Game crashes when Process Explorer from Microsoft's SysInternals is running

LostScot · March 11

Update 41 no longer lets me run Process Explorer from Microsoft's SysInternals suite of tools while the game is running. I have been using Process Explorer v17.05 alongside Elder Scrolls Online since August 2023.

The game runs for up to a minute before crashing, citing procexp.exe (or procexp64.exe if not launching Process Explorer through the stub) as the reason for the crash in a popup. The launcher tells me the game failed to run and suggests I repair the installation. This information is logged to the Windows System event log as follows:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Application Popup" Guid="{47bfa2b7-bd54-4fac-b70b-29021084ca8f}" />
<EventID>26</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2024-03-11T20:52:44.8756255Z" />
<EventRecordID>110114</EventRecordID>
<Correlation />
<Execution ProcessID="1608" ThreadID="16240" />
<Channel>System</Channel>
<Security UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="Caption">Error</Data>
<Data Name="Message">Prohibited: procexp64.exe 8f2d35bd4e71b67655192a2b5159e7a7303d8332cd81df2842bf2679d92adbf57e255201 Application terminated</Data>
</EventData>
</Event>

This is a tool that is running at all times on my computer. I use it for diagnostics, and have been running it for many years with no problems. This is the first time I have seen an application throw an exception due to Process Explorer running in the background. The same core code that powers Process Explorer is also used by Microsoft for the more familiar Windows Task Manager.

The launcher updated the game to U41 no problem today. All available addon updates have been applied. I've followed the launcher's advice of repairing the game, and have been through that 3 times now. Thankfully it is quick and not finding anything to repair.

I use my computer for work and gaming, and my work requires Process Explorer. I'm wondering if this can be fed back to the devs? I can imagine at least a handful of your developers are familiar with Process Explorer and will understand my concern at this conflict between Elder Scrolls Online U41 and a very productive utility! Thank you.

Hobotron · March 12

Agreed 100%. I have used Process Explorer as my task manager since well before ESO has existed, and _always_ have it running to monitor my system. What possible reason could they have for prohibiting it? It's not able to do anything that you couldn't do with the regular Task Manager or a multitude of different command line tools.

This is extremely concerning.

Hobotron · March 12

LostScot wrote: »

This is a tool that is running at all times on my computer. I use it for diagnostics, and have been running it for many years with no problems. This is the first time I have seen an application throw an exception due to Process Explorer running in the background. The same core code that powers Process Explorer is also used by Microsoft for the more familiar Windows Task Manager.

[...]
I use my computer for work and gaming, and my work requires Process Explorer. I'm wondering if this can be fed back to the devs? I can imagine at least a handful of your developers are familiar with Process Explorer and will understand my concern at this conflict between Elder Scrolls Online U41 and a very productive utility! Thank you.

The only time I've ever had a program gripe about it in the last 15 years has been when it was trying to be sneaky and install adware. That is nothing but validation that it should be running at all times.

Estcarp · March 12

Same thing here. I have been running Process Explorer for more than a decade and this is the first time any application program has been interfered/is interfering with Process Explorer.

I am missing daily rewards every day that this transgression continues

Estcarp · March 12

Actually, I have been using Process Explorer since 2003 - Two Decades! This is the first time that there has been any problem related to Process Explorer.

What did you do???

Estcarp · March 12

I reverted to Task Manager (Registry) and now I only have access to Task Manager with CTRL-ALT-DELETE. Apparently, even running Process Explorer to monitor performance causes the problem too. This alarms me greatly. Having removed all vestiges of Process Explorer, I can execute the game. All of this troubles me - what has Zenimax/Bethesda/Microsoft foisted on us????

There is something wrong here and I can't quite figure out what it is. Is it Stealthware, Malware, or something more sinister?

code65536 · March 12

Yea, I've noticed the same thing since PTS. I've been using procexp for two decades, but I don't keep it running 24/7, so it hasn't bothered me quite as much.

I wonder if it's some sort of anti-cheat protection measure that they added. Procexp acts like a debugger in some ways, and that's a kind of access that's similar to what external cheat modification software will use.

I haven't had a chance to test it, but I wonder if running procexp in user mode (without admin elevation) will trigger the same problem.

Hobotron · March 12

code65536 wrote: »

I wonder if it's some sort of anti-cheat protection measure that they added. Procexp acts like a debugger in some ways, and that's a kind of access that's similar to what external cheat modification software will use.

For clarity, it is not able to modify running processes. It can adjust process priority or suspend/kill processes -- the same as built-in Task Manager, as well as numerous command tools bundled with the OS.

Disallowing the execution of monitoring tools on your own machine is a really bad look, giving the appearance that the application is doing something untoward that they don't want users to observe. A response from Zenimax would hopefully clear this up.

ZOS_Bill · March 12

@LostScot

We are aware of an issue with ESO freezing after being launched. This is documented in the known issues for Update 41 found here. There are some further crash troubleshooting steps you can try such as reinstalling. You can also open a ticket for further assistance with customer support.

LostScot · March 12

ZOS_Bill wrote: »

@LostScot

We are aware of an issue with ESO freezing after being launched. This is documented in the known issues for Update 41 found here. There are some further crash troubleshooting steps you can try such as reinstalling. You can also open a ticket for further assistance with customer support.

Thanks for the response. I've been closing Process Explorer while playing Elder Scrolls Online since the update. Main downside is I can't monitor the activity of the machine learning models active on 12 of the cores (I only use 4 cores for ESO), so I'm playing a bit less since the update.

Looking forward to a fix from Zenimax, I'm familiar with the calibre of their developers and know they'll sweep up this problem along with any other issues from the U41 update.

LostScot · March 12

code65536 wrote: »

I haven't had a chance to test it, but I wonder if running procexp in user mode (without admin elevation) will trigger the same problem.

I can save you some time here, it's one of the first things I tested. No difference with or without the 'Show Details for All Processes' (aka run as admin) option enabled.

In complete agreement with the other points you've raised. Like you and others I've been using Process Explorer for decades without issue, and I've had the most recent release from July 2023 (v17.05) installed since August last year. Lot of respect for Mark Russinovich, it was his code in the mid to late 90s that taught me how to write device drivers for the NT kernel's hardware abstraction layer.

My thoughts are that there is some attempt within ESO U41 to utilise application container permissions that are exclusive to the running process (no System access, only Owner), and this is causing the exception when Process Explorer or other process monitoring utilities attempt to update their knowledge of the ESO process. This may be deliberate, an attempt like you say to negate cheating, or it may be a side effect arising from attempting to utilise some of the more recent Windows virtualisation functionality to isolate processes and improve memory management. Speculation by me, only Zenimax know for sure.

Estcarp · March 13

I filed a ticket. They asked me for the ESO report file (done), dxdiag log (done) and MSINFO log (done) ... not sure how that helps??? Just making me jump through hoops from a script and makes no sense. I know what the problem is, they are violating Microsoft rules process explorer will have none of that so Process Explorer automatically terminates ESO64.exe to protect me.

EldarOfSuburbia · March 13

Just chiming in to say I have the same issue, so glad I'm not alone. The only reason I keep Process Explorer running is to log my son off my PC because he always forgets to do it himself when his time limit expires! So it's no imposition for me to shut it down before starting ESO. It's still a minor inconvenience I don't understand and it would be nice if it went away.

Since the thing that changed is ESO, the fix is going to be squarely in ESO's court. I've never known any other process to interfere with or be interfered with by Process Explorer, and like many others in this thread, I have been running it on a daily basis for many years; in my case on dozens of Windows servers that I manage for my job.

ZOS_Bill · March 13

@Estcarp

You are welcome to share your current ticket here if you need any updates.

Elsonso · March 13

code65536 wrote: »

Yea, I've noticed the same thing since PTS. I've been using procexp for two decades, but I don't keep it running 24/7, so it hasn't bothered me quite as much.

I wonder if it's some sort of anti-cheat protection measure that they added. Procexp acts like a debugger in some ways, and that's a kind of access that's similar to what external cheat modification software will use.

I haven't had a chance to test it, but I wonder if running procexp in user mode (without admin elevation) will trigger the same problem.

I noticed this on Day 1 of PTS because I happened to have Process Explorer open at the time. It is a tool available for download from Microsoft. It's not like I had to hide out in a back alley and pay for it with untraceable crypto currency from a shady guy that only goes by the name "John".

Like you, I don't keep it running all the time, but if it is Anti-cheat, then I don't want to forget and be dinged by some Anti-Cheat detect algorithm and be told "violates the ToS, guh-bye!" It is always better to be on the "I've never been contacted" side of the ToS team than the "I had to beg to get my account back" side.

Estcarp wrote: »

Same thing here. I have been running Process Explorer for more than a decade and this is the first time any application program has been interfered/is interfering with Process Explorer.

I have encountered problems a long time ago with a game long forgotten. I complained, and the problem magically went away in a patch. Not saying my complaint had anything to do with it.

Been a long long time, though.

LostScot wrote: »

Lot of respect for Mark Russinovich, it was his code in the mid to late 90s that taught me how to write device drivers for the NT kernel's hardware abstraction layer.

Man, that seems like an eon ago. Wait. It was!

EldarOfSuburbia · March 13

I'm wondering if the problem is Process Explorer itself, or how it uses WMI / CIM to gather process info? Has anyone tried, for example, to loop

Get-CimInstance -class Win32_Process -filter 'name = "eso64.exe"'

?

code65536 · March 13

It's not just procexp; it closes with procmon up, too

ESO evidently does not like utilities that can peek at what it's doing.

Elsonso · March 13

code65536 wrote: »

It's not just procexp; it closes with procmon up, too

ESO evidently does not like utilities that can peek at what it's doing.

Security through obscurity?

KlauthWarthog · March 13

This makes me think back to the redshell incident a couple years ago.

SyBorg · March 20

I've also been using Sysinternals utilities for ages, and I'm very disappointed.
I've found it has wemod.exe as blacklisted process as well.
I experienced the same behavior in "Fallout 76" on Steam - had to uninstall and requested a refund, "my computer - my rules".

(I see some Windows Internals bible readers here, eh?..;)

Elsonso · March 20

I put wemod (had to Google it) in a different category than things like Process Explorer.

That said, my opinion means nothing.

There is probably a <1% chance that they will change their opinion. They had a few weeks to do it, if they wanted to. They aren't changing my opinion, either. I uninstalled the PC client on Update 41 launch day. I play on XBox now, but a whole lot less.

Hobotron · March 23

Wemod I can absolutely understand, since its purpose in life *is* to modify running processes. It really doesn't make sense for Process Explorer. It's a process monitor.

I'd really love some feedback from Zen on this, since it definitely gives the impression of not wanting users to see what their application is doing on their system.

Elsonso · March 25

My assumption is that they did not change anything this patch?

Estcarp · March 25

Patch on Monday (today_ ) changed nothing ....

Elsonso · March 25

Thanks!

ixthUA · March 25

Tried to play ESO, but game client closes saying i have procexp running. Between two, my choice is procexp. I hope they can fix this within a half of year that it takes the next chapter dlc to go on sale.

LostScot · March 25

Upon further investigation, my hunch about Zenimax attempting to implement application container permissions turns out to be correct. Looking at how the ESO client is calling SeCreateClientSecurity in ntifs.h I can see that it goes against Microsoft's recommendations for base permissions - it's too exclusive.

When the ESO client is running you can see that immediately before the crash, the client will iterate through the details of all loaded processes in memory and will then trigger the error. It's not really my place to go debugging this further, I just wanted to know why it's causing a crash on my computer.

This is easily fixable. I am more than happy to provide further details if Zenimax want to share notes on this, I am fairly confident though that the developers who implemented the relevant code will know exactly what I'm referring to.

Elsonso · March 25

LostScot wrote: »

This is easily fixable. I am more than happy to provide further details if Zenimax want to share notes on this, I am fairly confident though that the developers who implemented the relevant code will know exactly what I'm referring to.

They have had weeks to fix this, and it was discovered and reported on day 1 of PTS. At this point, I assume it is intentional and that it won’t be fixed. My computers remain free of ESO clients for that reason. I don’t have to worry about these things on console.

code65536 · March 25

Elsonso wrote: »

I don’t have to worry about these things on console.

That's asinine; the reason you don't have to worry about this on console is because it's a locked-down environment where things like procexp can't even exist. You're effectively saying, "I don't like it when the game prohibits me from using this diagnostic utility, so I'll go to a place where such diagnostic utilities aren't even allowed to exist."

Elsonso · March 26

code65536 wrote: »

Elsonso wrote: »

I don’t have to worry about these things on console.

the reason you don't have to worry about this on console is because it's a locked-down environment where things like procexp can't even exist. You're effectively saying, "I don't like it when the game prohibits me from using this diagnostic utility, so I'll go to a place where such diagnostic utilities aren't even allowed to exist."

Yes, that is exactly why I don't have to worry about them doing that, and yes, that is exactly what I am doing. I am not going to stop using Process Explorer on PC so that I can run a game. Like I said, I don't think that this is a mistake. It is not even in the list @ZOS_Kevin made. It seems clear to me that system management tools like Process Explorer are not authorized by ZeniMax, and therefore, in violation of the Terms of Service. Even if they don't take action, whatever they are doing starting with Update 41 just terminates the program when it detects it. Why do I want to bother with that?

I am monitoring, in case I am wrong, but I moved to console because I don't expect them to make any changes.

Estcarp · March 30

This is the answer for my ticket ... They closed it!

Greetings,

Thank you for contacting The Elder Scrolls Online Team!

We greatly appreciate you bringing this potential bug to our attention. This information has been collected and will be passed on to our development team. You will not receive a further response to this ticket.

We encourage you check the Bug Reports section of the ESO Forums as well. The development team checks these regularly and it allows you to add video and screenshots more easily to help describe the issue you're experiencing.

Thank you for your continued interest and support!

Kind Regards,
The Elder Scrolls Online Team
06:48 AM - 3/15/2024

What is this with whitewashing bug reports … IT HAS NOT, REPEAT, NOT BEEN RESOLVED

[240315-001590] Elder Scrolls Online Support Ticket