procexp64.exe - high CPU itself RRS feed

  • Question

  • re: PE 16.31

    Hi all,

    On one particular i3 laptop the PE executable itself seems to run wild: its CPU use spikes to 20..30% and stays that way until the program is closed.  It happens most often when Chrome or Firefox is also running and using a lot of CPU, but also has happened with the laptop sitting idle and no other application running ... fan kicks into high gear, open laptop to see the culprit is PE itself.  Since PE runs at high priority, if something else is also using a lot of CPU this tends to bring the whole system to a crawl.  Sometimes it is a struggle just to activate the PE window to close it.  Once PE is closed, everything goes back to normal.

    This has been an infrequent annoyance through several versions, but it has become troublesome with 16.31 and Windows 10.  I load PE at login and leave it running much of the time, and this now is happening several times a day.

    The laptop is older, but still useful: its an i3-370m (64-bit HT dual core) with 6GB RAM and Windows 10 home.  When PE goes crazy it maxes out at least one VCPU and often more.

    A little searching revealed that a few people have seen this before - but it was many years ago and there was no resolution that I could find.  I didn't see it until early v16, and it hasn't been a problem for me until very recently.

    Any ideas?  I don't know what to look for.



    PS.  How does one get "verified" to post screen captures?  I logged in with a Microsoft account.

    Thursday, March 5, 2020 6:22 PM

All replies

  • This is true for the initial verification of all the digital certificate attached to the running exe.

    In the latest version PE verify the digital signature set on the many different exe and this takes time.

    On my machine it stays at 30% for almost a minute than goes down to 2-3%.

    So, generally speaking this is true but should least the time necessary to verify the digital signature of the running exe. After that time it should go down to 0.

    To understand what's going on, i used ProcMon. Start Procmon to log all the activity of Process Explorer only (by default it is disabled) and then start Procews Explorer.. let it go until the cpu used goes down to 0. If it doesn't, like it seems your problem, let it record all the activity then share the log. Normally you should see a huge activity related to the digital certificates stored in the registry. If you see something else, that would be the culprit of your problem..


    Friday, March 6, 2020 7:45 AM
  • Hi Mario,

    Yes, there is a lot of CPU activity for a minute or so when PE first starts, but then it quiets down.  Usually though the startup usage is 10..15%, not 20..30%.  And since I usually start PE at login, this short burst is not a problem.

    I will try ProcMon as you suggest.  The difficulty is that I can't predict when PE will go crazy, and logging it unconditionally all day long is wasteful.  I'm hoping I can set up ProcMon, but leave it idle until PE starts acting up.  Hopefully I can catch something after the problem starts.


    Saturday, March 7, 2020 7:17 AM
  • Hi George

    Do you still see the problem if you turn off signature verification?

    Next time you see it could you grab a process dump for procexp(64).exe and ping me offline at so that I can provide you with a location to upload it..


    Wednesday, March 18, 2020 12:17 PM
  • Hi,

    Yes the problem occurs with signature verification turned off.

    The problem is that when PE goes crazy, frequently the computer is locked up so bad I can't do much of anything until I manage to close PE.  At least so far I have been able to close it without needing to reboot, though often it takes several minutes to do it.

    I will try to get a dump for you the next time it happens.



    Thursday, March 19, 2020 7:46 PM
  • Hi,

    Unfortunately I can't do much of anything while PE is in this state - the program is unresponsive [and the rest of the computer is very sluggish].  I've been trying to get an dump from ProcMon, but that hasn't worked so far ... if it is not recording at the time I can't start it, and if it is recording it seems like it doesn't record any events that occur during the lockup.



    Thursday, March 19, 2020 7:51 PM
  • Configure the pc to take a full memory dump pressing the keys combination CTRL+SCROLL LOCK+SCROLL LOCK

    This way you can cause a blue screen that will stop all the sluggish which is going on the pc and will take a dump.


    Thursday, March 19, 2020 8:28 PM
  • Hi Mario,

    Interesting idea.  I don't have a SCROLL-LOCK key on the laptop so I'll have to figure a way to use another combination.



    Thursday, March 19, 2020 8:53 PM
  • There are several suggestions on-line that may or may not allow the CTRL+SCROLL LOCK+SCROLL LOCK option to work on your laptop.
    Here's a suggestion that works every time. Assuming you have one plug in an external keyboard that has a Scroll-Lock Key.
    Thursday, March 19, 2020 10:46 PM