How to find out source of dllhost.exe

[Rollin 4 Eva]

I've got a Windows 2000 server running with about 50 websites on it, all
running ASP scripts. I've noticed that the servers CPU usage gets up 100%
sometimes, caused by dllhost.exe, which I'm certain is a hanging ASP script
somewhere on the box. Probably an on error resume next line that doesn't go
anywhere when an error is an encountered. Anyways, I'm not sure if there's
a way to isolate the website where its originating, or even the page this
problem is originating from. Is there a way to do this? Any help would be
appreciated, as this problem is slowing down the server for everyone. TIA
for any help/advice.

Rollin

[Tom Kaminski [MVP]]

"Rollin 4 Eva" <te**@test.co m> wrote in message
news:o_******** ************@gi ganews.com...

I've got a Windows 2000 server running with about 50 websites on it, all
running ASP scripts. I've noticed that the servers CPU usage gets up 100%
sometimes, caused by dllhost.exe, which I'm certain is a hanging ASP script somewhere on the box. Probably an on error resume next line that doesn't go anywhere when an error is an encountered. Anyways, I'm not sure if there's a way to isolate the website where its originating, or even the page this
problem is originating from. Is there a way to do this? Any help would be appreciated, as this problem is slowing down the server for everyone. TIA
for any help/advice.

Go into Component Services MMC. Click the "Status View" button in COM+. It
will show you the PID for each DllHost process.

--
Tom Kaminski IIS MVP
http://www.iistoolshed.com/ - tools, scripts, and utilities for running IIS
http://mvp.support.microsoft.com/
http://www.microsoft.com/windowsserv...y/centers/iis/

[Aaron Bertrand - MVP]

> Probably an on error resume next line that doesn't go

anywhere when an error is an encountered.
No, that wouldn't cause it... on error resume next doesn't "go anywhere"...
it just ignores the line that causes the error and moves to the next line
(hence the "resume next" part).
Anyways, I'm not sure if there's
a way to isolate the website where its originating, or even the page this
problem is originating from. Is there a way to do this? Any help would be appreciated, as this problem is slowing down the server for everyone. TIA
for any help/advice.

I think you'd have to use trial and error... move all sites into isolated
and you should be able to track it down that way (since each site would have
its own dllhost.exe).

A

[Rollin 4 Eva]

"Aaron Bertrand - MVP" <aa***@TRASHasp faq.com> wrote in message
news:up******** ******@TK2MSFTN GP09.phx.gbl...

Probably an on error resume next line that doesn't go
anywhere when an error is an encountered.
No, that wouldn't cause it... on error resume next doesn't "go

anywhere"... it just ignores the line that causes the error and moves to the next line
(hence the "resume next" part). well what if the error happens when I try to open up a recordset (which
mostly all the pages that use a dbase connection do)? And what if the next
line is do while not rsTemp.EOF?
Wouldn't that cause an endless loop?

Anyways, I'm not sure if there's
a way to isolate the website where its originating, or even the page this problem is originating from. Is there a way to do this? Any help would be

appreciated, as this problem is slowing down the server for everyone. TIA for any help/advice.

I think you'd have to use trial and error... move all sites into isolated
and you should be able to track it down that way (since each site would

have its own dllhost.exe). Not sure what you mean by isolated. Running IIS on Windows 2000 Server BTW

Thanks.
Rollin

A

[Don Verhagen]

In news:z9******** ************@gi ganews.com,
Rollin 4 Eva <te**@test.co m> typed:
: "Aaron Bertrand - MVP" <aa***@TRASHasp faq.com> wrote in message
: news:up******** ******@TK2MSFTN GP09.phx.gbl...
::: Probably an on error resume next line that doesn't go
::: anywhere when an error is an encountered.
::
:: No, that wouldn't cause it... on error resume next doesn't "go
:: anywhere"... it just ignores the line that causes the error and
:: moves to the next line (hence the "resume next" part).
: well what if the error happens when I try to open up a recordset
: (which mostly all the pages that use a dbase connection do)? And
: what if the next line is do while not rsTemp.EOF?
: Wouldn't that cause an endless loop?

Yes, but the On Error Resume Next would not have *any* effect on that. An
endless loop is not incorrect in and of itself, although, in most cases,
highly undesirable.

[snipped..the rest]

Don Verhagen

[Aaron Bertrand [MVP]]

> well what if the error happens when I try to open up a recordset (which

mostly all the pages that use a dbase connection do)? And what if the next line is do while not rsTemp.EOF?
What if? Did you try it?
Wouldn't that cause an endless loop?

Again, did you try it?

[Stuart]

Sounds like you have got the Welchia Worm !!! I had the same problem myself.

If you do a search you will find more than one instance of DLLHOST.EXE.

The culprit resides in WinNT/System32/Wins/Dllhost.exe

You will not be able to delete this, change privaliges or anything.

You will have to go to Sophos (or Norton the choice is yours), and download
a little .exe file to delete the worm.

Then go to Microsoft.com and do a search on IISLockd.exe (this is an IIS
lock down tool)
You need this as the worm uses an RPC on the WEBDAV element in IIS to upload
the worm to your machine.
I hope this helps
Stuart

You can go to Sophos and download a little .exe to clear it.
"Rollin 4 Eva" <te**@test.co m> wrote in message
news:o_******** ************@gi ganews.com...

I've got a Windows 2000 server running with about 50 websites on it, all
running ASP scripts. I've noticed that the servers CPU usage gets up 100%
sometimes, caused by dllhost.exe, which I'm certain is a hanging ASP script somewhere on the box. Probably an on error resume next line that doesn't go anywhere when an error is an encountered. Anyways, I'm not sure if there's a way to isolate the website where its originating, or even the page this
problem is originating from. Is there a way to do this? Any help would be appreciated, as this problem is slowing down the server for everyone. TIA
for any help/advice.

Rollin

[Rollin 4 Eva]

Yes I tried it. It causes the server to lock up. The on error resume next
causes an endless loop because the recordset never reaches an .EOF status.
The initial question had nothing to do with the code. I'm aware of what's
causing the problem, just unaware of how to isolate the website which its
coming from.

"Aaron Bertrand [MVP]" <aa***@TRASHasp faq.com> wrote in message
news:#E******** ******@TK2MSFTN GP09.phx.gbl...

well what if the error happens when I try to open up a recordset (which
mostly all the pages that use a dbase connection do)? And what if the

next

line is do while not rsTemp.EOF?

What if? Did you try it?

Wouldn't that cause an endless loop?

Again, did you try it?

[Aaron Bertrand - MVP]

> Yes I tried it. It causes the server to lock up. The on error resume
next

causes an endless loop because the recordset never reaches an .EOF status.

Can you show code that reproduces this? You understand that the following
loop will never even be entered if eof is false, right?

do while not rs.eof

[Rollin 4 Eva]

"Aaron Bertrand - MVP" <aa***@TRASHasp faq.com> wrote in message
news:eI******** ******@TK2MSFTN GP09.phx.gbl...

Yes I tried it. It causes the server to lock up. The on error resume next

causes an endless loop because the recordset never reaches an .EOF

status.
Can you show code that reproduces this? You understand that the following
loop will never even be entered if eof is false, right?

do while not rs.eof

OK try running this code on your server and tell me this doesn't create an
endless loop.
<%@ Language=VBScri pt %>
<% Option Explicit %>
<% Response.Buffer = true %>
<!--#include file="/includes/connection.inc. asp" -->
<%
on error resume next
dim rsTemp

set rsTemp = server.CreateOb ject("ADODB.REC ORDSET")
set rsTemp = conn.execute("s ome sql syntax that does nothing")

do while not rsTemp.EOF
response.Write( "TEST<BR>")
rsTemp.MoveNext
loop

rsTemp.Close
set rsTemp = nothing
conn.close
set conn = nothing
%>

You have to take out the include and set up your own connection of course.
EOF status is never reached because the sql syntax isn't proper.