Iexplore.exe and System process hogging CPU

[bierlyt]

This is the strangest thing. For the last couple of days, every time
Internet Explorer is opened, the System process (No, it is not the
System Idle Process, it is the System process) will take up 30-40% of
the CPU while the Iexplore.exe process takes up another 40%. It
doesn't completely bog down the system if just one or two Internet
Explorer's are open, but it does start to really affect it with more
IE's open.

I should mention that this is on the main Terminal Server at work with
about 30 users logged on. The server is still running Windows 2000.

I just rebooted the server after work. With only myself logged on and
nothing else extra running, I opened Process Explorer (from
Sysinternals) and watched while I opened Internet Explorer, waited 10
seconds, and then closed it. While IE was open, IE was showing taking
up about 45% CPU and System process another 35%. There was still a
little bit taken up by other processes and some left for the System
Idle Process. As soon as I closed IE the System Idle Process went back
up to 99%.

As soon as I opened IE again, same thing happens. Although I also
noticed that as soon as the home page was fully loaded, the System Idle
Process went back to 99% again. As soon as I click on a link it goes
back up again until the next page is fully loaded.

I do notice that if I right-click and go to Properties for both the
System process and the Iexplore.exe that is taking up the CPU, both of
them under the Performance tab have a HUGE number of "Other" I/O
operations, as in over 500,000 every time I click a link and load a new
page.

I cannot seem to detect any traces of spyware or viruses. I update
Symantec virus defs daily on all our computers. It is just this one
server, which happens to be the main computer that most of the people
in the office use, that is showing this problem.

It seemed to all start a few days ago about the same time as when one
of the accounting ladies tried to print something off the web (that she
prints all the time) and the server locked up. We had to reboot the
server, and when she tried to print again, the same thing happened.
The issue described above definitely has been happening before then,
but it's very possible it could have been happening before over the
weekend and could be totally unrelated.

I have tried looking at as much information using Process Explorer and
Process Monitor that I can. I did notice that in Process Monitor,
where I did about a 5 second capture during which I opened and closed
IE, that there were a couple hundred thousand file operations reported,
and a great majority of them were the following file operations
repeated endlessly over and over again, and performed against C:\

CreateFile
QueryBasicInformationFile
QueryAttributeInformationVolume
CloseFile

If anyone has any ideas, I'd be grateful. Any other helful utilities?
How else to diagnose it?

Thanks,
Toby

 

[bierlyt]

I'm bumping this up to the top again since it's been two days. Please
let me know if there is a better group to address this question to.

Thanks,
Toby

 

[Bob I]

have you been using Windows search? somtimes that gets the CPU pegged.

 

[bierlyt]

No, I don't think it has anything to Windows search. As I explained in
my original post, immediately after a server reboot when I was the only
person logged in on the terminal server, I simply opened Internet
Explorer and watched the Iexplore.exe process and the System process
both spike up in CPU usage until the home page was loaded.

It is definitely related to Internet Explorer and happens whenever IE
is trying to load a page. I'm considering trying to download IE6 again
and see if installing it over the top of the current IE installation
yields any results. Or perhaps it's time to call Microsoft for a paid
tech support call. I really don't want to spend the entire weekend
reformatting, reinstalling, and reconfiguring the server. That would
be a massive undertaking.

I would greatly appreciate any more suggestions.

Thanks,
Toby

 

[Stacy]

I've recently run across this and found the problem to be with the Java
Scripting feature being enabled. If you go in to Internet Explorer | Tools
| Internet Options | Security | Custom Level, and scroll all the way to the
bottom, you'll see the "Scripting of Java applets" - set it to either
Disable or Prompt and the problem goes away.

Sorta odd, but it works. I've been told to update java using the on-line
installation, but it didn't help in my case, so I left my setting to
"Prompt" and am happy for now anyway!

Thanks,
Stacy

 

[bierlyt]

Stacy,

Can you describe in more detail the problems you were having. I tried
changing the "Scripting of Java applets" setting and it didn't change
anything. I was curious how close your symptoms were to mine.

Thanks,
Toby

 

[Stacy]

Toby,

The symptoms I was having were 50%-70% CPU utilization by "SYSTEM" (not
system idle process) when IE 7 was open. Close IE 7 and everything went
back to normal (98% CPU in system idle process).

Sorry if I read something into your posting that wasn't. Rarely do I answer
posts in forums - perhaps I should have held my tongue this time too.

If, on the off chance, this sounds like it might help you, I can provide a
bit more information about the "resolutions" I found.

Thanks,
Stacy

 

[bierlyt]

No, definitely you should post. Thank you for your post. That it
pretty close to what I had happening.

I finally figured it out, after a $245 call to Microsoft. We narrowed
down what the problem was by first booting into Safe Mode with
Networking. The problem didn't occur there. Using MsConfig, we
disabled all non-Microsoft items on the Services and Startup tabs, and
then booted into Normal mode.

Everything was fine there, so we kept re-enabling Services until we
got to Symantec AntiVirus. When we enabled it and rebooted, the
problem occurred.

So now I have to wait for Symantec's tech support hours to chat with
them and get this figured out. At least I know what program is
causing the issue.

Thanks to everyone that responded,
Toby