services.exe consuming memory and consequently 15 minutes to bootProblem Description: It would appear that since update KB973687 was installed my Dell Inspiron 640m is taking an age to boot. I am running XP SP3 with all updates installed, have 2 x 512mb memory installed and microsoft security essentials is turned on and no virus found. Running task manager on booting I note that services.exe has 2 user objects running. Peak memory usage reaches around 500,000 to 600,000k and Virtual memory size increases to over 2,000,000k. Once VM reaches around 2,200,000k it then starts to release very slowly and eventually reduces to a size of around 6,000 -7,000k and then has just one user object running. It is not until this time when the system becomes usable. This is happening on every boot and takes around 15 minutes for the system to be usable.I have read many articles on this issue and, other than a clean reinstall which I do not want to do, cannot find a solution.Your help would be greatly appreciated.Operating System: Windows XP1 person got this answerI do too

Hi and thanks.Tried your suggestion but still have the same problem using a clean boot.

Did your system have the symptoms that KB973687 was supposed to correct:Install this update to prevent applications from sending too many HTTP requests while a well-known Document Type Definition (DTD) is included. After you install this item, you may have to restart your computer.If you were not having that symptom, what symptom were you having that you thought KB973687 would correct?If you think the KB973687 is contributing to your issue, just unintall it and then see how your system runs without it. Do you need help uninstalling KB973687?I think it is very suspicious if you have two services.exe Processes running in Task Manager. What I do know is that some malicious software will sometimes disguise itself as valid windows processes name or hide under one of the many svchost.exe Processes you also see in Task Manager. On a healthy system, it is normal to have several svchost.exe Processes, but using Task Manager you can't see what is running under them, so that is a good place for malicious software to hide.Microsoft Security Essentials does not know about every kind of malicious software and it misses detecting/preventing many things (MSE is just "okay"). Just because MSE didn't find anything does not mean that your system is malware free. What it does mean is that MSE did not find anything that it knows about and it's list is small compared to other tools.Microsoft is not in the malicious software detection, prevention and removal business - that is not what they do. You should include in your scans some other software from companies where malicious software detection and removal is all they do all day long.I would recommend that in addition to your MSE, you do this:Download, install, update and do a full scan with these free malware detection programs:Malwarebytes (MBAM): http://malwarebytes.org/SUPERAntiSpyware: (SAS): http://www.superantispyware.com/They can be uninstalled later if desired.When the scans run clean, only then does it make sense to start to troubleshoot any remaining issues.If, after the scans, your hopefully clean system is still malfunctioning or still takes 15 minutes to boot, you can figure out why and see what you can do about it (without guessing or trying things).Do, or do not. There is no try.I need YOUR votes and points for helpful replies and Propose as Answers. I am saving up for a pony!

HiI did not have the problem you describe prior to installing update KB973687 but as far as I remember the update was installed via automatic updates.I am not totally sure that this is update is contributing to the problem and yes I have looked at trying to uninstall it but cannot find it through control panel add/remove. So yes please any help you can give on uninstalling would be useful.Just to clarify, there are not 2 services.exe running in task manager just one. There are two "user objects" running in services.exe which reduces back to one after about 15 minutes when the system becomes usable.Appreciate that MSE is not foolproof and do run MBAM regularly which show the system is clean but still the problem persists.

it is possible that the clean boot was unhelpful. but it is a worthy method to utilize in order to begin the process of elimination. however, it is always hopeful that this method is resolute otherwise, it is like looking for a needle in a haystack to figure issues like yours.fortunately, there are other methods available as well. first method is to use safeboot and safeboot w/networking (for internet connectivity) and compare the performance of windows in the safeboot modes to that with that to the problematic normal mode.second method is to revert the system back to a date prior to the installation of the update. if the problem you have now was present prior to the update, then it is best to work on the system without the update. also, if you have several restore points, then reinstate the system state as far back as you can. that way, if by chance your issue is a combination of events occurring over time, you can eliminate most of them by restoring the system as far back as possible.third method is to ensure that the disk and file system are tuned up. you see, if the disk and file system were not in perfect shape when you added more data to your system by way of the update or other downloads, then you only exaberated the problem with the file system.also, there are times that when windows is updated, other software you have also need to be updated afterwards, especially anti virals because they don't recognize the updates or the updates make them dysfunctional.the above are only a few options in which any one or a combination of them may prove to be useful and executed in any order. perhaps, the next steip i would try is a method two.db·´¯`·...¸>-)))º> ·´¯`·...¸>-)))º> share the nirvana mann

I have looked at trying to uninstall it but cannot find it through control panel add/remove. So yes please any help you can give on uninstalling would be useful.You need to make sure the "Show updates" box is checked.

HiCould not find update KB973687 but did find 3688 and removed it.However, still the same problem with services.exe when booting.Perhaps the issue with KB973687 (or 3688) is e red herring so what is causing the services.exe issue?

I suggest you download Process Explorer.For further information about Process Explorer see here:http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx This freeware utility performs a similar function to the Windows Task Manager but it goes much further.In Process Explorer place the cursor on Services.exe, right click and select Properties. Click the Services tab and see what services are registered. are registered there. On my computer Event Log and Plug and Play appear there. Plug and Play detects Devices during the boot process. If it encounters a problem it will delay completion of the boot. Go to Device Manager and see if there are question marks against any device? You can locate Device Manager by selecting Start, Settings(some computers)Control Panel, System, Hardware, Device Manager.Another suggestion. Examine the System Log in Event Viewer for Warnings and Errors.You can access Event Viewer by selecting Start, Control Panel,Administrative Tools, and Event Viewer. When researching the meaningof the error, information regarding Event ID, Source and Descriptionare important. A tip for posting copies of Error Reports! Run Event Viewer and doubleclick on the error you want to copy. In the window, which appears is abutton resembling two pages. Click the button and close EventViewer.Now start your message (email) and do a paste into the body ofthe message. Make sure this is the first paste after exiting fromEvent Viewer.Hope this helps, Gerry Cornell

I'm puzzled. In your initial post, you stated that update KB973687 had been installed on your PC. But there is no evidence that this is so. Why do you think that particular update was installed?If I were you, I would uninstall everything that got installed on that day that things got screwed up (assuming it wasn't too long ago and there weren't too many updates or programs installed). Then I would run System Restore for good measure.Furthermore, I would only ever install critical updates for Windows XP. Especially stay away from driver updates on that Microsoft site!

Hi. Have downloaded PE as you suggested. The sevices registered are similar to yours - Event Log and Plug and Play.There appears to be a plethora of information coming out of PE but, as a novice, what am I looking for to try and solve the problem?Device Manager has no question marks against any device.Have looked at the System Log and there is nothing untoward.Regards

Have another look at the System log. If a computer takes 15 minutes to boot there should be some point in the log where there are no entries for a significant period before they resume. What are the 2/3 entries after this period? Please post copies. Hope this helps, Gerry Cornell

Hi GerryTask manager shows the reboot time at 20:43 and here is a copy of the next two system log entries after the period of delay that you requested:Event Type: InformationEvent Source: Service Control ManagerEvent Category: NoneEvent ID: 7035Date: 25/11/2010Time: 21:06:35User: RAYNOTEBOOK\Ray WoodcockComputer: RAYNOTEBOOKDescription:The Protected Storage service was successfully sent a start control.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Event Type: InformationEvent Source: Service Control ManagerEvent Category: NoneEvent ID: 7036Date: 25/11/2010Time: 21:06:36User: N/AComputer: RAYNOTEBOOKDescription:The Protected Storage service entered the running state.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Regards

In Process Explorer please add a Column. Select View, Select, Columns, Process, Performance and check the box before Start Time. Next select "Show Processes from all Users" and click on the column header "Start Time". This will sort so that you can see start with the earliest first. You may need to click twice or three times.On my WindowsXP box I see:smss.exe =Session Manageravgehsvx.exe =AVG 10 (Specific to my computer)csrss.exe =Microsoft Client Server Runtime Server 3 seconds laterwinlogon.exe =Microsoft Windows Logon Process =2 seconds laterservices.exe =WindowsService Controller =2 seconds laterlsass.exe = Local Security Authentication Server =Same time as services.exeMy computer is not lightning fast -compare the above with what you see and let me know where there is a significant discrepancy.I am wondering whethether you have a corrupted user profile.http://support.microsoft.com/kb/811151Try creating a new User Profile and see whether you see a difference.Hope this helps, Gerry Cornell

Hi GerryOther than your AVG 10 specific, PE is showing the same as you experience.However after isass.exe I have the following that also runsvchost.exe = Generic host process for windows32 services = 1 second laterRapportmgmtservice.exe = RapportmgmtService = same time as svchost.exeS24EvMon.exe = Wireless Management Service = 6 seconds latersvchost.exe = Generic host process for windows32 services = 1 second latersvchost.exe = Generic host process for windows32 services = same time as that abovesvchost.exe = Generic host process for windows32 services = same time as that abovespoolsv.exe =Spooler Subsystem App = 1 second laterAppleMobileDeviceService.exe = Apple Mobile Device Service = same time as spoolsv.exemDNSResponder.exe = Bonjour Service = same time as spoolsv.exedllhost.exe = COM Surrogate = 1 second laterehSched.exe = Media Center Scedular Service = same time as dllhost.exeEvtEng.exe = Intel PROset/Wireless Event Log = same time as dllhost.exesvchost.exe = Generic host process for windows32 services = same time as dllhost.exeKService.exe = Delivery Manager Service = same time as dllhost.exeLVComSer.exe = Logitech Video COM Servive = same time as dllhost.exeexplorer.exe = Windows Explorer = 1 second laterMDM.exe = Machine Debug Manager = same time as explorer.exeNicConfigSvc.exe = Internal Network Card Power Management = same time as explorer.exeRegSrvc.exe = Intel PROset/Wireless Registry Service = same time as explorer.exesvchost.exe = Generic host process for windows32 services = same time as explorer.exesvchost.exe = Generic host process for windows32 services = 1 second laterWLKEEPER.exe = WLANKEEPER = same time as svchost.exeWLIDSVC.exe = Microsoft Windows Live ID Service = same time as svchost.exeLVComSer.exe = Logitech Video COM Servive = same time as svchost.exesearchindexer.exe = Microsoft Windows Search Indexer = 1 second latermcrdsvc.exe = MCRD Device Service = 6 seconds laterwmpnetwk.exe = Windows Media Player Network Sharing Service = same time as mcrdsvc.exeSynTPEnh.exe = Synaptics TouchPad Enhancements = 12 seconds laterWLIDSVCM.EXE = Microsoft Windows Live ID Service Monitor = 3 seconds laterstsystra.exe = Sigmatel Audio system tray application = same time as WLIDSVCM.EXEmsseces = Microsoft Security Essentials User Interface = 2 seconds laterQuickcam.exe = Camera Software = 3 seconds lateralg.exe = Application Layer Gateway Service = same time as Quickcam.exeCommunications_Helper.exe = Communications Manager = 1 second laterZCfgSvc.exe = ZeroCfgSvc MFC Application = same time as Communications_Helper.exeiFrmewrk.exe = Intel Framework MFC Application = 1 second laterctfmon.exe = CTF Loader = same time as iFrmewrk.exewmpnscfg.exe = Windows Media Player Network Sharing Service = 2 seconds laterManyCam.exe = ManyCam Application = 1 second laterISUSPM.exe = Macrovision Software Manager = 2 seconds laterRapportService.exe = Rapport Service = 2 seconds laterThere is then a 22 minute gap before I manually open OUTLOOK when services.exe eats up memory/pagefile before slowly releasing it.(I have only recently installed Rapport but was having the services.exe problem long before installing Rapport.)Does the above help indentify the cause in any way?Regards

Hi GerryOther than your AVG 10 specific, PE is showing the same as you experience.However after isass.exe I have the following that also runsvchost.exe = Generic host process for windows32 services = 1 second laterRapportmgmtservice.exe = RapportmgmtService = same time as svchost.exeS24EvMon.exe = Wireless Management Service = 6 seconds latersvchost.exe = Generic host process for windows32 services = 1 second latersvchost.exe = Generic host process for windows32 services = same time as that abovesvchost.exe = Generic host process for windows32 services = same time as that abovespoolsv.exe =Spooler Subsystem App = 1 second laterAppleMobileDeviceService.exe = Apple Mobile Device Service = same time as spoolsv.exemDNSResponder.exe = Bonjour Service = same time as spoolsv.exedllhost.exe = COM Surrogate = 1 second laterehSched.exe = Media Center Scedular Service = same time as dllhost.exeEvtEng.exe = Intel PROset/Wireless Event Log = same time as dllhost.exesvchost.exe = Generic host process for windows32 services = same time as dllhost.exeKService.exe = Delivery Manager Service = same time as dllhost.exeLVComSer.exe = Logitech Video COM Servive = same time as dllhost.exeexplorer.exe = Windows Explorer = 1 second laterMDM.exe = Machine Debug Manager = same time as explorer.exe

Your list is a lot different and a lot longer than mine. My first thought is do you have programmes loading at StartUp which could just as easily load on Demand. A useful tool for looking at StartUp items is Autoruns.http://technet.microsoft.com/en-us/sysinternals/bb963902.aspxRapport -Google search resulthttp://www.google.co.uk/search?sourceid=ie7&q=Rarrort+Service&rls=com.microsoft:en-gb:IE-SearchBox&ie=UTF-8&oe=UTF-8&rlz=1I7ACAW_enGB397GB397&redir_esc=&ei=mgTwTLvpE4GxhAeUtZSUDARight click on Rapport and select Performance Graph. What is the CPU Usage and Private Bytes. I suspect you need to know the usage during StarUp but at the moment know how to do this.I am puzzled by the absence of references to other security software. What anti-virus, anti-spyware and firewall are you using? Hope this helps, Gerry Cornell

HiInstalled and ran Autoruns as suggested. Found files like Bitdefender and redundant HP printer files and deleted them.Uninstalled Rapport.Hey presto, after rebooting services.exe stopped eating memory. Boot time is now around 3 minutes.Am running MSE and Malwarebytes which I start manually.Many thanks.

Glad you have had a good result.Gerry Cornell