How to find out source of dllhost.exe

[Rollin 4 Eva]

I've got a Windows 2000 server running with about 50 websites on it, all
running ASP scripts. I've noticed that the servers CPU usage gets up 100%
sometimes, caused by dllhost.exe, which I'm certain is a hanging ASP script
somewhere on the box. Probably an on error resume next line that doesn't go
anywhere when an error is an encountered. Anyways, I'm not sure if there's
a way to isolate the website where its originating, or even the page this
problem is originating from. Is there a way to do this? Any help would be
appreciated, as this problem is slowing down the server for everyone. TIA
for any help/advice.

Rollin

[Tom Kaminski [MVP]]

"Rollin 4 Eva" <test@test.com> wrote in message
news:o_udnf9BvN4uogmiRTvUqQ@giganews.com...

> I've got a Windows 2000 server running with about 50 websites on it, all
> running ASP scripts. I've noticed that the servers CPU usage gets up 100%
> sometimes, caused by dllhost.exe, which I'm certain is a hanging ASP

script

> somewhere on the box. Probably an on error resume next line that doesn't

go

> anywhere when an error is an encountered. Anyways, I'm not sure if

there's

> a way to isolate the website where its originating, or even the page this
> problem is originating from. Is there a way to do this? Any help would

be

> appreciated, as this problem is slowing down the server for everyone. TIA
> for any help/advice.

Go into Component Services MMC. Click the "Status View" button in COM+. It
will show you the PID for each DllHost process.

--
Tom Kaminski IIS MVP
[url]http://www.iistoolshed.com/[/url] - tools, scripts, and utilities for running IIS
[url]http://mvp.support.microsoft.com/[/url]
[url]http://www.microsoft.com/windowsserver2003/community/centers/iis/[/url]

[Aaron Bertrand - MVP]

> Probably an on error resume next line that doesn't go

> anywhere when an error is an encountered.

No, that wouldn't cause it... on error resume next doesn't "go anywhere"...
it just ignores the line that causes the error and moves to the next line
(hence the "resume next" part).

> Anyways, I'm not sure if there's
> a way to isolate the website where its originating, or even the page this
> problem is originating from. Is there a way to do this? Any help would

be

> appreciated, as this problem is slowing down the server for everyone. TIA
> for any help/advice.

I think you'd have to use trial and error... move all sites into isolated
and you should be able to track it down that way (since each site would have
its own dllhost.exe).

A

[Rollin 4 Eva]

"Aaron Bertrand - MVP" <aaron@TRASHaspfaq.com> wrote in message
news:upnKzg0lDHA.2444@TK2MSFTNGP09.phx.gbl...

> > Probably an on error resume next line that doesn't go
> > anywhere when an error is an encountered.

>
> No, that wouldn't cause it... on error resume next doesn't "go

anywhere"...

> it just ignores the line that causes the error and moves to the next line
> (hence the "resume next" part).

well what if the error happens when I try to open up a recordset (which
mostly all the pages that use a dbase connection do)? And what if the next
line is do while not rsTemp.EOF?
Wouldn't that cause an endless loop?

>

> > Anyways, I'm not sure if there's
> > a way to isolate the website where its originating, or even the page

this

> > problem is originating from. Is there a way to do this? Any help would

> be

> > appreciated, as this problem is slowing down the server for everyone.

TIA

> > for any help/advice.

>
> I think you'd have to use trial and error... move all sites into isolated
> and you should be able to track it down that way (since each site would

have

> its own dllhost.exe).

Not sure what you mean by isolated. Running IIS on Windows 2000 Server BTW

Thanks.
Rollin

>
> A
>
>

[Don Verhagen]

In news:z96dnbZ8X53DyAmiRTvUqw@giganews.com,
Rollin 4 Eva <test@test.com> typed:
: "Aaron Bertrand - MVP" <aaron@TRASHaspfaq.com> wrote in message
: news:upnKzg0lDHA.2444@TK2MSFTNGP09.phx.gbl...
::: Probably an on error resume next line that doesn't go
::: anywhere when an error is an encountered.
::
:: No, that wouldn't cause it... on error resume next doesn't "go
:: anywhere"... it just ignores the line that causes the error and
:: moves to the next line (hence the "resume next" part).
: well what if the error happens when I try to open up a recordset
: (which mostly all the pages that use a dbase connection do)? And
: what if the next line is do while not rsTemp.EOF?
: Wouldn't that cause an endless loop?

Yes, but the On Error Resume Next would not have *any* effect on that. An
endless loop is not incorrect in and of itself, although, in most cases,
highly undesirable.

[snipped..the rest]

Don Verhagen

[Aaron Bertrand [MVP]]

> well what if the error happens when I try to open up a recordset (which

> mostly all the pages that use a dbase connection do)? And what if the

next

> line is do while not rsTemp.EOF?

What if? Did you try it?

> Wouldn't that cause an endless loop?

Again, did you try it?

[Stuart]

Sounds like you have got the Welchia Worm !!! I had the same problem myself.

If you do a search you will find more than one instance of DLLHOST.EXE.

The culprit resides in WinNT/System32/Wins/Dllhost.exe

You will not be able to delete this, change privaliges or anything.

You will have to go to Sophos (or Norton the choice is yours), and download
a little .exe file to delete the worm.

Then go to Microsoft.com and do a search on IISLockd.exe (this is an IIS
lock down tool)
You need this as the worm uses an RPC on the WEBDAV element in IIS to upload
the worm to your machine.


I hope this helps


Stuart

You can go to Sophos and download a little .exe to clear it.
"Rollin 4 Eva" <test@test.com> wrote in message
news:o_udnf9BvN4uogmiRTvUqQ@giganews.com...

> I've got a Windows 2000 server running with about 50 websites on it, all
> running ASP scripts. I've noticed that the servers CPU usage gets up 100%
> sometimes, caused by dllhost.exe, which I'm certain is a hanging ASP

script

> somewhere on the box. Probably an on error resume next line that doesn't

go

> anywhere when an error is an encountered. Anyways, I'm not sure if

there's

> a way to isolate the website where its originating, or even the page this
> problem is originating from. Is there a way to do this? Any help would

be

> appreciated, as this problem is slowing down the server for everyone. TIA
> for any help/advice.
>
> Rollin
>
>

[Rollin 4 Eva]

Yes I tried it. It causes the server to lock up. The on error resume next
causes an endless loop because the recordset never reaches an .EOF status.
The initial question had nothing to do with the code. I'm aware of what's
causing the problem, just unaware of how to isolate the website which its
coming from.

"Aaron Bertrand [MVP]" <aaron@TRASHaspfaq.com> wrote in message
news:#EnI1j1lDHA.1728@TK2MSFTNGP09.phx.gbl...

> > well what if the error happens when I try to open up a recordset (which
> > mostly all the pages that use a dbase connection do)? And what if the

> next

> > line is do while not rsTemp.EOF?

>
> What if? Did you try it?
>

> > Wouldn't that cause an endless loop?

>
> Again, did you try it?
>
>

[Aaron Bertrand - MVP]

> Yes I tried it. It causes the server to lock up. The on error resume
next

> causes an endless loop because the recordset never reaches an .EOF status.

Can you show code that reproduces this? You understand that the following
loop will never even be entered if eof is false, right?

do while not rs.eof

[Rollin 4 Eva]

"Aaron Bertrand - MVP" <aaron@TRASHaspfaq.com> wrote in message
news:eIIQG2AmDHA.2456@TK2MSFTNGP09.phx.gbl...

> > Yes I tried it. It causes the server to lock up. The on error resume

> next

> > causes an endless loop because the recordset never reaches an .EOF

status.

>
> Can you show code that reproduces this? You understand that the following
> loop will never even be entered if eof is false, right?
>
> do while not rs.eof
>
>
>

OK try running this code on your server and tell me this doesn't create an
endless loop.
<%@ Language=VBScript %>
<% Option Explicit %>
<% Response.Buffer = true %>
<!--#include file="/includes/connection.inc.asp" -->
<%
on error resume next
dim rsTemp

set rsTemp = server.CreateObject("ADODB.RECORDSET")
set rsTemp = conn.execute("some sql syntax that does nothing")

do while not rsTemp.EOF
response.Write("TEST<BR>")
rsTemp.MoveNext
loop

rsTemp.Close
set rsTemp = nothing
conn.close
set conn = nothing


%>

You have to take out the include and set up your own connection of course.
EOF status is never reached because the sql syntax isn't proper.

[Bob Barrows]

Rollin 4 Eva wrote:

> "Aaron Bertrand - MVP" <aaron@TRASHaspfaq.com> wrote in message
> news:eIIQG2AmDHA.2456@TK2MSFTNGP09.phx.gbl...

>
> OK try running this code on your server and tell me this doesn't
> create an endless loop.
> <%@ Language=VBScript %>
> set rsTemp = conn.execute("some sql syntax that does nothing")

I'd like to try this but I have no idea what "some sql syntax that does
nothing" means. If you mean to use a statement that raises an error, well,
you would want to detect that error before attempting to loop through a
recordset wouldn't you? Since you are using On Error Resume Next, then it
seems that it would seem logical to use

If err <> 0 then
'handle the error
else
do until rsTemp.EOF
'etc
loop
end if

wouldn't it?

Bob Barrows


--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

[Rollin 4 Eva]

Well see that's where my problem is. My problem comes from a page that I
wrote in my inefficient/without error handling code writing days. I'm
pretty good about handling errors nowadays, but I find myself chasing the
ghosts of coding past. And considering that there's at least 50 different
websites on the server, I was hoping that there could be an easier way to
find the cause of the error than to manually go through every asp page on
the server and make sure error handling is handled properly.


"Bob Barrows" <reb01501@NOyahoo.SPAMcom> wrote in message
news:ek2AwXNmDHA.988@TK2MSFTNGP10.phx.gbl...

> Rollin 4 Eva wrote:

> > "Aaron Bertrand - MVP" <aaron@TRASHaspfaq.com> wrote in message
> > news:eIIQG2AmDHA.2456@TK2MSFTNGP09.phx.gbl...

>

> >
> > OK try running this code on your server and tell me this doesn't
> > create an endless loop.
> > <%@ Language=VBScript %>
> > set rsTemp = conn.execute("some sql syntax that does nothing")

>
> I'd like to try this but I have no idea what "some sql syntax that does
> nothing" means. If you mean to use a statement that raises an error, well,
> you would want to detect that error before attempting to loop through a
> recordset wouldn't you? Since you are using On Error Resume Next, then it
> seems that it would seem logical to use
>
> If err <> 0 then
> 'handle the error
> else
> do until rsTemp.EOF
> 'etc
> loop
> end if
>
> wouldn't it?
>
> Bob Barrows
>
>
> --
> Microsoft MVP -- ASP/ASP.NET
> Please reply to the newsgroup. The email account listed in my From
> header is my spam trap, so I don't check it very often. You will get a
> quicker response by posting to the newsgroup.
>
>