Process Explorer crashing on startup - using Process Hacker instead

[IainB]

A while back, PE (Process Explorer) from SysInternals was working fine on my Win7-64 Home Premium system. Then it stopped working.

This is what happened when it was working:

• STEP 1: when the 32-bit .exe file was executed, it seemed to generate a 64-bit .exe;
• STEP 2: the 64-bit .exe was then auto-executed;
• STEP 3: the PE UI then came up;
• STEP 4: after PE was terminated, the 64-bit .exe would disappear.

Now when I run PE, STEP 1 occurs (including the 64-bit .exe being generated), then PE appears to auto-terminate or "crash" (goes to STEP 4), and the UI never appears, all without any error messages at all.
I have given up trying to find a cause for this crash, and the user forum seems to be pretty useless and offers no help. There are posts mentioning crashing on startup, but no root cause is known and the best recommendations seem to be to blindly change this and that in the hope that your blundering about might accidentally fix things.
That not a recommended approach to resolving a problem.
The OS appears to be rock solid, and passes all the analysis/checks I have run.
The conclusion that I have arrived at is that the last/latest version of PE is flaky and unreliable.

I have therefore abandoned it and reinstalled PH (Process Hacker) - which I had trialled over a year ago.
PH works a treat.
Here are the key features of PH and a comparison with PE,  from their website: http://processhacker.sourceforge.net/

Spoiler

Process Hacker is a feature-packed tool for manipulating processes and services on your computer.

Key features of Process Hacker:
     • A simple, customizable tree view with highlighting showing you the processes running on your computer.
     • Detailed system statistics with graphs.
     • Advanced features not found in other programs, such as detaching from debuggers, viewing GDI handles, viewing heaps, injecting and unloading DLLs, and more.
     • Powerful process termination that bypasses security software and rootkits.
     • View, edit and control services, including those not shown by the Services console.
     • View and close network connections.
     • Starts up almost instantly, unlike other programs.
     • Many more features...

Compared with Process Explorer, Process Hacker:
     • Implements all of the functionality offered by Process Explorer, plus more advanced features.
     • Performs stack traces correctly for .NET programs, with managed symbol resolution.
     • Allows you to see what a thread is waiting on.
     • Has advanced string scanning capabilities, as well as regular expression filtering.
     • Highlights both relocated and .NET DLLs.
     • Shows symbolic access masks (e.g. Read, Write), rather than just numbers (e.g. 0x12019f).
     • Shows names for transaction manager objects and ETW registration objects.
     • Shows detailed token information, as well as allowing privileges to be enabled and disabled.

Hoping this may be of interest/use to someone.

[Ath]

You may have issues with the stored settings, somewhere in registry (not sure where exactly it's stored though). If it's terminated/stopped while minimized, it'll restart minimized the next time. But clicking the taskbar icon restores it like any app, and your step 4 wouldn't happen.
Maybe eradicating the registry entries and retrying could help you out?

And I'll take a look at Process Hacker later

[Ath]

Found the registry key on the FAQ page, it's under HKCU\Software\Sysinternals\Process Explorer

[IainB]

@Ath: Thanks for the suggestion about the Registry key. I hadn't tried that. So I deleted the Registry key to PE, closed the Registry and started PE as a clean new first start.
It initially looked more hopeful, because the licence agreement form came up, so this was a first time run procedure. But then it just reverted to the same crash steps as above. I restarted PE, and it repeated the crash sequence.
This is just more blind stumbling trying this and that.

Where you say:

If it's terminated/stopped while minimized, it'll restart minimized the next time. But clicking the taskbar icon restores it like any app, and your step 4 wouldn't happen.

- would not seem to be relevant in this case, as PE never seems to appear in the task bar - not even momentarily.

I shall stick with PH from hereon.
Thanks again anyway.

[Ath]

PE never seems to appear in the task bar - not even momentarily.

-IainB (January 06, 2012, 01:30 AM)

That is really strange, but I have no more clues

[nosh]

he OS appears to be rock solid, and passes all the analysis/checks I have run.

Anti-malware checks included?

[IainB]

Yes, I've been using Malwarebytes PRO (does realtime scanning) and MS Security Essentials from new, and there are no issues there.
And even though it's arguable that it's probably no longer strictly necessary/beneficial, I periodically run CCleaner and RevoUninstaller over the system. No issues there either.
Belarc analysis reports no issues either.

[f0dder]

Sounds very weird - you're saying the 64bit exe is generated, and it's also being deleted after PE fails to load properly?

If it was a piece of malware responsible, I'd expect the 64bit exe to stick around. Perhaps it's an issue with driver registering/loading? Yes, Process Explorer uses a device driver for some of it's stuff.

[IainB]

Sounds very weird - you're saying the 64bit exe is generated, and it's also being deleted after PE fails to load properly?

If it was a piece of malware responsible, I'd expect the 64bit exe to stick around. Perhaps it's an issue with driver registering/loading? Yes, Process Explorer uses a device driver for some of it's stuff.

-f0dder (January 06, 2012, 10:46 AM)

Yes, that's what happens. Could even be a .NET issue, I suppose,
Like I said, "flaky".