Intermitent High CPU Usage by small .exe

Hi everybody

I ran Server 03 / SP2 with Active Directory on a Pentium III Acer PC using an old IDE HardDisk for years without problems. A particular small .exe 20k runs with zero CPU usage on this configuration.

Recently I replaced the old HDisk with a new HDisk, then install Server 03 /SP2 with Active Dir on the same PC. Now the same small .exe hogs the CPU with 100% usage, 9 out of 10 times it is loaded.

Also when accessing a workstation as Administrator (Domain), from the Server, workstation username & password are required before access is allowed. No such additional step was required in the old config.

What is the most likely causes? I read Reggie's note on DHCP, could this be the cause? I think both new & old setup are similar so this adds to my frustration of being unable to pin point the cause. Please HELP!!

 

Small.exe is either an old Virus first found in 1992.

Or a utilities suite called small utilities.

In taskmgr kill the process small.exe.

Then I would search for and delete small.exe it should not be on a server.

May have to remove it in Safe mode.

A good virus scanner should find such an old virus easily.

Mike

 

Thank you both of you

1) The name of the small 49k .exe file is sllp2ks.exe; which is loaded before running a foxpro database accounting program. Its function is to copyright protect by security check via a dongle attached to LPT1.

2) Sorry for placing the word "small " to near the ".exe "; "small" literally means small in size .. yet hogs the CPU.

3) Further i need to keep sllp2k.exe running for users to log on to the accounting program.

Thanks again

 

Oh!

Well that sure figures! A copy protection scheme. They always cause problems.

I think you are up the creek unless your software vendor has help.

I goggled sllp2k.exe and there is no info on it.

One thing tho, is this app being run from Terminal service clients? If so does it slow down more as more clients log on?

Or does it start out maxing the cpu on boot with no users connected?

If so after a boot kill the process and restart it manually and see if cpu usage changes. If so it may be the load order.

Mike

 

Thanks Mike
High CPU usage even there is no terminal user, just on server loading it 100% usage.
Once it is killed in server, CPU usage of server goes back to zero.

 

This is unacceptable on any computer especially a server!

You need to contact the vendor, perhaps they are aware of this issue and have a fix for it. Maybe a patch or newer version.

Other than that the only solution I can think of is a process throttling ap like
Process lasso http://www.bitsum.com/prolasso.php.

This is an excellent and mature program that should not be needed at all but in some cases is the only answer.

I don't like this solution especially on a server.

Try the Vendor for the program first!!

Mike

 

Thanks Mike
I just contacted the vendor, they are looking for in any a new sllp2ks.exe. The funny thing remains is: why there is no such issue on my old harddisk. I believe all files & configuration are the exactly the same under a fully protected system in terms of virus, worm & spyware.
Anyway I think will do a number of tinkering to find the solution eg relook at the registry, setting the related services to manual, checking that all related folders & files are fully controlled by SYSTEM, USERS & EVERB.O.DY, try on older OS - Server 2k/sp4, etc, etc.
Will let u know if i am in luck. Cheers!! Michael

 

Oh I just reread your 1st post!

So it did run OK an another OS version!

OK a couple of things to look into.

1. Do properties on this program. If Compatability is offered set it to the next lower OS, XP, if no go then to Win2k on down to win95 until you find one that works or not.
You should reboot between all changes.

2. Update the Device driver for the HASP or what ever Device you have on the LPT port.

Hope this helps.

Mike

 

Hi Mike

Still some miscommunication!
Yr wrote "So it did run OK an another OS version!" - Not really true, it was the same hardware, same OS Server 03 SP2, same version accounting package; only difference are 1) different hard disk or 2) some installation or configuration differences that I might have unawarely done differently. Anymore ideas???

On yr suggestions: 1) Already tried Compatability options before I posted this problem 2) the driver that worked on the old configuration is sllp2ks.exe

Meanwhile the vendor told me there is a new version of sllp2ks.exe designed specially for Server03; when it works i put a PERIOD on this part of this thread.

Meanwhile i really hope that you can throw some light on 2nd part of this thread namely "Also when accessing a workstation as Administrator (Domain), from the Server, workstation username & password are required before access is allowed. No such additional step was required in the old config. "

Hope to hear from you again. Cheers!!

 

The Vendor is working on it huh! I've heard that before, if they say a month count that as year in your time. Don't wait on them untill you have exhausted all else.

Make a new thread for the Logon issue it is a nuisance compared to this.

I will try to look at it later if no one else gets to it.

As for this issue a "Server" running at 100% CPU is a real problem?

If you think a temp or registry entry or DNS cache would not cause this think again.

I advise you to do the following!

The following should be done after hours or with all users off the system!

I know you can not run without a firewall but have you truned off the Windows or other software firewall and rebooted to see if it is the problem?

Have you looked in the event logs.

Clear the event logs (backup/save the logs if you want) once they are clear immediately reboot and then go straight to the event logs.

The events now should only have events thru shutdown and restart. Do you have any errors seeminly related to this or not.

Do a System Restore point.

Add a redundent Reg backup get and install ERUNT let it add itself to startup and do a backup on install check all boxes.

ERUNT http://www.larshederer.homepage.t-online.de/erunt/

Next lets do some cleanups:

Download and run DiskCleaner http://www.diskcleaner.nl/download.php

also ATF-Cleaner http://www.atribune.org/index.php?option=com_content&task=view&id=25&Itemid=25
Run repeatedly untill no items found.

CCleaner get the Slim version: http://www.ccleaner.com/download/builds
Run both temp and registry clean run both temp and Registry repeatedly untill they come up clean.

Reboot once again and recheck.

If no still joy do the following and reboot.

Do this from the command line not from run, you can copy and paste these lines. Depending on your setup you will likely get errors this is ok for now.

Netsh WinSock Reset

ipconfig /flushdns

ipconfig /registerdns

nbtstat -RR (yes use Capital R's)

netsh interface ip delete arpcache

Now reboot and test

Mike

 

Thanks Mike
Great & small minds think alike, just contemplating to put the login problem on another thread. Will do this within the next few days after checking a few things. I will further clarify this issue which i believe is quite a common nuisance in the sense that u can't find the specific cause.. i always like to thank Ms to such pain.

Meanwhile i got from the vendor a new sllp... that is designed specially for server 03. Will keep you posted on the result. Meanwhile let me digest what u have written & see to march on.

Meanwhile really feelling good knowing u follow through all the way.

 

May not need my procedure if new sllp2k works.

I would do the cleanups and ERUNT!

I apologize for telling you to do a System Restore point. But System Restore is not available in 2003.

I always add it to my 2003 servers and forgot it is not installed as default.

To add System Restore to Server 2003

http://www.windowsreference.com/windows-2003/how-to-installenable-system-restore-on-win-server-2003/

Let me kow the results of all this.

Mike

 

PERIOD: 100% now to 0% Explain.

Hi Mike

The problem is due to improper usage of the Service "sllProNt_dr ". The correct way is to use automatic start up of this service which will automatically call up SLLP2KS.EXE. Though the tinkering process i start to understand the workings of this service.

The vendor had in the past though its downline given instruction steps with insufficient explaination of what's happening and what to expect.

Their old way which is not efficient is to use the service manually & run SLLP2KS.exe via the startup menu causing unstable CPU usage when SLLP2KS is toggle on/off during switching of users.

By the way the Vendor did sent me a new file for sllp.. but did not work at all with my much older dongle.

That's it. Thanks.

 

Resolved

Fantastical!

Hope you considered the Cleanups and ERUNT and Sys Restore in my posts # 11 and 13.

Good luck!

Mike

 

Ps

Cheers Mike
Already using ERUNT for many years, will consider your proposal on cleanup. I will post my login issue on the new thread soon. See u there. Bye & Kind Regards.

 

Problem Remains Unresolved

Dear mflynn . Mike
I am very upset to say that the hogging remains totally unresolved, my latest tinkering continues to show that sllp...exe whether run from services or manual startup remains to hog 100% except on the old configuration ... WHY??.
I have tried all the cleanups and run all your cmd lines to no avail.
I am totally LOSS.....

 

Sorry to hear that! Thought it was confirmed fixed.

Is this also a terminal server? If so how many are connecting from remote?

OK as an experiment unless you are sure!

Once it boots up at 100% use Taskmgr to kill it then manually restart it.

Does it immediately go back to 100%, do it later, or run normally if started like this?

OK paste the following 3 lines 1 line at a time to the CMD prompt then paste me the contents of the files it puts on the desktop.

%SystemRoot%\system32\cmd.exe /c %windir%\system32\sc query type= driver > "%USERPROFILE% "\Desktop\DvrQuery.txt

%SystemRoot%\system32\cmd.exe /c %windir%\system32\sc query type= service > "%USERPROFILE% "\Desktop\ScQuery.txt

%SystemRoot%\system32\cmd.exe /c %windir%\system32\tasklist.exe /svc > "%USERPROFILE% "\Desktop\Tasklist.txt

Download Startup Control panel
http://www.mlin.net/StartupCPL.shtml

Run it, find this program. Let me know under which entry is is starting, HKLM etc.

Finally after all above is done not before run Taskmgr find the process in the list Rt click go to bottom chose set priority, tell me what it is set at then 1st choose BelowNormal and recheck if some or no improvement then choose Low.

After changing this setting confirm you client computers can still run their app OK!

Mike

 

FINAL PERIOD: Backdoor solution

Hi mflynn Mike

Good news, I use the new .exe program given by the vendor, then use the old registry setup (ie i did not use the new registry setup recommended by the vendor that came with the new .exe); voila it works perfectly.

The premature Period, was due to the fact that if in the network some other PC is running the old .exe, then there is no hogging. Regretfully! Life gets so complicated with the fast changes in the world.

As to your question "Once it boots up at 100% use Taskmgr to kill it then manually restart it. Does it immediately go back to 100%, do it later, or run normally if started like this?" ... the answer is it does using the old .exe.

I will try your other suggestion to tinker more. Much appreciation all your effort, Thanks again & hope to see u again.

 

In the future what I would do in this case is grab Process Explorer from SysInternals (free), and when your app is running at 100% CPU, double click it in process explorer, goto the threads tab and sort by CPU utilization. Select the thread in question, click Stack, and paste that in here. That will often have some very useful info.