Its a white box they built before we became involved.

 

Dual Xeon 2.4g

1gb of ram

 

Plenty of disk space

 

Normaly uses maybe 3% of the proc. It is back down to that at the moment. That is the really wierd thing. It keeps fluctuating so much.

The main error/warning I am getting in the logs right now is 2012. PerfOS Unable to get system process information from the system. The status code returned is in the first DWORD in the Data section.

 

I have no clue what that means.

just a thought:

are there a lot of mails in exchange queue ? if exchange cannot find the correct route to deliver the mail it will try this several times thus the fluctuation in performance ?

found this on the 2012 error:
What's the data part in your case ?

Data=

0000: 9a 00 00 c0

Hi Shane,

 found another article on the error stating your 9a data code. This does not help yoy now, but the article mentioned Marina having worked on it. She the other M (in M&M).
I have to stop now (will have to go to work in 4 hours and haven't got any sleep yet )

maybe Mariëtte can ask Marina if she remembered the solution ?
regards,
pim

Thanks for the advice, everyone. I'm located in UK, so unfortunately I will not be able to make use of the security help desk. Does anyone know if MS has an equivalent service in UK?
I've noticed these events in my event log:
Event Type: Warning
Event Source: PerfOS
Event Category: None
Event ID: 2012
Date:  2005-02-07
Time:  10:03:06
User:  N/A
Computer: [snip]
Description:
Unable to get system process information from system. The status code returned is in the first DWORD in the Data section.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink­/events.asp.
Data: 0000: 9a 00 00 c0               š..À

This sort of explains why I can't see the processes that are running. I have problems even logging into the server now, sometimes the login just fails, sometimes it will succeed but I will not see any processes or items in the tray and will not be able to launch programs. Other times, I'll try and everything seems fine.

Other events in the event log point to a "lack of system resources" but the resource usage on my system hasn't really changed noticeably. All very strange behaviour, but still, perhaps I should persue other avenues before crying Wolf.
--Tim

Hi Shane,

 

Unfortunately we never got a reply on that thread, so I have no clue what was happening there. What 3rd party stuff are you running? Can you boot in safe mode?

I am starting to think we either got hacked or got a trojan or something.  When I left last night I had moved the Users Shared Folders back to C: and it seemed like everything had stabilized. This morning the Share is back on D: and now we have lost all of the installed licenses. The process utilization is down to normal levels but things are definately wierd.

 

Shane

Hi Shane,

 

Which ports are opened inbound? From a workstation open up the services on the server (local Control panel, Administration tools, Computer Management, Eventviewer, connect to server). Are there weird kind of services running?

Hi Marina, Thanks for your help.

I attempted to connect to the server the way you suggested but I do not have that option. I am not sure if I am missing something, but when I manage the workstation and go to event view, i dont see any way to connect to the server.

 

Also I am really not sure what ports are open. Probably alot more than should be. I have been trying to install ISA for the past few weeks but the client keeps putting me off until it is convienant for their business. I guess they are learning the hard way.

 

If I go to the server itselt and view running processes I dont notice anything unusual.

 

Oh by the way, it seems something has messed up the video card. I can only get 4bit colors and the resoloution stays 600x800 or lower.

 

Shane

Hi Shane,

From that workstation open Computermanagement. Right click on computer (local). You should have the option ''Connect to another  computer", assuming that workstation has joined the domain properly.