How to kill a task that is "lacking an instance"?

19

1

Spotify first killed itself but "something of it" kept lingering which was detectable as a task with PID 8664 and judging from the fact that RAM usage kept changing from time to time - it "did something".

Now first of all this process kept me from listening to music because Spotify refused to restart due to this instance hanging around.

So I tried to get rid of this process. But neither task manager nor the taskkill command (as Admin of course) succeeded in doing so.

taskkill at least gave me a "reason" which I will translate here.

>taskkill /pid 8664 /f
>taskkill /im spotify.exe /f

both gave:

ERROR: The process "spotify.exe" with PID 8664 could not be terminated.
Reason: There is currently no instance executed by this task.

I would like to know what that means and whether there is another option of how to terminate such a process.

(Windows 7 Pro 64 bit)

Raffael

Posted 2013-11-14T10:12:36.513

Reputation: 1 029

1

@Ramhound, about "Its not possible to "hide" a process in Windows". It does seem possible, if we look at e.g. this question http://security.stackexchange.com/questions/84385/can-a-trojan-hide-itself-so-its-activity-doesnt-appear-in-task-manager-process or this question http://security.stackexchange.com/questions/24848/how-effective-is-windows-task-manager-at-identifying-keyloggers

– user100487 – 2015-11-20T15:00:28.377

@user100487 - There is absolutely nothing you can do to a process to hide it, that with my knowledge, would result in me not finding it. Every method described in those linked answers, has a workaround, I might have trouble in some cases but I guarantee you I could come up with a solution. If I can do it then anyone can do it. Please avoid pinging me on questions this old, its annoying, since your comment is not constructive after all this time." – Ramhound – 2015-11-20T15:10:37.407

1duh yes certainly "any process can be found". However they can be hidden from view from if you are only using the tools that OP mentioned (Windows Task Manager or Task Kill). That's all. – user100487 – 2015-11-20T15:36:46.577

@Ramhound To finally clear this up: the process is not hidden; it's dead. It's only visible because there are outstanding handles. (I guess this is another case of not attributing to malice what can be explained by mistakes.) See my answer. – Ben N – 2015-12-28T01:15:52.713

It means that Spotify is either not running or you have the wrong process id. Its not possible to "hide" a process in Windows. How did you determine the process id in question was connected to Spotify. – Ramhound – 2013-11-14T12:01:18.270

there was nothing "hidden" and the PID was correct – Raffael – 2013-11-16T17:40:49.727

Answers

12

The process is almost certainly already dead, i.e. it is no longer executing any code. However, the bookkeeping about it doesn't go away until every handle to it and each of its threads is closed. You might have another program holding such a handle open (antivirus programs are a likely culprit), or it might have made a request before its death to a kernel-mode driver that is now hung (I once had a CD drive that caused this a lot). Further reading: "Why do some processes stay in Task Manager after they've been killed?" and "Why are there all these processes lingering near death, and what is keeping them alive?"

Spotify refuses to launch again because it sees a copy of itself already running, but it apparently just looks for another process called spotify. (A single-instance application is its own denial of service, in the words of Raymond Chen.) The easiest way to fix this would be to restart the computer, since that will wipe out all handles and bookkeeping.

But if you really feel like Fixing It YourselfTM, download Process Explorer, a fantastically useful free utility from Sysinternals. (I have no affiliation.) Run it, no installation required, and accept the EULA. Under File, choose Show Details for All Processes; this causes Process Explorer to relaunch as administrator. Then, under Find, choose Find Handle or DLL. Type the name of the zombie (well, corpse) process and press Search.

searching for handles

The Process and PID columns tell you what process owns the handle. The Type column indicates what sort of thing it is; we're interested in those of type Process or Thread. The Name column tells you what the handle is to. (A lot of processes own handles to themselves; these will go away if the owning application ends without problems in kernel mode.)

Danger: closing a handle that an application really needs is a great way to crash it. If possible, exit the application that owns the handle. But if you can't, or you just feel like hitting things with hammers...

Click an entry in that search window to open the handles pane. Right-click the newly highlighted entry in that pane and choose Close Handle to zap it out of existence.

Once all handles are closed, the process will vanish.

Ben N

Posted 2013-11-14T10:12:36.513

Reputation: 32 973

I couldn't get this to work ProcessExplorer hangs very easily and I had no process that had a handle I could close – Matthew Lock – 2017-05-30T05:28:01.513

2I closed all handled to all threads but the issue persisted. – Tomáš Zato - Reinstate Monica – 2017-09-20T21:46:02.097