I’m not sure what caused the issue, but what I did know was that I had to stop the installer from creating new Flash installer instances on my computer. With Windows Task Manager out of the picture, I had to find a way to terminate the process.

One of the best Windows Task Manager alternatives is Process Explorer from Sysinternals (which have been part of Microsoft for the past years). You can download the latest version of Process Explorer from here.

I started the process manager with standard rights first only to find out that I could not use it this way to terminate the process. After exiting and restarting it with elevated rights (by right-clicking and selecting run as administrator) I was able to terminate the process on the system.

Other programs, like Process Lasso, Kill Process or the recently reviewed Daphne may have also been able to terminate the rogue process.

I have learned two things this morning: First, that Windows Task Manager is not almighty when it comes to terminating processes on Windows, and second that it is definitely better to download and install Adobe Flash Player offline installers.

Did you ever encounter a process that you could not kill? What did you do to resolve it?

A click on More Details in the Task Manager expands the display to make it look more like the Task Manager known from previous Windows versions.

When you look closer though you will notice that there are fundamental differences that may make the Task Manager unusable for system administrators and tech savvy users. Lets take a look at the Task Manager in Windows 8:

And now as a comparison the Task Manager in Windows 7:

Probably the first thing that you will notice is that the Windows 8 Task Manager is dividing processes into groups like Applications, Background Processes or Windows Processes. This may provide a better overview of tasks, but some users may criticize that it is now more difficulty to look at all tasks as they are not sorted alphabetically anymore. You can change the display with a right-click on the status bar and a click on “Group by Type” there.

If you look closer, you will notice that Windows 8 displays service and application names instead of the process executable. Microsoft has removed the option to add or remove columns from the View menu. You now need to right-click on a column in the Task Manager to see the selection of available information that you can display in the window. Among the options is the process name which adds the file executable to the interface again.

Good thing is that Windows will remember the modifications that you have made to the Task Manager. It will launch the task manager in detailed view directly and with the layout changes that you have made in a previous session.

I personally dislike the way the new Task Manager is delivered to the user. The default state is absolutely useless and the detailed view only becomes a working solution once you make the modifications mentioned above. Once you have modified it it resembles the old task manager. Some users on the other hand may feel the need to switch to a task manager replacement like Process Explorer instead.

The selection of a thread in the upper half of the window displays its stack data information in the lower half. Displayed in particular are strings found in the stack, stack module addresses, call stack and processor registers.

It is possible to pause and resume the updating at anytime, helpful if you need to analyze a particular state. The stack view can be changed from displaying strings to displaying binary values, module addresses or all other stack values. These view modes plus displaying processor registers and call stacks can be enabled under the Options menu in the menubar.

It is possible to switch to another process with a click on the Choose Process bar in the button toolbar. Process Threads View is more of a tool for software developers than end users. It still can be used by everyone to get a deeper understanding of a process running on the system, but interpretation of the information requires technical knowledge.

The software itself comes with the usual Nirsoft features that include saving selected items to formats such as XML or txt. It is furthermore possible to create an HTML report of selected or all items on display.

Process Threads View is not as sophisticated or rich in functionality as Process Explorer. It is on the other hand easier to access and use.

The software is compatible with all versions of the Windows operating system from Windows 2000 on. A 32-bit and 64-bit edition of the program is offered for download at the Nirsoft website.

Process Explorer shows you information about “which handles and DLLs processes have opened or loaded”. If you ever wanted to know what’s launching all those svchost processes, or why a process has been launched then Process Explorer is the tool to reveal those information.

But what’s new in Process Explorer 14? Take a look at this brief paragraph:

This major update to Process Explorer adds a slew of enhancements and new functionality including network and disk monitoring, an improved multi-tab system information dialog, additional memory statistics, a new column that shows aggregate CPU usage for a tree of processes, improved DLL scanning performance and accuracy, command-lines in process tree tooltips, support for more than 64 CPU systems, and more.

A few interesting additions. The tree cpu usage column for instance can be helpful to determine the cpu usage of a program spawning multiple processes, like Google Chrome for instance (last column in the screenshot).

Process Explorer 14 is available for download at the official Windows Sysinternals website. It is also possible to run Process Explorer directly from http://live.sysinternals.com/procexp.exe.

The interface of System Explorer is tab driven. It displays various information like Tasks, Processes, Modules or Opened Files in the various tabs on the top of the software program. Each tab will list the designated information, the process tab will for instance list the process names, their dependencies, cpu usage, process id and memory usage.

One of the interesting options that System Explorer provides is the ability to display or request additional information about an entry. A right-click on an entry will open a context menu with options to display file information, query Internet databases like Process Library or checking the file with online virus scanners like Virus Total.

That’s interesting for users who want to check up on processes or modules running on their computer system.

Unlike Microsoft’s Task Manager System Explorer does provide additional information. It will for example list all open connections of a computer system including the applications responsible for the connection. It will furthermore display the opened files or a process history in its interface which provide additional valuable information to the user.

Another interesting option is the snapshot ability. Users can create system snapshots and compare them to previous snapshots that they have created. This can be interesting to compare before and after system states while installing or updating software programs.

System Explorer provides access to additional system related features next to the extensive system monitoring options. It will list autostart entries, software programs that are installed on the computer system and link to system utilities like computer management or group policy management.

The software program can be used to replace the Windows Task Manager. To do that select the “Replace Task Manager” option in the Options menu on top. System Explorer will open whenever the user starts the Task Manager from then on.

Resource usage of System Explorer is low, it uses less than 5 Megabytes of computer memory while running which is acceptable considering all the advanced features that it brings to the table.

The program comes with a process modules viewer which will display the various modules a process is accessing on a computer system. The modules are rated with the same rating system and can give additional information about the process in question. Additional options include the ability to explore the system directory of a process and to perform a action on selected processes.

Actions can be to ignore (the default value), close or delete a process on the computer system. Closing will simply kill the process on the system while deleting will try and delete the file on the hard drive so that the file cannot be executed anymore.

Microsoft processes can be removed from the display to get a better overview of the non-system processes that are running on the system. The main problem of Assassin SE is the lack of ratings for several known applications. It was not able to identify True Crypt, Foxit Reader or Newsbin Pro which are common applications. It did however identify Firefox, uTorrent and Skype.

The software program can be helpful when checking the processes that are running on a computer system. It still requires some manual research after being left with unknown and potentially dangerous processes but it helps at reducing the amount of processes that have to be checked.

The basic actions that can be defined in the Windows application monitor are to close the application if the memory or cpu usage exceeds parameters, to start additional programs if the application starts or ends or to turn off the computer when it ends. The advanced rules are only available in the commercial version of the application monitor.

Kiwi will collect statistics about application usage and resource consumption. The Windows application monitor will for example dsiplay the average running time per day or session, the average memory usage and the maximum peak memory usage.

The last option that might be interesting for some users is to define minimum and maximum allowed working set in Megabytes. Kiwi uses just a few Megabytes of computer memory and about 30 Megabytes of virtual memory while minimized which should be acceptable for users who would like to monitor their applications and make use of the additional options of the program.

The main window of the Access Tools presents the running processes on the system. Information like memory usage, company and ID are presented in the interface which is automatically updated in real time. The lower pane contains an event viewer that displays events such as starting or closing processes. A click on a process displays additional information about that process such as its parent process or system path.

This is one of the areas that Process Explorer handles in a better way. The Sysinternal’s application displays all processes in a tree view with child processes beneath their parent’s processes which guarantees a better overview.

Grouped Access Tools would be nothing more than a better Windows Task Manager if that would be the complete functionality. Thankfully though it is not. A right-click on a process opens a quick access menu to functions like terminating, suspending, resuming or wiping the memory of the selected process.

It is a bit strange that not all of the functions are available in the right-click menu, especially those that open windows with extensive information about the selected process. More than half of the available functions are only accessible from the top menu.

The Process Information window for instance contains five tabs with extensive information about modules, threads, handles, file information and process information.

Grouped Access Tools comes with a memory dump and memory editing function which could be quite interesting for debugging purposes. Below is a list of features taken from the developer’s homepage which the Access Tools have that Process Explorer does not.

• Auto Filing/ Move on Boot
• Auto Processing
• Hidden Process Scanning
• Module (DLL) Termination
• Multiple methods of ending a process
• Multiselection and handling
• Process Logging
• Running programs in System Mode

Process Explorer on the other hand provides access to several tools that Grouped Access Tools provide only partially or not at all.

Grouped Access Tools runs on all Windows NT systems including Windows XP and Windows Vista. Provided are a portable version and a version that has to be installed.

It does not seem to provide any additional information that a user could not get out of Process Explorer but it provides the advantage that it is not overladen with additional features and other services. The software program scans all svchost processes that are currently running on the system and displays them in a tree view that can be expanded to show additional information and the services that are run under each svchost entry.

This has caused lots of confusion by users in the past who wondered why several svchost.exe processes were running in the Windows Task Manager.

The services under each svchost process are listed in the left pane, a click opens detailed information about each service in the right larger pane of the application.

It details the amount of computer memory a svchost process is using currently as well as a description and program path to the services it has spawned.

The svchost viewer application is portable and should run under Windows XP and Windows Vista. The Microsoft .net Framework 2.0 or higher is required to run it. The application itself takes up only 40 Kilobyte on the hard drive.

This is a great way to identify any process, program and module that is connecting to the Internet. These programs and processes can then be analyzed to determine if the Internet connection is needed and trustworthy or not. This should just take a few seconds for most processes listed there, we all know that Firefox and Opera need a Internet connection for example.

It becomes difficulty if general processes have a Internet connection, svchost.exe for example. It’s not clear if this is needed or not and it requires some research to find out. A quick research with Process Explorer revealed that this svchost.exe process was related to the RPC – Remote Procedure Call – service that is needed for Internet Connections.

The best way to find out would be either perform a search for the process and find out if it needs an Internet connection . You could also just kill the process and see what happens but this could let to blue screens or other errors and is normally not advised.

Procx does not have to be installed and can be run from any location on your computer.

Update: The Procx website is no longer available and it seems that the program has been discontinued. I suggest you use Process Explorer instead which is linked above. You can alternatively download the latest version of Procx (11) from our servers. We have uploaded the process manager there for your convenience.