Process Explorer Archives

Winsage

June 30, 2026

Microsoft reveals why Windows 11 keeps saying a file is in use after you close the app, plus the fix

The 'file in use' error in Windows indicates that a file is currently being accessed by a program, preventing deletion or renaming to avoid data corruption. This error can persist even after closing an application due to reasons such as antivirus software scanning the file, network references from other devices, or files loaded as Dynamic Link Libraries (DLLs) that remain in memory. To identify the process causing the error, Mark Russinovich developed the command-line tool Handle, which shows all open file handles, and Process Explorer, which provides a graphical interface to find and manage these handles. Microsoft is integrating Sysinternals tools into PowerToys for easier access, including the File Locksmith tool that allows users to unlock files directly. A recommended workaround for the error is to rename the file instead of deleting it, as Windows permits renaming even when a file is open.

Winsage

January 12, 2026

EDRStartupHinder Disables Antivirus and EDR Protections During Windows 11 25H2 Startup

A new tool named EDRStartupHinder was unveiled on January 11, 2026, which allows attackers to inhibit the launch of antivirus and endpoint detection and response (EDR) solutions during the Windows startup process. Developed by security researcher Two Seven One Three, it targets Windows Defender and various commercial security products on Windows 11 25H2 systems by redirecting essential system DLLs during boot using the Windows Bindlink API and Protected Process Light (PPL) security mechanisms. The tool employs a four-step attack chain that includes creating a malicious service with higher priority than the targeted security services, redirecting critical DLLs to attacker-controlled locations, and modifying a byte in the PE header of the DLLs to cause PPL-protected processes to refuse loading them. This results in the termination of the security software. EDRStartupHinder has been tested successfully against Windows Defender and other unnamed antivirus products, demonstrating its effectiveness in preventing these security solutions from launching. The source code for EDRStartupHinder is publicly available on GitHub, raising concerns about its potential misuse. Security teams are advised to monitor for Bindlink activity, unauthorized service creation, and registry modifications related to service groups and startup configurations to detect this attack vector. Microsoft has not yet issued any statements regarding patches or mitigations for this technique.

Winsage

November 2, 2025

Windows Task Manager is fine, but this is the tool I actually use

Windows Task Manager has evolved to align with Windows 11's aesthetics while improving functionality, but some users find it frustrating when processes won't terminate. Process Explorer is an alternative that offers a clearer interface, real-time monitoring, and detailed statistics. It displays hardware graphs at the top and consolidates key metrics into a single view, including the total number of active processes. Users can hover over processes for quick information and access a comprehensive properties view by double-clicking. Process Explorer allows adding columns for process paths and related services, provides graphical views of resource usage, and enables the termination of stubborn processes. It also offers a refresh rate as low as 0.5 seconds and displays comprehensive graphical statistics since system boot-up. Additionally, it integrates with Virus Total to verify processes against a database, includes a tool for searching processes online, and features a lens tool for identifying process names. Process Explorer is considered a superior alternative for advanced users due to its rich features and security integration.

Tech Optimizer

October 11, 2025

Hackers Can Inject Malicious Code into Antivirus Processes to Create a Backdoor

A new cybersecurity technique allows attackers to exploit antivirus software by injecting malicious code into its processes, evading detection and compromising security. The method involves cloning protected services and hijacking cryptographic providers to create a backdoor in the antivirus installation folder. This technique takes advantage of antivirus solutions' reliance on operating system features and less-guarded auxiliary components. By exporting and importing registry keys, attackers can create a duplicate service that retains the original's configurations, allowing for the injection of malicious DLLs during service startup. An open-source tool named IAmAntimalware automates this process, successfully demonstrating the technique with various antivirus programs. To mitigate these threats, monitoring of module loads, auditing trusted certificates, and enforcing security features are recommended.

Tech Optimizer

September 24, 2025

EDR Bypass Technique Puts Antivirus Tools To Sleep

Endpoint detection and response (EDR) systems and antivirus protections are increasingly targeted by threat actors using sophisticated techniques. A new method called EDR-Freeze has been introduced, which utilizes Windows Error Reporting and the MiniDumpWriteDump function to hibernate antivirus processes without needing to install vulnerable drivers. This technique operates entirely in user mode and was disclosed by an anonymous researcher known as Two One Seven Three on Zero Salarium. The MiniDumpWriteDump function can suspend all threads within a target process during the dump process, which is crucial to avoid memory corruption. The researcher faced challenges with the rapid execution of MiniDumpWriteDump and the security measures protecting EDR and antivirus processes. By reverse-engineering the WerFaultSecure program, the researcher enabled MiniDumpWriteDump for any chosen process and integrated it with the CreateProcessAsPPL tool to bypass Protected Process Light (PPL) protections. The researcher proposed a race condition attack consisting of four steps: executing WerFaultSecure with WinTCB-level protection, configuring it to dump the target process, monitoring the target process until it is suspended, and then suspending the WerFaultSecure process. A tool to execute this exploit is available on GitHub, and another researcher has developed a KQL rule for its detection. The EDR-Freeze technique exploits a vulnerability in the WerFaultSecure program, addressing the weaknesses of the BYOVD method and allowing flexible control over EDR and antivirus programs.

Winsage

September 24, 2025

EDR-Freeze Arrives! It Puts Windows into a Deep Coma Without Vulnerable Drivers

A Zero Salarium specialist has developed a method called EDR-Freeze that temporarily disables antivirus processes and EDR agents on Windows systems. This technique utilizes built-in system tools and exploits race conditions between processes, specifically using MiniDumpWriteDump to suspend target processes while capturing snapshots. The method operates without third-party driver exploits and functions in user mode. The EDR-Freeze tool is available on GitHub and requires the target program's PID and a pause time in milliseconds to keep the antivirus process suspended. A demonstration showed that the Windows Defender service (MsMpEng.exe) was successfully suspended. The specialist warns to monitor WerFaultSecure for unusual boot parameters related to sensitive services and recommends implementing robust protection mechanisms to verify boot chains of protected processes.

Winsage

April 30, 2025

5 alternatives to the Windows Task Manager that you should be using

Windows Task Manager has been enhanced in Windows 11, featuring a streamlined interface and improved functionality. Alternatives to Task Manager include: - System Informer: A free, open-source tool that monitors system resources with real-time performance graphs and detailed process information. It displays CPU, memory, and disk usage, tracks file access, and offers advanced features like call stack traces. - System Explorer: Integrates system monitoring with security features, providing a clean interface for exploring processes, modules, and network connections. It includes a built-in file database and VirusTotal integration for security assessments. - Process Lasso: Extends Task Manager capabilities by allowing users to adjust CPU priority and core affinities. Features include ProBalance for automatic CPU adjustments, performance mode for optimizing CPU usage, IdleSaver for power management, and SmartTrim for memory optimization. - Process Explorer: A Sysinternals tool that offers a detailed view of running processes in a hierarchical tree format, showing user, PID, and resource usage. It includes a search capability for identifying resource usage and integrates with VirusTotal for security checks. - Task Manager DeLuxe (TMX): A portable task management tool that consolidates system stats across multiple tabs, providing quick access to CPU and memory usage, along with graphical representations of network and disk activity. It allows filtering and searching for processes and can be run from a USB drive.

Winsage

March 3, 2025

5 reasons to use Process Explorer instead of the default Task Manager on Windows

Process Explorer is a tool from the Sysinternals Suite that serves as an alternative to the Windows Task Manager, providing advanced system monitoring and troubleshooting capabilities. It offers detailed information about processes, including paths and descriptions, and allows users to inspect or delete files. The tool integrates with VirusTotal to scan running processes for malware, provides real-time monitoring of CPU, GPU, RAM, and I/O activity with precise graphs, and enables users to forcefully kill stubborn processes or terminate entire process trees. Additionally, it helps users identify which processes are using locked files, facilitating better file management.