High values of Process ID in Task Manager

Question

I have a curious sequence of events which may be related.

The symptom: My PC suddenly began to take ages to perform a link at the end of a compile. This was assocaited with continuous disk activity. I looked in Task Manager and:

plenty of memory
nothing in particular using excessive amounts of CPU
process IDs for recent tasks have values of 6 figures - normally PID's never have more than 4 digits.
one task - GoogleToolbarNotifier - is using 160,000 handles, and this is clocking up as I watch it. That app obviously has a serious handle leak.
also notice a SearchSettings.exe which I'm suspicious about.

I reboot and kill the GoogleToolbarNotifier task and all the tasks with high PID's but new tasks still get assigned high PID's.

Also: a day or so ago GoogleToolbarNotifier suddenly appeared in my taskbar and warned me that something was trying to change my default search engine from Google to Yahoo.

I ran MalwareBytes and it found 9 items all associated with Youtube Downloader which I had just installed. Removed them and uninstalled YD.

I may have accidentally installed some toolbar extension when I installed YD. I can't remember.

And the question is...

Why do I have high-value PID's in task manager and is it indicative of unwanted or suspicious behaviour?

TIA Ross

score 3 · Accepted Answer · answered Dec 07 '10 at 19:04

Why do I have high-value PID's in task manager and is it indicative of unwanted or suspicious behaviour?

It indicates that some program at some stage probably created tens of thousands (or hundreds of thousands) of processes. This does not have to be malicious and could be that the program is attempting to start a process which fails and it keep retrying the action. This may be caused by a programming bug or a corrupt installation.

For example, I seen a program which monitored a particular directory for incoming files and if there were any it ran a batch file that did some work and then deleted the file. An update to the customer's antivirus package caused problems in that it was locking the file when the batch file attempted to delete and so the file was never deleted. Hence this routine ran continually and each time the batch file was launched a process id was used up.

I reboot and kill the GoogleToolbarNotifier task and all the tasks with high PID's but new tasks still get assigned high PID's

The numbers will start again a low numbers when you reboot, so if you have high numbers immediately after a reboot, it looks like something strange going on at startup.

However, once the system has started to use high pids, it can continue to use them (even after the culprit is killed) until rebooted, Although PID's can be reused, it is more common to see the number increase. It is not the fault of the new tasks, nor should it cause them problems. (They are probably all innocent bystanders and the culprit is likely to have a normal pid).

Given that GoogleToolbarNotifier has a problem with 160,000 handles, I would suggest uninstalling this. If it resolves the issue and you want the program, you could also try re-installing it afterwards, maybe checking if there is a new version.

Note, High PIDs on their own don't usually cause a problem, but a program that leaks handles will eventually cause all sort of weird problems such as screens that can't draw themselves, programs won't open properly, files can be accessed/saved etc. It is quite common to get totally meaningless error messages in such cases, such as file does not exist (when it obviously does it) or permission denied (when the permissions are fine).