locked
Program doesn't completely quit RRS feed

  • Question

  • I have an interesting situation with my Qt program... in the installer I made with NSIS I have a page that detects if the program is running and if so prompts the user to close the program. Most of the time things proceed just fine however sometimes on my laptop the installer will detect the program running even though I quit it already. Nothing shows up in task manager however when I run tasklist from the command prompt after having quit the program I see:

    C:\Users\Owner>tasklist /FI "IMAGENAME eq ReplicatorNew.exe"
    
    Image Name                     PID Session Name        Session#    Mem Usage
    ========================= ======== ================ =========== ============
    ReplicatorNew.exe             8256 Console                    1         28 K
    

    If I run the program again I see:

    Image Name                     PID Session Name        Session#    Mem Usage
    ========================= ======== ================ =========== ============
    ReplicatorNew.exe             8256 Console                    1         28 K
    ReplicatorNew.exe             3040 Console                    1     50,940 K
    

    So something is sticking around after closing the program. Any ideas what's going on here? Thanks.  I'm pretty sure the two times this happened occurred after resuming from standby then closing the program.

    Thursday, July 19, 2018 7:58 PM

All replies

  • I don't know what tasklist is; unless it is something that all other developers are familiar with, it does not help to use it to describe the problem.

    You don't say what type of application that your application is; is it a console program or a GUI? Do you have access to the source? If so, then what language is it?

    There is very much you are not telling us.



    Sam Hobbs
    SimpleSamples.Info

    Thursday, July 19, 2018 10:04 PM
  • I don't know what tasklist is; unless it is something that all other developers are familiar with

    Mr. Hobbs, really.... just open a command window and type 'tasklist' ?

    (it used to be in a Resource Kit in our better days)

    -- pa

    Friday, July 20, 2018 2:50 AM
  • Try to find out what is this 28K process. If it has a PID it *must* be visible in the Task Manager, or there's some malware activity going. Try to tweak the task manager view, or run it elevated, use Sysinternal tools etc.

    -- pa

    Friday, July 20, 2018 3:14 AM
  • I don't know what tasklist is; unless it is something that all other developers are familiar with

    Mr. Hobbs, really.... just open a command window and type 'tasklist' ?

    (it used to be in a Resource Kit in our better days)

    -- pa

    Really, I have never heard of it. Really. And it does not seem to help you either to determine what is happening.

    Am I wrong about my questions? Do we know what type of application it is? Or is that not relevant? Is it not relevant whether the source code is available?

    If it is a GUI application then we need to proceed to determine if the message loop is still executing. If not then we need to see what happens after the message loop. If it is a console then we need to determine what are the circumstances that can keep it executing.

    For either type of application, an important question is if there are background tasks. All of this is part of a methodology; diagnosing a problem like this should be done with answers to the questions I posted, or questions such as that. I think it is not worthwhile to proceed without answers to the questions of whether the source code is available, that significantly affects how the problem is diagnosed. I don't understand why people ask for help yet insist upon being vague about the problem.



    Sam Hobbs
    SimpleSamples.Info

    Friday, July 20, 2018 4:09 AM
  • In Task Manager, go to the "Details" tab. Do you find the PID there? It must be. You can sort by PID. Assuming you find it, right-click on it and select "Analyze wait chain". That usually shows nothing but if it does show something then it could give a big clue.

    See Closing main form doesn't finish process (only some computers). The answer in that says that the problem was a bank security module from Gas Tecnologia and that "almost all brasilian banks use this module".

    The Task Manager in Windows 10 seems to be much less useful than in previous versions. Pavel says "Sysinternal tools" and the main one for this is the process explorer, procexp.



    Sam Hobbs
    SimpleSamples.Info


    Friday, July 20, 2018 4:19 AM
  • Hi,

    thanks for posting here.

    This forum is about desktop application development with Microsoft products. For your case which isn't related to development, I suggest you post on QT forum or answer forum.

    https://www.qt.io/developers/#support

    https://answers.microsoft.com/en-us

    Your understanding and cooperation will be grateful.

    Best Regards,

    Baron Bi


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Friday, July 20, 2018 6:29 AM
  • I suggest you post on QT forum or answer forum.

    We don't know if the QT forum is correct and probably it is not. Posting in the answer forum won't help without more information.

    In the past, Microsoft representatives would request clarification and if none is provided (within a few days) then the question was updated to make it a discussion instead of a question. However doing that will deny members (such as I) from getting points if anything they said helps.



    Sam Hobbs
    SimpleSamples.Info

    Friday, July 20, 2018 7:03 AM
  • Have you tried attaching a debugger to the "zombie" 28k process?
    Friday, July 20, 2018 11:49 AM
  • Hi guys thanks for all the replies.  It is a GUI program, I have access to the source, and it is in C++.  I'm going to try and replicate the error since it is very sporadic and intermittent.  (I won't complain if it never happens again ha :)  If I can replicate it I will try attaching the debugger and analyzing wait chain.  How do I attach a debugger?
    Friday, July 20, 2018 8:01 PM
  • Something I might do is to put some lines in the program that writes trace messages to a file for diagnostic purposes. That can be done however you want to, it could be a file that you decide the name and location for and the code to do it can be whatever code you want to use. An alternative would be to use the Windows API function OutputDebugString but that would require additional debugging software; RLWA32 is more familiar with everything that might be available for that. There are many other possibilities.

    To attach to an existing application just execute VS and (usually) without a project open go to "Debug" | "Attach to process ...". There are many details about that but that is the general idea. When attached you might be able to see something that helps.



    Sam Hobbs
    SimpleSamples.Info

    Friday, July 20, 2018 8:34 PM
  • I just replicated the error on another computer.  Tasklist shows the process but task manager doesn't, not in the processes tab or the details tab.
    Friday, July 20, 2018 8:35 PM
  • More juicy information!  Process Explorer shows the process.  CPU column says 'Suspended'.  Could this be related to the NSIS installer since the last step of the installer launches the program?  Perhaps it's a child process and the installer hangs on?  But the installer doesn't show up in task manager/tasklist/process explorer once it finishes.  Two screenshots below.  When I try to kill the process using Process Explorer I get "Error opening process: Access is Denied."  Resuming does "Unable to suspend the process: Access is Denied."  And restart says process in running in a different account so it may behave differently etc.  Help much appreciated.
    • Edited by Crag_Hack Friday, July 20, 2018 8:55 PM
    Friday, July 20, 2018 8:47 PM
  • Perhaps it's a child process and the installer hangs on?
    I assume the wait chain would show that.


    Sam Hobbs
    SimpleSamples.Info

    Friday, July 20, 2018 8:49 PM

  • Friday, July 20, 2018 8:50 PM
  • And Calculator.exe shows as suspended too.  Have you tried whitelisting with Avast or otherwise disabling the antivirus?

    • Edited by RLWA32 Friday, July 20, 2018 9:09 PM
    Friday, July 20, 2018 9:08 PM
  • Lockapp.exe Microsoft.Photos.exe OfficeHubTaskHost.exe SearchUI.exe SkypeHost.exe are all also suspended.  I was able to kill the calculator process no problem.  I tried disabling Avast and MBAM but still couldn't kill my runaway Buddha Backup process.
    Friday, July 20, 2018 11:07 PM
  • Lockapp.exe Microsoft.Photos.exe OfficeHubTaskHost.exe SearchUI.exe SkypeHost.exe are all also suspended.  I was able to kill the calculator process no problem.  I tried disabling Avast and MBAM but still couldn't kill my runaway Buddha Backup process.

    None of this sounds like normal behavior -- more and more I don't think this is a development problem.  Maybe it's time to do a clean boot and some scanning...
    Friday, July 20, 2018 11:17 PM
  • Before you panic, this is what I see in my system. I can't find any of these suspended applications in the Processes tab of the Task Manager. From a user's perspective the Calculator and Edge are not executing. The Task Manager in Windows 10 is not a useful diagnostic tool.



    Sam Hobbs
    SimpleSamples.Info

    Saturday, July 21, 2018 12:38 AM
  • Are you running process explorer with elevated privileges?

    In addition to running it elevated, I also suggest you add the user name and integrity level to the columns displayed. 

    Saturday, July 21, 2018 12:57 AM
  • Process Explorer with elevated privileges didn't help, still access denied on kill attempt.  Here's a screenshot of the latest.  Also this error has occurred on multiple computers, one with avast/malwarebytes anti-exploit beta, one with avast/malwarebytes premium.

    Saturday, July 21, 2018 8:02 PM
  • This thread seems to be wandering a bit.  What is the connection between the initial post about a 28K zombie process named ReplicatorNew.exe and the suspended Buddha Backup x64.exe process?

    Did you ever attach the debugger to the ReplicatorNew.exe process?

    Saturday, July 21, 2018 9:42 PM
  • These suspended processes belong to "UWP process group". Unlike "normal" ones, they can be suspended when the OS believes they are not active and in this state they don't get processor time at all.  In the Processes view these groups are marked with a tiny green leaf.

    -- pa

    Saturday, July 21, 2018 10:18 PM
  • @RLWA32 I edited the name of the process in the initial post for secrecy but decided it doesn't really matter ... :)

    How do I attach debugger?

    Sunday, July 22, 2018 8:06 PM
  • Look at the Debug menu in Visual Studio to become familiar with it. Note that one of the items is "Attach to Process". So normally we will not have a project open in VS when we use that and for this you probably do not want a project open.



    Sam Hobbs
    SimpleSamples.Info

    Sunday, July 22, 2018 8:19 PM
  • Is Buddha Backup x64.exe a Windows desktop application written in unmanaged C++ (using Qt)?
    Sunday, July 22, 2018 8:40 PM
  • When attaching with Visual Studio I get "Unable to attach to the process. Catastrophic failure." When using Qt Creator I get:

    0_1532293994392_qc.png

    The process as it is hung now was run as an exe outside of both IDEs. Not sure if that's relevant.

    It is Windows desktop app in c++ with qt framework.  Does unmanaged just mean not .NET?

    Sunday, July 22, 2018 9:34 PM
  • From what you have said it is my understanding that the application is not a UWP application, was built without Common Language Runtime Support and doesn't use the .Net Framework.  It is a Windows desktop application built using the Win32 API with Qt providing the user interface.

    If that understanding is correct then it is indeed anomalous behavior for the application to be suspended.

    Can you test it on a vanilla Windows system that doesn't have Avast and other third-party software/drivers installed?  Maybe a virtual machine?

    Sunday, July 22, 2018 11:02 PM
  • This sounds like a Qt problem. You have not found any relevant C++ code; either there is none relevant or you have avoided finding it.


    Sam Hobbs
    SimpleSamples.Info

    Sunday, July 22, 2018 11:39 PM