"System Process consuming 95 - 100 % CPU

Windows 2000 Server SP4
SQL server SP3
2 seperate applications accessing SQL server
Problem; The "system" process is consuming 95 - 100% of the cpu
If I reboot the computer and let it start SQL server automatically it is fine for a while and then something occurs that I can not trace to make the CPU usage jump from the usual 12 -15% to 95-100% and it is the system process that is the hog any ideas what I can check for?

Thanks
KLCGEAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Fatal_ExceptionSystems EngineerCommented:
Systernals Process Explorer may help you with this mystery...

Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns each process.

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
jvuzCommented:
Do a check with adaware or Spybot.
jvuzCommented:
SpyBot-S&D


SpyBot-S&D is an adware and spyware detection and removal tool. This includes removal of certain advertising components, that may gather statistics as well as detection of various keylogging and other spy utilities. In addition, it also securely removes PC and Internet usage tracks, including browser history, temporary pages, cookies (with option to keep selected) and more. The program offers an attractive outlook-style interface that is easy to use and multi-lingual. SpyBot-S&D allows you to exclude selected cookies, programs or extensions from being reported, allowing you to prevent false positive messages for items that you dont want to be alerted of every time. It can even scan your download directory for files that have been downloaded, but not yet installed, allowing you to detect unwanted programs before you even install them. SpyBot produces a detailed and easy to understand report before it deletes any files and allows you to deselect any item that you do not want to be processed. In addition, a recovery feature allows you to restore your settings if needed. Very nice tool, that exceeds the capabilities of the popular Ad-Aware application.


http://www.webattack.com/download/dlspybot.shtml


Ad-aware


AdAware is a privacy tool, that scans your memory, registry, hard, removable and optical drives for known data-mining, aggressive advertising, and tracking components. It then lists the results and offers to remove or quarantine the components. The program detects a wide range of adware/spyware related issues and can be updated with the latest signatures via the built-in update utility. Please be advised that removing certain components may impact the functionality of effected software applications. You should fully read the included Ad-aware documentation before removing any files!


http://www.webattack.com/download/dladaware.shtml


HijackThis


HijackThis is a tool, that lists all installed browser add-on, buttons, starup items and allows you to inspect them, and optionally remove selected items. The program can create a backup of your original settings and also ignore selected items. Additional features include a simple list of all startup items, default start page, online updates and more. Intended for advanced users.


http://www.webattack.com/download/dlhijackthis.shtml
The 7 Worst Nightmares of a Sysadmin

Fear not! To defend your business’ IT systems we’re going to shine a light on the seven most sinister terrors that haunt sysadmins. That way you can be sure there’s nothing in your stack waiting to go bump in the night.

oBdACommented:
If you installed the April security hotfixes, especially 835732, and thge problem started afterwards, then this is probably be the cause. There seem to be some issues concerning the KB 835732 hotfix. On W2k in certain configurations, it's high CPU usage of the system process, on Server 2k3, it disables IE's encryption, and it seems to mess up some NT4 installations as well.
Here's a description about how to best remove it:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=%23IOM%23EzIEHA.3476%40TK2MSFTNGP11.phx.gbl
or another possibility:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=1d1d201c42315%2448f9c3b0%24a501280a%40phx.gbl&rnum=2

If it doesn't work, google groups for "835732" and "CPU usage" or "835732" and "realtime".
Here are the important parts of the articles above, just in case:

====8<----[MICROSOFT IS LOOKING at the KB 835732 issue now]----
To unistall it, I did the following
(1) Boot into Safe mode.
(2) Run TaskManager - and noticed that the SYSTEM process
was using 99% of the CPU time.
(3) From TaskManager set the Priority of the EXPLORER
process to REALTIME, so that I can get to the control
panel.
(4) Run ADD/REMOVE PROGRAM from control panel.
(5) Go back to TaskManager and set the Priority of
MSHTA.exe to REALTIME, so that the ADD/REMOVE PROGRAM can
get some CPU time.
(6) Select and Remove "Windows 2000 Hotfix  - KB835732".
(7) Go back to TaskManager and set the Priority
of "SPUNIST.exe" to REALTIME, for the uninstall program to
run.
(8) Wait a few minutes, and the uninstall program will
eventually ask you to click FINISH to reboot the machine.
It took a long time for the system to shutdown and I just
unplugged the power.
(9) The machine should become normal after reboot.
====8<----[MICROSOFT IS LOOKING at the KB 835732 issue now]----

====8<----[HELP...ME TOO! my machine is doing the exact same thing...]----
I found this solution below,  and it worked great.
Boot into SAFE MODE (no networking or no command prompt).
Go to: Control Panel --> Add / Remove Programs
UNINSTALL Windows Hotfix KB 835732
Reboot...

There's some additional tricks to this that you can use:

1) Instead of using add\remove programs,  run CMD and type
in:
%systemroot%\$Ntuninstallkb835732$\spuninst\spuninst.exe

or
2) if you can get to the desktop,  go to task manager.  
Give the explorer process Realtime priority.  Then go to
the command prompt and follow step #1.  Once you start up
the spuninst.exe program,  go into task manager and give
it Realtime priority as well.
====8<----[HELP...ME TOO! my machine is doing the exact same thing...]----
Fatal_ExceptionSystems EngineerCommented:
Glad it worked for you..  Sysinternals is a great place for these utilities..

and Thanks

FE
javeed_ccnaCommented:

Tell me what is a Sysinternals ?? is it a tool ? i want to use it how to use
Fatal_ExceptionSystems EngineerCommented:
javeed..  once these are closed, it is best to open a new thread and ask..

But, Sysinternals produces a suite of utilities (free).  these can be downloaded and run directly on your computer(s).  Here is the link for the list they have available.

http://www.sysinternals.com/ntw2k/utilities.shtml
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 2000

From novice to tech pro — start learning today.