Identifying CPU hog thread (not process)

[Forte Agent]

We have a process that consumes 100% of CPU time to time, practically
bringing our server down to halt. We know this process spawns many
threads. We are sure just one (or more) of threads goes crazy, taking
up 100% of CPU time to time. As far as we can tell, other threads run
normally.

We are wondering if there is a way to pin-point exactly what thread is
taking up CPU, and kill just that specific thread. Please let us know
if there is a way. Thank you in advance.

 

[David H. Lipman]

Here's a starting point ....

1) Download the following four items...

McAfee Stinger
http://vil.nai.com/vil/stinger/

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download Sysclean.com and place it in that directory.
Dowload the Trend Pattern File by obtaining the ZIP file.
For example; lpt242.zip

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) Update Adaware with the latest definitions.
3) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode
5) Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using the three
utilities; Trend Sysclean, Stinger and Adaware
7) If you are using WinME or WinXP, Re-enable System Restore and re-apply any
System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) If you are using WinME or WinXP, create a new Restore point

You can also try some of the below online scanners.

BitDefender:
http://www.bitdefender.com/scan/license.php

Computer Associates:
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

DialogueScience:
http://www.antivir.ru/english/www_av/

F-Secure:
http://support.f-secure.com/enu/home/ols.shtml

Freedom Online scanner:
http://www.freedom.net/viruscenter/index.html

Kaspersky:
http://www.kaspersky.com/de/scanforvirus

McAfee:
http://www.mcafee.com/myapps/mfs/default.asp

Panda:
http://www.pandasoftware.com/activescan/

RAV
http://www.ravantivirus.com/scan/

Symantec:
http://security.symantec.com/

Trend:
http://housecall.antivirus.com
http://housecall.trendmicro.com


* * * Please report your results ! * * *

Dave





|
| We have a process that consumes 100% of CPU time to time, practically
| bringing our server down to halt. We know this process spawns many
| threads. We are sure just one (or more) of threads goes crazy, taking
| up 100% of CPU time to time. As far as we can tell, other threads run
| normally.
|
| We are wondering if there is a way to pin-point exactly what thread is
| taking up CPU, and kill just that specific thread. Please let us know
| if there is a way. Thank you in advance.
|
|
|

 

[Matt Wagner [MSFT]]

Forte Agent:

Download PSTools from:
http://www.sysinternals.com/ntw2k/freeware/pstools.shtml

Extract these into a directory. Open cmd.exe and navigate to the
directory in which you extracted the tools.

For all processes and their threads, type:
pslist -d

For a specific process and it's threads type:
pslist -d <PID of Process>

--
Matt Wagner
Enterprise Engineering Center
Microsoft Corporation

Legal Disclaimer:
This posting is provided "AS IS" with no warranties, and confers no
rights. Use of included script samples are subject to the terms
specified at http://www.microsoft.com/info/cpyright.htm Please do not
send e-mail directly to this alias. This alias is for newsgroup purposes
only.