Process invisible to Process Explorer

[Swifty]

I have the "USB Aquarium" from
http://www.dreamcheeky.com/index.php?pagename=product&pid=10

It starts automatically with an entry in HKLM/Run, and puts an icon in
the system tray. If you use this icon to Quit, then it stops.

When my wife uses fast-user-switching, it starts a copy of
"Aquarium.exe". When she logs off, this process gets terminated, but the
aquarium doesn't stop.

From Process Explorer, I cannot find what is keeping the aquarium
running, and the only way to stop it is to ask her to logon again, then
stop it from her system tray icon before logging off.

There are a couple of DLLs in the same directory as the aquarium.exe;
might one of these be causing the aquarium to keep going?

Or, is the device just sitting there, doing its "thing", until something
(another copy of aquarium.exe) comes along and instructs it to stop?

Next time this happens, I'll try launching my own aquarium.exe process,
to see if that can be used to stop it.

 

[VanguardLH]

I have the "USB Aquarium" from
http://www.dreamcheeky.com/index.php?pagename=product&pid=10

It starts automatically with an entry in HKLM/Run, and puts an icon in
the system tray. If you use this icon to Quit, then it stops.

When my wife uses fast-user-switching, it starts a copy of
"Aquarium.exe". When she logs off, this process gets terminated, but the
aquarium doesn't stop.

From Process Explorer, I cannot find what is keeping the aquarium
running, and the only way to stop it is to ask her to logon again, then
stop it from her system tray icon before logging off.

There are a couple of DLLs in the same directory as the aquarium.exe;
might one of these be causing the aquarium to keep going?

Or, is the device just sitting there, doing its "thing", until something
(another copy of aquarium.exe) comes along and instructs it to stop?

Next time this happens, I'll try launching my own aquarium.exe process,
to see if that can be used to stop it.

My guess is that you are only looking at the process names and using
them to identify what is running. Have you looked at the svchost
processes to see what services have been rolled up inside each one?
Maybe this "app" is an NT service.

 

[Swifty]

My guess is that you are only looking at the process names and using

them to identify what is running. Have you looked at the svchost
processes to see what services have been rolled up inside each one?
Maybe this "app" is an NT service.

That was to be my next step, but there are a *lot* of svchost entries,
and there's a lot to look through in each.

I decided to test my hypothesis that aquarium.exe just sends state
changes to the aquarium, so terminating the task would leave the fish
swimming around forever. I logged on as my wife, and the aquarium
started up. I logged off, and it kept running. I logged back on as my
own ID and started the aquarium.exe - then quit it normally. The
aquarium stopped. So now I can stop asking my wife for her password.