logo, wi here, this is just bad.
Behavior That's kind of the bottom line here.