CPU usage fluctuates ?

[vrcatherine]

We have a windows 2000 server , and when i check
the CPU usage it fluctuates randomly.

1% ==> 23%==>5%==>45%==>12%


Everything was fine expect when we installed Norton antivirus
and it detected some virus files (winlogon.exe and some other files) when i checked the fixes for that at symantec.com they say we have remove some registry files and delete the infected files. I am afraid to do that as they are widows files. I'm not sure as that is the one which is causing the CPU usage fluctuation.



Even when the system is idle i can see a cpu usage of 12-15%.


Any help will be appreciated.



--Thanks
Cathy

 

[NortonES2]

Which processes are using the CPU?

-------------------------------

If it doesn't leak oil it must be empty!!

 

[vrcatherine]

I have lot of process running which i am not sure
what they are for , except 1 database process.

AWHOST32.EXE
BENETNS.EXE
BENGINE.EXE
BENSER.EXE
BENTOAGT.EXE
BEREMOTE.EXE
BESERVER.EXE
CSRCSS.EXE X 3
DLL.HOST
EXPLORER.EXE X 3
LLSSRV.EXE
LSASS.EXE
SVCHOST.EXE X 4
WINLOGON.EXE X 4
YMSGR_TRAY.EXE

 

[NortonES2]

This server is running Backup Exec, if you use this for backups you are strongly advised by Veritas to disable any Virus scanning software.

Also you should check what file are in:

c:\windows\system32\wins

-------------------------------

If it doesn't leak oil it must be empty!!

 

[vrcatherine]

Yeh i have Veritas Backup 9.0 for windows server installed on that server ?

But if i disable that virus scan how can it be protected form virus files ?


--Cathy

 

[GESwihart]

Hi Cathy -
You can choose to have Veritas stop your Virus Scan right before the backup starts and then start it right after the backup is finished. I have a batch file setup to stop ours and start them. Under the properties of the backup job that you have set up there is a place to tell Veritas what command you want run right before the backup begins and right after the backup ends. Hope that helps.

 

[trusted]

vrcatherine

What exactly does this server do? What size processor does it have? How much ram is install?

Having a server that has 12-15% processor usage on some networks is nothing to worry about. It's when it starts hang around the 50% and above that you really need to look at upgrading the system.

 

[vrcatherine]

SERVER:

Dual Xeon 2.8ghz processor,1.5GB RAM, 40GB x 2 Hot swap Hard Disks.

It has a Ftp server on it, and the thing is even after i reboot the system , with no users connected and not much activity it show as 12%-15%-26% CPU usage.

I guess it was hit with some SQL slammer worm virus and i had seen the recommendations as what can be done.


They say we have to upgrade or apply service packs for the SQL server or the MSDE (microsoft desktop engine). So where are these really used in my server. SQL server isnt there in that server.

SO i was checking the Veritas support site and i gues they use the MSDE or SQL server ( I am not sure). Even after applying the patch it still shows the CPU usage 12-15-23% after the reboot when no one is really logged in.


I ran the FixSQLex for the slammer worm and it gave me this log:

====================================================
C:\program files\microsoft sql server\mssql$bkupexec\binn\backup\0686\ssnetlib.dll is vulnerable!!!
C:\program files\microsoft sql server\mssql$bkupexec\binn\ssnetlib.dll is not vulnerable!!!
W32.SQLExp.Worm was not located in memory.

A vulnerable version of ssnetlib.dll was detected on your computer.
You should download and install the Microsoft patch from the following URL:

http://www.microsoft.com/technet/security/bulletin/MS02-061.asp

After installing the patch, reboot your computer and run the tool again.
======================================================



Any ideas !!!!!!!!!!!!!!!!!!!!!


---thanks
Cathy

 

[vrcatherine]

After applying this patch , a week or so I see that the
server takes too much time to reboot.


During reboot , it takes too much time

"Applying computer settings"
"applying personal settings"

During the above 2 screens it takes atleast 15 minutes .

Once it comes to the desktop it throws this error.

RUNDLL
Error loading c:\winnt\image.dll
The specified module could not be found

Any ideas as why this happening ??

--Thanks
Cathy