Microsoft KB Archive/941756

= On a file server that is running Windows Server 2003, CPU utilization for the System process increases to 100 percent =

Article ID: 941756

Article Last Modified on 10/11/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Standard x64 Edition
 * Microsoft Windows Server 2003, Enterprise x64 Edition
 * Microsoft Windows Server 2003, Datacenter x64 Edition

-



SYMPTOMS
Consider the following scenario. You have a file server that is running Windows Server 2003. Some clients that have Trend Micro OfficeScan installed connect to this file server. In this scenario, the following symptoms may occur on the file server:  CPU utilization for the System process increases to 100 percent. If you disconnect the file server's network adapter, CPU utilization decreases to the standard level. If you use the Network Monitor tool to trace network traffic, you discover that many packets that are sent from the file server contain a &quot;STATUS_NO_SUCH_FILE&quot; error message. For example, these packets contain an error message that resembles the following:

172.31.28.228 SMB SMB: R; Transact2, Open2 - NT Status: System - Error, Code = (15) STATUS_NO_SUCH_FILE

 If you run Process Explorer, you see that the Srv.sys file has a continuous instance that uses excessive system resources.

To download Process Explorer, visit the following Microsoft Web site:

http://www.microsoft.com/technet/sysinternals/default.mspx





CAUSE
The problem is caused by the Pccntmon.exe file on the client. If you have Trend Micro OfficeScan installed, the operating system queries for the files in folders that do not exist. The Pccntmon.exe file is located in the following folder on the client:



Note The  placeholder represents the drive on which the operating system is installed.



RESOLUTION
To update OfficeScan, contact Trend Micro.

For information about how to contact Trend Micro, click the appropriate article number in the following list to view the article in the Microsoft Knowledge Base:

65416 Hardware and software vendor contact information, A-K

60781 Hardware and software vendor contact information, L-P

60782 Hardware and software vendor contact information, Q-Z

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.



WORKAROUND
If you cannot immediately obtain the update for Trend Micro OfficeScan, work around this problem by disabling an option in the Trend Micro OfficeScan Management Web Console. To do this, follow these steps:
 * 1) In the Trend Micro OfficeScan Management Web Console, click Network Clients, and then click Global Client Settings.
 * 2) In the Alert Settings section, click to clear the Show the alert icon on the Windows taskbar if the virus pattern file is not updated after XX day(s) check box. This operation turns off the process that constantly searches for updates every time that a connection is made to a remote source.



MORE INFORMATION
The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

Keywords: kbtshoot kbprb kbexpertiseinter KB941756

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.