process freezing/suspending

[TECHWG]

What is the benefit and usages of suspending a process ? i mean [ractical usages . . what advantage does it provide being able to do this to an exe etc ?

[trickyricky]

A lot of malware monitors current processes and can re-start a process if killed/deleted. Many, however, fail to detect a suspended process, so you can stop the essential background processes from running and then deal with locked files and everything else to enable you to rid the system of the malware. It's just another weapon in our arsenal which helps us deal with the crap.

[lotuseclat79]

{QUOTE-> What is the benefit and usages of suspending a process ? i mean [ractical usages . . what advantage does it provide being able to do this to an exe etc ? <-QUOTE}
Hi TECHWG,

You did not specify a context for your question, and even though trickyricky's reply is in the malware monitor context - here is a different notion:

From the point-of-view of the OS, it would be impossible to schedule a higher priority process for the CPU if it could not suspend and at a later time resume a lower priority process when it is time to run it according to the scheduling algorithm used by the OS. Needless to say, this is a core service of the OS.

It also is an area of who controls what in the context of the system. Getting control (e.g. of a kernel service) is the mantra of a trojan, while keeping and not delegating control to a foreign-agent (to the system) is the mantra of anti-malware protecting the system.

As such, getting enough control to suspend/resume processes in a running system is one such service for which an OS cannot afford to lose control.

-- Tom