Process - System 95+%

[stunpals]

THis is an NT 4 Server SP6a, today the system process has been totally hogging the CPU, I rebooted it and it started out around 20-25% of the CPU, within 10min it was in the high 90's again. But it does drop every so often down to low 20's.

I have Trend Antivirus that is up to date and its not picking up anything.

I have started to shutdown any other services not needed to see if i can find the cause...

Is there anyway to determine what is causing the System Process to jump like this.

 

[stunpals]

Before I rebooted the server it was responing to a ping but no one could connect through the unc.

 

[stunpals]

I have been working with Trend Micro to make sure its not a virus and during this it seems when the Antivirus software Server Protect (SP) v5.56 is not running the CPU usage is normal. I have uninstalled SP and the server sat for over 45min with normal usage then as soon as SP is installed the CPU starts to climb.



I have ran a full scan on the system with updated antivirus software and its coming up clean. I’m about to format reinstall the server, I have just completed some 3rd lev support debugging and waiting for Trends response. Any one out there have an idea or similar problem.??

 

[SamirSolaris]

There could be some files (exes, dlls) which has got corrupt.
When u do an uninstall, I guess the files/folders are not being deleted completely and while re-installing, the same file may not be overwritten.
Before formatting, please try to do this

Uninstall the software
Delete the folder where software was installed. Genrally, I guess should be C:\Program Files
If possible, clean the registry with a utility like regclean from NT resource kit. If not available, goto registry editor and delete search for entries of that particular antivirus and delete all such entries.
Reinstall antivirus. This time, install it in another folder, if possible another drive.

Let us Know.

 

[SamirSolaris]

A small correction in the above post, Generally the software should create a sub-folder in C:\Program Files. Delete that subfolder. Please never try to dlete C:\Program files.........

 

[stunpals]

I had a Trend support person try this and as i'm doing the search/delete in the registry there is so far one key i can not delete
HKLM-system-controlset001-Enum-Root-legacy_spntsvc

this is the process that even after stopping the SP serice would still be running. The Trend support person even went into the regedt32 to set permissions to delete this key and had no luck.

 

[stunpals]

After re applying the permissions i was able to delete all related keys/entries. I reinstalled as you suggested even on another drive and up until the software was installed approx 1hr the CPU usage was normal, right after the install completed the CPU (system process) started to jump and within 5 min it is at 97%.

I am waiting to hear back from the Lev 3 Trend support today, unless they or someone else has another idea it starting to look like a format reinstall of this server.