Why do some process stay in Task Manager after they’ve been killed?
When a process ends (either of natural causes or due to something harsher like TerminateProcess), the user-mode part of the process is thrown away. But the kernel-mode part can't go away until all drivers are finished with the thread, too. For example, if a thread was in the middle of an I/O operation, the kernel signals to the driver res...