Windows Server 2003 R2 Slow

August 15, 2011 at 23:23:11
Specs: Windows 2003 R2, Intel Core 2 Duo/2 GB Ram
Hi

I have a client that is running Windows Server 2003 R2 and is running extremely slow. The server was installed last year, but it gradually got slower and now it is unbearably slow. After troubleshooting I found that taskmgr.exe was using roughly about 50% of CPU usage (reason I say roughly is because it fluctuates between 48 and 52). After rebooting I see that explorer.exe used roughly 50% as well and then after another reboot, services.exe is using roughly 50% as well. So explorer.exe and services.exe alternate between using the other half of CPU usage, but after a long time only taskmgr.exe is left using 50%.

I have searched the internet for a solution but none of the stuff I found helped. Ok in safe mode it works fine and fast with no problems. I tried stopping services one by one until all where stopped and it was still slow. I scanned with Kaspersky and it came up with nothing. I had experience with viruses before so I looked in the registry for anything odd and couldn't find anything. Under startup there are only a few items and all of them I configured to startup. One forum said it was an update that caused the problem, so I left Automatic Updates running last night to see if that works.

Here is the log from HiJackThis

Logfile of HijackThis v1.99.1
Scan saved at 3:58:50 PM, on 8/11/2011
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Servers MP4\avp.exe
C:\WINDOWS\system32\Dfssvc.exe
C:\WINDOWS\System32\dns.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SuperFlexible\ExtremeVSS.exe
C:\Fitserver\FinconServer.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files\hMailServer\Bin\hMailServer.exe
C:\WINDOWS\System32\ismserv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\WINDOWS\system32\ntfrs.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Servers MP4\avp.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Servers MP4\avp.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\SuperFlexible\ExtremeSyncService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
C:\Program Files\SuperFlexible\SuperFlexibleSynchronizer.exe
C:\WINDOWS\SoftwareDistribution\Download\177240c79c5dc6b6883c8a81498fab11\update\update.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://iesetup.dll/hardAdmin.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://iesetup.dll/hardAdmin.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Servers MP4\avp.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [ExtremeSync Background Scheduler] "C:\Program Files\SuperFlexible\ExtremeSyncService.exe" /TIMERASAPP /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
O4 - Startup: Super Flexible File Synchronizer.lnk = C:\Program Files\SuperFlexible\SuperFlexibleSynchronizer.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O11 - Options group: [INTERNATIONAL] International
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows...
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Benju.local
O17 - HKLM\Software\..\Telephony: DomainName = Benju.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{98367F69-8B2B-491A-AEDC-41F211ABF2F1}: NameServer = 192.168.1.100
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Benju.local
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Servers MP4\avp.exe" -r (file missing)
O23 - Service: Extreme VSS Service (ExtremeVSSService) - Super Flexible Software Ltd. & Co. KG - C:\Program Files\SuperFlexible\ExtremeVSS.exe
O23 - Service: Fincon Server 5.90 (FinconServer) - Fincon Information Technologies (Pty) Ltd - C:\Fitserver\FinconServer.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - Unknown owner - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe" -s (file missing)
O23 - Service: hMailServer - hMailServer - C:\Program Files\hMailServer\Bin\hMailServer.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe

Any help on this would be GREATLY APPRECIATED Thanx.

P.S. I know I haven't run any anti-malware/spyware programs, the reason for this is 1. it is too slow to install anything (it took me 2 hours to install HiJackThis) and 2. I don't think it has malware/spyware (I could be wrong) because apart from the slowness there is nothing suspicious about it, every program works fine, registry has nothing odd (well to my knowledge) and I have clean out temp files etc. with no problem.

If you require any more info please let me know.


See More: Windows Server 2003 R2 Slow

Report •

#1
August 17, 2011 at 08:00:01
what processor and how many?
how much ram?
have you run chkdsk /f on the drive?
have you run disk defragmenter?
how much free space?
any red events in the event viewer logs?

If connected to the internet why wasn't AV and antimalware installed in the beginning?
If you disconnect the server from the internet does any speed come back or do you see a spike in a service/program cpu usage?

Are the clients pointing to the server for dns or the gateway?

Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's


Report •

#2
August 19, 2011 at 05:43:39
if you are running server 2003 SP2 check the NICs to see if they have TCP/IP overloading enabled. There are known (by microsoft and others) problems with this function of the NICs enabled.

Report •

#3
August 19, 2011 at 08:48:03
spock181 no mention of NAT being done on the server

Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's


Report •
Related Solutions


Ask Question