Solved

Infected  SBS 2003 server?

Posted on 2011-02-16
12
982 Views
Last Modified: 2012-05-11
I am monitoring an SBS 2003 Premium server which in saying the CPU is 33% to 80% busy while System Idle Process is constantly 87% to 95%.

The Server is protected by Symantec Endpoint and if it wasn't a server I would run Combofix.

Any ideas?
0
Comment
Question by:mikeabc27
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 4
12 Comments
 

Author Comment

by:mikeabc27
ID: 34908952
Sorry I meant to add Show processes from all users is ticked.
0
 
LVL 2

Expert Comment

by:treetop3
ID: 34909036
Hi,

Although it may appear to users that their CPU is being monopolized by the idle process, it is merely acting as a sort of placeholder during "free time" (therefore, whenever the idle process appears to be consuming most of the CPU, it is proof that no other process wants that CPU time)

In other words when this process is consuming the CPU there are no other processes looking to use the CPU, the CPU is Idle and free.

Is the Server Slow ?
0
 

Author Comment

by:mikeabc27
ID: 34909099
Yes, it feels like more than 60% of cpu being used. Slow to save and just got msg Disk is Full.

I was just surprised that CPU Usage doesn't equal System Idle minus running processes.
0
Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

 
LVL 2

Expert Comment

by:treetop3
ID: 34909124
Clear out the disk to free up space with tresizer and atfcleaner this will improve speed as the page file is filling up
0
 

Author Comment

by:mikeabc27
ID: 34909231
101GB showing as free and available, so I checked the quotas and 2 were on 99.9% full but no warning received. I've increased these from 1GB to 5GB and the CPU is running at 1% to 4%
0
 
LVL 96

Expert Comment

by:Lee W, MVP
ID: 34909236
Last time I say something like that, the system was suffering from a high hardware interrupt rate - found this using Process Explorer.  Is this a proper server or a home built system acting like a server?

Do cleanup the C: drive - for 20+ things you can do, see http://www.lwcomputing.com/tips/static/bootdrivesize.asp
0
 

Author Comment

by:mikeabc27
ID: 34914163
Checked remotely this and CPU usage still at 20% to 40% while System Idel around 2% to 10% - no indication of why the CPU is so busy.

I built the server myself around 7 years ago and it started life with an Adaptec 3920 and 2 x 53GB SCSIs, high end (workstation) motherboard and P4 cpu. When the Adaptec died I switched the disks for a 250GB SATA, They have to replace this in the next 6 months, I'm just trying to get it to last a little longer.

I'll check out the article.
0
 
LVL 2

Expert Comment

by:treetop3
ID: 34914722
Do you have a VirusScan or some sort of indexing software or Shadow Copy enabled
0
 

Author Comment

by:mikeabc27
ID: 34914998
I have had to stop the disk cleam up as no-one can connect to server. Will do over the weekend.

treetop -Using Symantec Enfdpoint on the server but cannot see any processes using excess CPU power. What I do not get is CPU usage - 40% I would expect = System Idle + running process = 60%. but I am getting - system idle = 92% and other processes 4%, as if CPU usage was only 96%.

When the CPU usage read 40% it feels like it.
 
0
 
LVL 2

Expert Comment

by:treetop3
ID: 34917463
Do you have the relevant exclusions set for Symantec

System Idle is only run once nothing else is running and the CPU is Idle
0
 

Accepted Solution

by:
mikeabc27 earned 0 total points
ID: 34969456
Sorry for delay in reply. Certain scheduled programs were causing problems and when these were rescheduled it resolved the problem.
0
 

Author Closing Comment

by:mikeabc27
ID: 35106974
resolved myself
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question