Process Explorer in 64-Bit World

Process Explorer is one of tools that get installed on any computer I get my hands on. One click on "Options"/"Replace Task Manager" and Ctrl+Esc shortcut becomes owned by it.

That is, it will replace task manager but only if you have 32-bit system. On 64-bit system it will seem to work until you exit it. As soon as you are out of program, system seems to forget that there is any task manager.

Using another great Sysinternals utility - Process Monitor - I found issue. Process Explorer hosts 64-bit version inside of it's 32-bit process (procexp.exe). If it detects that it is running on 64-bit system it tries to unpacks procexp64.exe into current folder. If that folder is not writable, it extracts file to temporary folder and runs it from there. Process Explorer that you see is running from procexp64.exe.

When replacing task manager, it will point system to search for it's currently executing copy. Unfortunately when you exit program it procexp.exe will delete that copy in attempt of cleaning after it self. Ctrl+Esc does not work since registry points to, freshly deleted, non-existing procexp64.exe file.

Solution that worked for me was to grant write rights to Process Explorer directory (to both Administrators and Users groups), start it and, while it is running, make copy of procexp64.exe. Once I secured copy of program, I went to "Options"/"Replace Task Manager". All that is left to do then is exiting program (be sure it is not left in tray area).

Process Explorer will delete procexp64.exe upon exit. To overcome this I just rename program's copy (made while Process Explorer was running) back to procexp64.exe. Now Ctrl+Esc can be used once more.

Slightly annoying aspect of this is fact that procexp.exe must not be started again to avoid triggering delete. You can solve this by deleting procexp.exe - procexp64.exe is all you need.

Slightly annoying fix, but it does work. And Process Explorer is easily worth all this trouble.

Leave a Reply

Your email address will not be published. Required fields are marked *