We have a domain controller running Server 2003, service pack 3 I'm pretty sure, that has the dnsvc virus/trojan service on it but the service has been disabled, and is still listed as such in the Services window, while our antivirus software provider figures out how to deal with it. I have set the virtual memory size to System Managed size but the OS keeps seizing up after a few days with 100% Page File useage. We get just the desktop with no icons but you can bring up the Task Manager and the System Idle process is running at 99%. I have been taking care of bang and red "X"s in the Event Viewer concerning DNS and DHCP misconfigurations also but this problem persists. Does anyone have any suggestions as to which way to look? Microsoft Security Essentials won't run on any of the Server products from what I can tell and when I downloaded the Malicious Software Removal Tool with the other current security updates it never showed anything when, as I understand its workings, when the system was rebooted. I thought MSR was supposed to do its check at reboot ... ? Thanks ahead of time for any thoughts coming my way.

On Thu, 20 Jan 2011 15:23:33 +0000, DanaKatWall wrote: We have a domain controller running Server 2003, service pack 3 I'm pretty sure, that has the dnsvc virus/trojan service on it but the service has been disabled If this were one of my DCs no question, I'd flatten it and rebuild it from scratch. Paul Adare MVP - Identity Lifecycle Manager http://www.identit.ca An elephant is a mouse with an operating system.

Oh, believe me, I am sooo tempted. I think this domain was set up by a committee. Very little makes sense but I don't have the time to start over from scratch.

On Thu, 20 Jan 2011 16:28:09 +0000, DanaKatWall wrote: Oh, believe me, I am sooo tempted.? I think this domain was set up by a committee.? Very little makes sense but I don't have the time to start over from scratch. I didn't mean the entire domain, I meant the DC that was infected. Surely you've got more than just a single DC? Paul Adare MVP - Identity Lifecycle Manager http://www.identit.ca Hackers have kernel knowledge.

LOL! Are you kidding? I inherited this. The principal won't spend the money for a good backup system and we have to work with what we have. AD, DNS and DHCP all run on the DC. I set up the original domain and then left for a little over a year as jobs have begun to fluctuate around here and am back now. This off-site campus now has a new server because the old one I'd set up was made to run in an UNairconditioned room all summer long because of this principal but, to its credit, didn't start loosing its primary drive until after the 3 year warranty was out (drives were mirrored). There are two other servers that probably could be promoted but finding the time to do it is the problem. This small campus is apart from the main one I, as part of the tech staff, take care of and the main campus is a full K-12 school that keeps us running. Any time we leave to take care of this other campus (and there's an office we also take care of as well but it's pretty stable) usually requires the better part of a day to finish up with. It did with me as no one was paying attention to the bang and red X marks in the Event Viewer but soully attending to the apparent virus problem.

On Thu, 20 Jan 2011 16:40:50 +0000, DanaKatWall wrote: LOL!? Are you kidding?? I inherited this.? The principal won't spend the money for a good backup system and we have to work with what we have.?AD, DNS and DHCP all run on the DC. Ahh, ok, then you have my complete and total sympathy. Unfortunately, I don't have any solutions for you. Paul Adare MVP - Identity Lifecycle Manager http://www.identit.ca And on the seventh day, He exited from append mode.

Thanks for letting me vent anyway!

Hi, First of all, please ensure that the computer is not infected with virus. You can refer to the following KB article: http://support.microsoft.com/kb/940831 If the virus is cleaned up but the performance issue persists, the following article could be helpful to troubleshoot the issue: http://blogs.technet.com/b/askperf/archive/2007/05/15/what-s-going-on-with-my-pagefile.aspx http://blogs.technet.com/b/askperf/archive/2007/01/26/processes-with-high-virtual-memory-at-startup.aspx Hope it helpsThis posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thanks for these! There seems to be a dearth of info on how to deal with PF problems and these are the first articles I've encountered that actually say something about it. Most Q&A posts end with no reply or something like it regarding this. I'll give the registry key a look as soon as I can get back to this campus.

Hi, If the articles do not help, we can collect the MPSReport for research: 1. Download the executable file from the following URL specific to the computer. http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd915706/MPSRPT_SETUPPerf.EXE http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd915706/MPSRPT_SetupPerf_Readme.txt 2. Double-click the executable to launch the report gathering tool. 3. After the tool finishes gathering the information, copy the cab file from the following folder: C:\WINDOWS\MPSReports\SETUPPerf\cab You can upload the file to the following space: https://sftasia.one.microsoft.com/choosetransfer.aspx?key=fb2e7cfc-af8a-4719-936b-b8e7394b344f Password: MI90^IBsAdIJ Meanwhile, I would like to confirm what you do to recover from the high PF usage?This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

The only thing we've been able to do in order to "fix" the PF usage problem is rebooting the server. This will last for 2 to 3 days before it has to be repeated again. Thanks for the references. As I said it may take a while to get back to the remote campus before we can try this.

Well, both the text and executeable file links wind up with a 404-page not found error. I'll search around for these files to see where else they may have moved them to.

Strange. I can download the executable file via the URL. Please try this link instead: http://www.microsoft.com/downloads/en/details.aspx?FamilyId=CEBF3C7C-7CA5-408F-88B7-F9C79B7306C0&displaylang=enThis posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Ok, this link, or this morning, it worked. Thanks.