TmsaInstance64.exe sometimes consumes 50% of CPU - why?

  • 1
  • Problem
  • Updated 2 months ago
  • In Progress
  • (Edited)
Windows 10 v1709, build 16299.248), TM Max Security v12.0.1226

I have noticed again recently, that TmsaInstance64.exe is consuming nearly 50% of CPU time, slowing down all other processes.
Can anyone tell me what purpose in Trend Micro's environment this executable serves?
Is it a fault that this process consumes so much CPU time, albeit intermittently?
I first saw this weeks ago, and it seemed to go away without intervention, but it has cropped up again. Why is that, if anyone knows?
Any helpful information would be gratefully accepted.
Photo of Sam

Sam

  • 384 Points 250 badge 2x thumb

Posted 3 months ago

  • 1
Photo of Tom Emmelot

Tom Emmelot, Champion

  • 16,678 Points 10k badge 2x thumb
Hi Sam

Welcome to TM Home users Community, a public site where volunteers try to help each-other , also there are TM Employees that can give answers, that is only at working hours. I am just a volunteer!
I think a reinstall will fix this case, but look at this link.

https://esupport.trendmicro.com/en-us/home/pages/technical-support/1101714.aspx?_ga=2.55339179.12626...
Hope this helps.

Kind regards,
Tom
Photo of TM_Kaye

TM_Kaye, Employee

  • 2,330 Points 2k badge 2x thumb
Hello Sam and welcome to Trend Micro Community!

Thank you for your insights, Tom Emmelot. :)

The TmsaInstance64.exe is for analyzing of script in web pages and identifies any malicious script in it. It is unusual if this process will consume 50% of the CPU usage of your computer. 

To further verify your concern, kindly provide to us more information about it:

1. Internet browser you are using. 
2. Did this issue happened when you are browsing the Internet?
3. How often does the TmsaInstance64.exe consumes 50% of the CPU usage?
4. Screenshot of your Task Manager showing its consumption. 

We will be waiting for your response. 

All the best,

Trend Micro Home Users Community
Photo of Sam

Sam

  • 384 Points 250 badge 2x thumb
I will try to keep a log of recurrences in the near future, and post more information later, but for now, I can say that I am currently using Firefox 64-bit v58.0.2. The phenomenon is quite easy to spot, as usually my PC runs smoothly and quickly, but when it happens, everything slows up dramatically.

I haven't noticed whether or not I was actively browsing at the time I noticed the pronounced performance drops, but I will look out for that. Because I didn't know what function TmsaInstance serves, I didn't look for coincidences with browsing. Does TmsaInstance only scan open pages, or does it go out and search for malicious script? If it only scans pages that are open, should the CPU usage be dependent on the number of pages currently open?

I have only noticed TmsaInstance64.exe consuming up to 50% CPU a few times, and maybe it has only happened shortly after startup, but I'm not certain.

The next time I spot it happening, I will take a screenshot of it in Task Manager, and post it here.

Thanks for your advice.

Regards,
Sam
(Edited)
Photo of Sam

Sam

  • 384 Points 250 badge 2x thumb
The mention of TmsaInstance64.exe scanning for malicious code in browser pages has prompted me to do some testing - monitoring TmsaInstance64 CPU usage while starting various browsers (Firefox, Chrome, IE11, and Edge).

This has produced some interesting results;

TmsaInstance64.exe - periods of high CPU activity following browser startup:

Firefox: 40-50 secs - it takes a few seconds for the heavy CPU usage to begin
Chrome: 2 secs
IE11: 2 secs
Edge: 0 secs

I also monitored TmsaInstance64 CPU usage while starting Firefox with and without displaying a home page, and the results were the same: 
1. Firefox is responsible, on my system at least, for invoking heavy processing by TmsaInstance64 when it first starts. Opening additional page tabs in Firefox appears to have little or no effect on TmsaInstance64 activity.
2. Chrome, IE11 and Edge do not invoke, when starting, any heavy and prolonged processing by TmsaInstance64.

So, the action is clear: I will change my default browser back to Chrome or IE11 - I don't like Edge, even though it is quick.

This is strange, because Firefox claims to be faster than Chrome in its operations, although evidently not in all processing environments, and that is why I started using Firefox instead of Chrome. Mistake!

Please post if there is anything more to add - thanks for your help, guys.
(Edited)
Photo of TM_Kaye

TM_Kaye, Employee

  • 2,330 Points 2k badge 2x thumb
I appreciate your time and effort in investigating the issue Sam

There is a possibility that the TmsaInstance64.exe is scanning the scripts for the installed Add-ons/Extension on your browsers. 

On your Mozilla Firefox, kindly check and provide to us the Add-ons/Extension installed so we can replicate the issue on our end. Then, kindly check also if you have similar Extensions on your other browsers. 

To do that, please see the steps below:

• In Mozilla Firefox, open the Menu and select Add-ons. Then choose Extensions

• In Internet Explorer, open IE and press Alt + X to open Tools. Click the Manage add-ons.

• In Google Chrome,  type chrome://extensions in the address bar and hit Enter to open the Extensions page.

• In Microsoft Edge, select the ... to open the menu and select Extensions.


Thanks and feel free to post here in the community so we can assist you further.

Have a great day!

Trend Micro Home Users Community
Photo of Sam

Sam

  • 384 Points 250 badge 2x thumb
Hi again TM_Kaye
I have done as you suggested, and listed extensions and plug-ins installed and enabled in the 4 browsers:
Firefox
Extensions:
 Amazon Assistant for Firefox
 DuckDuckGo Plus
 Nectar Browser Add-on
 Trend Micro Password Manager
 Trend Micro Toolbar
Plug-Ins:
 OpenH264 Video Codec, Cisco Systems, Inc.
 WideVine Content Decryption Module, Google

Chrome
Extensions:
 Amazon Assistant for Chrome 10.1712.7.1200
 Better, Faster, Private Browsing 1.6.7
 Dropbox for Gmail 1.1.6
 DuckDuckGo Privacy Essentials 2018.3.2
 iCloud Bookmarks 2.1.2
 Trend Micro Password Manager 3.8.1029


IE11
Extensions:
 Send to OneNote
 OneNote Linked Notes
 Java Plug-In SSV Helper
 Java Plug-In 2 SSV Helper
 Trend Micro Security Toolbar ActiveX
 Trend Micro Security Toolbar 
 Trend Micro Security Toolbar Helper
 Password Manager BHO
 Password Manager Toolbar

Edge
Extensions:
 None

I have also disabled and then removed all extensions from Firefox (except for Trend Micro Toolbar, which I couldn't see how to remove), and in both states, TmsaInstance64 immediately went into ~50% CPU usage for approx 40 secs after Firefox startup, even with only Trend Micro Toolbar installed but disabled.

If you can reproduce any of these observations on one of your systems, I would be glad to hear of it. Meanwhile, I have gone back to using Chrome for my web browsing.

Regards,
Sam
(Edited)
Photo of Tom Emmelot

Tom Emmelot, Champion

  • 16,678 Points 10k badge 2x thumb
Hi Sam

Welcome to TM Home users Community, a public site where volunteers try to help each-other , also there are TM Employees that can give answers, that is only at working hours. I am just a volunteer!
May i suggest to reinstall Firefox.
Hope that helps.

Kind regards,
Tom
Photo of Sam

Sam

  • 384 Points 250 badge 2x thumb
Hi Tom,

Why didn't I think of that?

After "Have you rebooted your PC?", "Have you reinstalled the offending software?" is usually the next most popular support question.

I'll give it a go.

Regards
Sam
Photo of Sam

Sam

  • 384 Points 250 badge 2x thumb
BTW, may I ask whereabouts in the wide world you and TM support professionals work? That might give me a guide for when best to post questions or responses.
Photo of Tom Emmelot

Tom Emmelot, Champion

  • 16,678 Points 10k badge 2x thumb
Hi Sam

I cant speak for the TM Employees, i am just a TM tester/volunteer because i got the program on my first win 98 PC and liked it, started as a tester for PCillin was also tester of the first versions of Windows Defender. But test TM till now and support here and also give criticism and suggestions.
I live in Amsterdam Netherlands and 67 years old ;)
Good luck

Kind regards,
Tom
Photo of TM_Kaye

TM_Kaye, Employee

  • 2,330 Points 2k badge 2x thumb
Thank you for your suggestion Tom Emmelot!

Hello again Sam,

Thanks for looking into it. You may try to reinstall the Mozilla Firefox as advised by Tom. Then, reinstall the Trend Micro program on your computer. To do that, please follow the steps in the links below:

Step 1. Uninstall Using Trend Micro Diagnostic Toolkit
Step 2. Using the Trend Micro Permission Tool
Step 3. Installing Maximum Security

If the issue still persists, we might be escalating your case to our Level 2 engineers for us to gather some logs and further investigate the issue. 

By the way, the Trend Micro Technical Support Center is located in the Philippines. :)

Thank you for patience!

Trend Micro Home Users Community
Photo of Sam

Sam

  • 384 Points 250 badge 2x thumb
Hi again TM_Kaye and Tom,

Thanks again for your advice. Removing and reinstalling Firefox 64bit v58.0.2 appears to have fixed the problem - it's a pity I didn't think of it before.
 
With the TM Toolbar extension re-enabled, Firefox now starts without any discernible activity by TmsaInstance64.exe, just a little burst by coreServiceShell. All the other extensions I had installed on Firefox have gone, as I had removed them earlier for testing, and I am working on re-establishing them.

Please can either of you remind me how I can re-install TM Password Manager's extension for Firefox? I downloaded the Password Manager installer, but it stops, saying I have already installed it - I have the browser extensions installed on Chrome and IE11. Can you tell me how to work around this restriction for Firefox? I seem to remember that there is a way to invoke a prompt in the browser to install it, but I can't remember how to do that.

Regards
Sam
Photo of TM_Jean

TM_Jean, Employee

  • 3,000 Points 3k badge 2x thumb
Hi Sam!

It's good to know that the issue got resolved by reinstalling the Firefox browser. 

Regarding your concern on how to enable the extension on Firefox, kindly refer to the link below. 

Enabling browser extensions of Password Manager

However, if you already have done the steps in that link, it is possible that the Firefox you have reinstalled is the 64-bit browser. Please refer to the link below, instead. 

Enabling the Trend Micro Toolbar in Mozilla Firefox

Feel free to comment here if the issue is not resolved or if you have any other inquiries.

Trend Micro Home Users Community