Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a curious sequence of events which may be related.

The symptom: My PC suddenly began to take ages to perform a link at the end of a compile. This was assocaited with continuous disk activity. I looked in Task Manager and:

  • plenty of memory
  • nothing in particular using excessive amounts of CPU
  • process IDs for recent tasks have values of 6 figures - normally PID's never have more than 4 digits.
  • one task - GoogleToolbarNotifier - is using 160,000 handles, and this is clocking up as I watch it. That app obviously has a serious handle leak.
  • also notice a SearchSettings.exe which I'm suspicious about.

I reboot and kill the GoogleToolbarNotifier task and all the tasks with high PID's but new tasks still get assigned high PID's.

Also: a day or so ago GoogleToolbarNotifier suddenly appeared in my taskbar and warned me that something was trying to change my default search engine from Google to Yahoo.

I ran MalwareBytes and it found 9 items all associated with Youtube Downloader which I had just installed. Removed them and uninstalled YD.

I may have accidentally installed some toolbar extension when I installed YD. I can't remember.

And the question is...

Why do I have high-value PID's in task manager and is it indicative of unwanted or suspicious behaviour?

TIA Ross

share|improve this question
    
So what exactly is the question? –  JNK Aug 1 '10 at 1:27
add comment

2 Answers 2

up vote 1 down vote accepted

Why do I have high-value PID's in task manager and is it indicative of unwanted or suspicious behaviour?

It indicates that some program at some stage probably created tens of thousands (or hundreds of thousands) of processes. This does not have to be malicious and could be that the program is attempting to start a process which fails and it keep retrying the action. This may be caused by a programming bug or a corrupt installation.

For example, I seen a program which monitored a particular directory for incoming files and if there were any it ran a batch file that did some work and then deleted the file. An update to the customer's antivirus package caused problems in that it was locking the file when the batch file attempted to delete and so the file was never deleted. Hence this routine ran continually and each time the batch file was launched a process id was used up.

I reboot and kill the GoogleToolbarNotifier task and all the tasks with high PID's but new tasks still get assigned high PID's

The numbers will start again a low numbers when you reboot, so if you have high numbers immediately after a reboot, it looks like something strange going on at startup.

However, once the system has started to use high pids, it can continue to use them (even after the culprit is killed) until rebooted, Although PID's can be reused, it is more common to see the number increase. It is not the fault of the new tasks, nor should it cause them problems. (They are probably all innocent bystanders and the culprit is likely to have a normal pid).

Given that GoogleToolbarNotifier has a problem with 160,000 handles, I would suggest uninstalling this. If it resolves the issue and you want the program, you could also try re-installing it afterwards, maybe checking if there is a new version.

Note, High PIDs on their own don't usually cause a problem, but a program that leaks handles will eventually cause all sort of weird problems such as screens that can't draw themselves, programs won't open properly, files can be accessed/saved etc. It is quite common to get totally meaningless error messages in such cases, such as file does not exist (when it obviously does it) or permission denied (when the permissions are fine).

share|improve this answer
add comment

Seems to be normal on some systems

http://forum.soft32.com/windows/Ridiculously-high-PID-numbers-ftopict352010.html

http://www.linfo.org/pid.html

Rootkit malware can be hard to detect, try this software to see if any are present.

http://www.gmer.net/

.

share|improve this answer
    
GMER.EXE causes a BSOD presumably when it tries to remove something it doesn't like. –  rossmcm Aug 1 '10 at 9:22
    
What exactly is it trying to remove? –  Moab Aug 1 '10 at 12:35
    
well, I don't know because the BSOD happened while I was away. It happened twice. The BSOD said that a thread caused a memory fault when it was being removed, or some such - I didn't note the message - (something I moan at my clients for!) –  rossmcm Aug 1 '10 at 21:17
    
its possibly mis-identifying something as malware and killing a thread it should not be. –  xbonez Dec 7 '10 at 19:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.