When I boot the PC(Pentium III with 320 megs RAM), upon getting to the desktop the disk keeps thrasshing for a long time and there is excess memory usage in the Performance section in Task Manager, often exceeding the amount of RAM I have installed in the computer. Eventually the system quiets down, but this is abnormal. This began two weeks ago when I uninstalled PCTOOLS Personal Firewall2 people need an answerI do too

Please start with the basics and do thorough scanning for malware. Post back with the results of your scans for further help.http://www.elephantboycomputers.com/page2.html#Removing_MalwareMS-MVP - Elephant Boy Computers - Don't Panic!

I ran Malwarebytes in safe mode with networking. First, with quick scan, and then with the Full Scan: Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4451Windows 5.1.2600 Service Pack 3 (Safe Mode)Internet Explorer 8.0.6001.187028/20/2010 7:51:46 AMmbam-log-2010-08-20 (07-51-46).txtScan type: Full scan (C:\|)Objects scanned: 263876Time elapsed: 38 minute(s), 9 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) One thing I notice is when I run the computer in Safe Mode there is NO disk thrashing and the PC is faster. It's only in regular mode on booting that it takes forever to get responsive(10-15 minutes). I also ran Avira's rescue disk- which is a Linux based CD with antivirus scan on the disk. You boot the computer from the CD(ISO Image is on the disk)and a scan is performed. Nothing was found from that scan.

In Task Manager, the "Processes" section shows: taskmgr.exe 4,724 kfirefox.exe 80,908 krundll32.exe 256 klocater.exe 64 knvsvc32.exe 292 kjqs.exe 1,384 kalg.exe 160 ksvchost.exe 44 kCTHELPER.EXE 216 kcarpserv.exe 48 kaolsoftware.exe 3,744 kzclient.exe 4,728 kspoolsv.exe 756 kexplorer.exe 9,056 kvsmon.exe 16,440 ksvchost.exe 68 ksvchost.exe 1,168 ksvchost.exe 12,180 ksvchost.exe 928 klsass.exe 1,040 kwinlogon.exe 1,256 kcrss.exe 1,244 ksmss.exe 44 kdmadmin.exe 440 ksystem 20 kSystem Idle Process 16 k

So if the computer is clean (which apparently it is) then you know that something running in regular mode is causing the issue. Do the clean-boot troubleshooting per the links already given. And do you actually use AOL software? If not, uninstall it.MS-MVP - Elephant Boy Computers - Don't Panic!

Yes I use AOL otherwise I would not have it on the computer. It's my main email program. Forgot to include, I downloaded Twister Antivirus and it found 5 trojans in the aol backup folder and removed them. I also ran PCTOOLS Spyware Doctor and it found 1 trojan in a different part of the computer, but removed it as well. I can only assume there's something loading into memory at regular boot up, since when running in Safe Mode the computer is faster.Eventually, in regular mode the computer IS normal, it's only when I first turn it on in the morning that it takes so long to become responsive. Hitting control/alt/delete doesn't do this.

A last option I thought was to download Mcafee's Internet program which scans for Spyware and Viruses(along with an integrated Firewall)and see what it finds- if anything.

If you follow the malware scanning instructions at the link I originally gave you that is normally sufficient. You will need to do the clean-boot troubleshooting to find out what is running in the background. I already gave you those links, too. Not everything that sucks up processing power is malware. And McAfee products are garbage. I would uninstall that one right away.MS-MVP - Elephant Boy Computers - Don't Panic!

I performed the clean boot with the utility on that download link you put above, and the computer is ALOT faster and doesn't do this disk thrashing. Now, how do I do a regular boot to where I can put checks back into boxes or do I have to do them one at a time and reboot to find out specifically what's causing the slowdown? Sorry for all the questions, but since performing what you told me to do, the MSCONFIG utility has some startup entires which were to blame for the slowdown but I'm usure which to check since it is in Selective Startup.

You enable one thing at a time until you find the culprit. If you don't know what the items are, you can Google their names or post back and I'll Google them for you.MS-MVP - Elephant Boy Computers - Don't Panic!

Some of them are obvious(i.e. Adobe Acrobat Reader, etc.). The others are: Carpserv.exeUpdateCheckerImekrmigImjpmigNvcpl(Rundll32.exe)NvmctrayNwiz(Nwiz.exe)UpdREGCthelper Windows Card SpaceWindows Media PlayerJava Quick Start

The first Nine items are in STARTUP in the Msconfig utility. The remaining Three items are in SERVICES in the Msconfig utility

So what is checking for updates (updatechecker)? Do you use the MS Office alternate input (imekrmig, imjpmig) stuff? The Nv stuff all has to do with your Nvidia graphics card. CThelper belongs to your sound card. Java Quick start doesn't need to be running. Carpserv has to do with a dialup modem; if you don't use one it doesn't need to run. But none of those things should slow your computer down significantly. More important is what *isn't* running that slows things down. What antivirus/security program(s) do you have installed? If you have done a true clean boot then nothing is running that doesn't belong to Microsoft at this point. So something that belongs to a third-party is the culprit. The most common culprit on a clean system is a antivirus/antispyware/firewall combo program which is a hog. Like McAfee, Norton, Panda, TrendMicro, Comodo, running more than one real-time av at a time. Etc.MS-MVP - Elephant Boy Computers - Don't Panic!

Do you have ZoneAlrm installed (zclinet.exe) and if yes, when you installed it did you choose to install all options (everything)?If you installed the ZA firewall as part of the installation, you need to disable the Firewall part of ZA, or disable the built in XP firewall. Use one or the other, but never both at the same time. For most folks, the built in XP firewall is fine.I am not installing ZA to test and recreate your problem, but have seen it before. Usually, I just am happy to uninstall ZA. I have in my notes this gem (I made note of it for some reason) about the disk thrashing:Find the ZA try icon in the notification area (to the left of the system time in the Taskbar), hold down the Shift and Ctrl keys together, right click the ZA tray icon, find the Set debug level section and set it to Off, click OK, etc. Then restart and test.If I had your system, I would uninstall ZA completely, reboot and test. You can always reinstall if you want to. Then I would discuss why you think you need ZA or are other less invasive free products with less overhead and a smaller footprint suitable for your environment.Some people really like ZA and some people don't like it at all. If you have the time and knowledge to do the research to tweak it up for XP, it is probably just fine, but most of the time it is a system resource hog when you install it "out of the box" like so many people do. Enabling everything is not always a good idea to get "more" protection.And, depending on the version you have, they have had a problem recently with ZA deleting System Restore points (all but the last one), so if you are not on the latest version where it is supposed to be fixed and are compelled to use ZA, better check this nugget too if you find your System Restore calendar is vacant: If it's 9.1.507.000, you need to either update to 9.1.603.000 or downgrade to 9.1.008.000. There are a number of authenticated problems with 507 on XP machines, one of which is losing prior restore points every day. You can read all about it in the ZA forums: http://forums.zonealarm.com/ Please vote my posts as helpful so I can get lots of points. I am saving up for a pony!

Good point about ZA. I forgot to add it to my "laundry list" of bad programs above.MS-MVP - Elephant Boy Computers - Don't Panic!

Malkeleah, You say none of "those things" should slow down my computer yet, when I unselected many of these, the computer IS much faster. So... I have downloaded Avira Free Antivirus but have not installed it. I do have Zone Alarm Free. Used to have Comodo but got rid of it. I am presently running Zone Alarm and the system is faster- but after I did the clean boot. I could uninstall Zone Alarm but have heard the Windows XP built in firewall is NOT very good. It apparently only blocks inbound traffic- but not outbound. If you have a suggestion for a better firewall, I'd be open to it but presently the system is faster since I did the clean boot as instructed at the top of the page

Well I uninstalled Zone Alarm and the did the clean boot again- the computer is SLOW again. This is really making me mad now. I'm considering installing Windows XP all over again and at least have a clean MSCONFIG, but this does not make sense. The other thing- and this is a stretch, is I have an Adaptec SCSI card, and possibly the SCSI cable is old and not sending date correctly, and possibly causing a slow system but again that is a stretch.

I did the Clean Boot one final time and it got fast again, only Microsoft items are checked- nothing else. It still puzzles me that this whole thing began when I uninstalled PCTOOLS Firewall. This has never happened before.

The Windows Firewall is fine for most people. ZA tends to cause more problems than its worth IMO. Without being able to see and test your machine myself, I can't really add anything to what I've already written. Maybe the SCSI adapter is old. Maybe there's file system corruption after getting rid of PCTools or other situations I'm not aware of. There's just no way for me to know what the cause is from here. Maybe Mr. Ibarra will have some fresh ideas for you. I'm sorry I wasn't able to point you to a definitive fix.MS-MVP - Elephant Boy Computers - Don't Panic!

Don't give up!If you can get it slow (or fast), make a screenshot of your Task Manager and post it so we can see it.Here is how to do that:Right click the Taskbar, choose Task Manager and select the Processes tab.Click View, Select Columns, check the box that says: Virtual Memory Size. Expand the width of the Task Manager by dragging the corners so you can see all the columns and processes in one window if possible. Drag the TM window corners and edges to expand it so it shows everything. If it all doesn't fit, make two screen shots.To create and email/post/print a screenshot:Press the Print Scrn button to copy your entire screen to the Windows clipboard.Press Alt Print Scrn to copy just the active window to the Windows clipboard.Open MS Paint:Start, Programs, Accessories, PaintWhen Paint opens, press CTRL-V to paste the clipboard, save the new Paint file to your desktop or someplace you can remember. JPG files take up less hard disk space than BMP files and are just as readable. Make as many screenshots as you need. Practice makes perfect. Be careful your screenshot does not contain any personal information. Practice viewing your images before you upload them to be sure they are okay.Some sites will let you attach a file directly to your post. If the site has some kind of attachment/upload function it is usually easiest just to use it. If there is no such function in your message board to upload files, then use a free third party image hosting WWW site.Create a free account on some free picture hosting web site. You can always remove your account later if you want. Here are some free image hosting sites:http://www.imageshack.us/http://photobucket.com/Using your free account, upload your screenshot(s) (the JPG or BMP files) to the site and it will return to you a URL web address (a Direct Link) for your new image(s) which you can paste the Direct Link in a message post, email, etc.Post that Direct Link web address back here in your response and we can click on the link address and see your screenshot. Post as many as you need - the sites are free.Then maybe you can get rid of some other things.When you are done, what you post for others to use should look something like this link to the image of my poor Task Manager showing all my processes:http://img96.imageshack.us/img96/6530/taskmanagerv.jpg Please vote my posts as helpful so I can get lots of points. I am saving up for a pony!

http://i275.photobucket.com/albums/jj303/briboy64/task.jpg?t=1282493795

http://i275.photobucket.com/albums/jj303/briboy64/task.jpg?t=1282493795 I just posted the new task manager shot. I'm considering the SCSI cable which connects the hard disk to the adapter might be old. It's a few years old and I was told the ribbon has to be replaced every so often. Since wires connect through it- to each of the connections on the hard disk(68 pins), that could also be a problem. But, I posted the above from task manager

Very good job.It could be the SCSI cable, but something else catches my eye.Recently in some thread around the corner is discussion of poor performance that may be related (perhaps coincidentally) to the Windows Automatic Update Client process. Here is the thread: http://social.answers.microsoft.com/Forums/en-US/xpperformance/thread/2e9bce71-788f-4f8a-bfed-bb713a300922If your TM, that would be the wuauclt.exe process.Symptom = disk thrashing on boot up, poor performance, sometimes it might be okay, Task Manager... doesn't really show too much interesting stuff.I experienced this phenomenon too which seems to have occurred around the last batch of Windows updates (8/13/2010). Was your system okay prior to that date if you can recall? Now I am not convinced there is a problem with the updates exactly - I am not sure what it is... But it is not just me and I figure that until it is sorted out, I have just disabled my WU Service and will wait a while for somebody else to figure it out since I am tired of trying things. There are lots of "ideas" but I am not fond of them exactly since some do not make sense.The problem is mostly on a fresh reboot when WU connects to Microsoft as it should and tries to figure out if there is anything to do and if not, it should go away, but it seems to keep running and running and running...On your system, when it is exhibiting the affliction, use TM to terminate (End Process) the wuauclt.exe process and then see how things look. Even it seems like WU is mixed up later on some other day, you can always "reset it", but you are just testing right now. You want to see how your system works when WU is not running.If things look good, disable the Automatic Update Service (that is how mine is now), reboot and you do not want to see wuauclt.exe hanging around in the TM. Just remmeber how you did it, so you can turn it back on and off a few times to see if that is your problem - you can always get updates another way and if it seems to work, there are some other sdjustments to make that do make sense until the MS people come up with a better idea.To disable the Automatic Update service, click Start, Run and in the box enter:services.mscFind the Automatic Updates service, right click, Stop it (you could test your system with it stopped now too), Properties and set it to Disabled, OK your way out, then restart your system and see if things are better. You do not want to see wuauclt.exe in the TM. I would do it a couple times to be sure, then set it back to Automatic, reboot and see if things are bad again to convince yourself that is it (or has nothing to do with your issue).Depending on how it goes, we can then adjust your WU so it still gets updates, but does things a different way.Please vote my posts as helpful so I can get lots of points. I am saving up for a pony!

I disabled the Automatic Updates in Services.msc and rebooted to make sure it isn't in the Task Manager- which it isn't. You're right that I first noticed the slow speed of the computer at around August 13th. I assumed because I uninstalled PCTOOLS Firewall, that was to blame. It may be what you mentioned above though regarding the last updates Microsoft made. Will keep watching the computer to see if it stays this way. Am still buying a new SCSI cable though, since the one I'm using now is several years old and even IDE cables need to be replaced every now and then.

Good job. In the meantime, you might read through that other post to see if it sounds like your system, but I would not be applying some of those suggestions or start trying things just yet. I need to catch up on that thread to see what is new lately...Let us know how you are getting on after some time and maybe a few reboots.Please vote my posts as helpful so I can get lots of points. I am saving up for a pony!

The system is stable after three reboots. That seemed to be the problem- related to Automatic Updates. The other post had some point from users but did not make sense. On a side issue-antivirus support, are there any recommendations for good products? I uninstalled the previous one that I had-after uninstalling Zone Alarm Firewall.

I am going to try to makes some sense out what I did to my system to work around the problem.The method is in that other thread (or maybe I read it elsewhere), but like you said... that thread is confusing and has some what I think are not too good ideas. Check back in a day or two or set up an email alert if you want on this thread and I will update about this stupid AU problem - I don't have good instructions yet, but need to make some.You can still check for MS updates from Internet Explorer anytime you want. MS likes to put out a batch the second Tuesday (Update Tuesday) of every month.If Malkeleah is still listening, maybe she will suggest antiwhatever programs. I can't remember what she likes, but I think she has more real world experience.I just use MBAM and SAS regularly - I surf pretty dangerously hoping my system will get afflicted on purpose so I can then learn how to fix it.If I suspect malware anywhere, I am always going to start with these two free ones:Malwarebytes (MBAM): http://malwarebytes.org/ SUPERAntiSpyware: (SAS): http://www.superantispyware.com/I would not recommend Norton, McAfee, ZoneAlarm or AVG - they seem to cause the most performance headaches with too much protection sometimes, but now you are a performance troubleshooting expert. And... you learned how to make and post good screen shots. Who-hoo! That instantly revealed the issue. Please vote my posts as helpful so I can get lots of points. I am saving up for a pony!

Someone posted this on another web site and they are also pointing out that exe file you previously mentioned and the same exact scenario that I had last week(and week before). Posted <abbr class="published" title="2010-08-18T08:07:12+00:00">18 August 2010 - 03:07 AM</abbr>Good morning,For the last 3 weeks, I have had a problem with my laptop at startup. For the first 10 min, the CPU is used at 100% and I can't do anything. A similar problem occurs when I shut down windows XP. I see the message "saving your configuration" for 5 min before windows turns off. I downloaded Process Explorer and I noticed that the culprit was windows update. I can see svchost and the correspondingWuauclt.exe taking up all the memory for 10 min. When I kill the process, I can use my laptop normally.I have windows XP SP2, and I ran CCleaner and Hijack this. The log is below.The problem is not related to the use of XP2 instead of XP3 since I refused the XP3 update at least 6 months ago.Is there anything suspicious in my log? Thank you!Sebastien

If my notes don't make sense, let me know what part is unclear to I can change it. I only tested it on ME so far.Allegedly, Microsoft has issued a statement:"We have gotten reports from multiple sources and consider this to be a live service issue and we are investigating it as a Priority 1."This is my statement on how to workaround it for now:The Automatic Update service seems to be involved in this issue. Not all machines experience the issue. The Automatic Updateis supposed to run, look for stuff to do and if it finds nothing to do, it should turn itself off. It is sometimes not turning itself off or taking a very long time to figure things out and keeps running and a symptom is excess HDD activity.You can totally disable the Automatic Updates service in XP, restart your system and not have any future problems and wait for ideasand perhaps a fix from Microsoft or you can change the way Automatic Updates are handled and leave the Automatic Update Service running.There are two kinds up updates you can get from the Microsoft web site:Windows UpdatesMicrosoft UpdatesThe workaround I am using is to configure your Automatic Updates to leave the automatic Windows Updates enabled and disable the automatic Microsoft Updates. If you disable the Microsoft updates, you will not get updates for MS Office, Windows Live or Silverlight until you enable theMicrosoft updates again (later). Here are the temporary consequences.What are the differences between Windows Updates, Automatic Updates, and Microsoft Updates?"While Windows Update provides you with updates specifically for Windows, Microsoft Update expands the service to download and install updates for other Microsoft software, such as Microsoft Office and Windows Live [as well as Silverlight & Microsoft Security Essentials]. Automatic updating is a feature that allows you to set your PC to automatically download and install updates using either service, making it easy and convenient for you to keep your Windows PC current."You will still automatically get the Windows updates that come out the second Tuesday of every month (Microsoft calls this "Patch Tuesday") and sometimes you may get more Windows updates before the next Patch Tuesday, but until MS figures it out and fixes it you will have to remember to check for any Microsoft Updates yourself by hand (you are going to disable this part for now).To turn off Microsoft updates, you must be using Internet Explorer, click Tools, Windows Update and on the left hand side of theUpdate page, click Change settings.Scroll down to the bottom of the page and click the box that says:Disable Microsoft Update software and let me use Windows Update only Click Apply changes now and reply in the affirmative (Yes) to the message box. Then restart your system and you should see the wuauclt.exe process show up in Task Manager like it always does on a reboot, and if your system needs no updates, the wuauclt.exe process should go away - in a few minutes depending on your system.That should be it. You may want to reboot a time or two and check the Processes tab in Task Manager as soon as your system is ableand you can watch the wuauclt.exe Process go away.If you want to turn the Microsoft Updates back on sometime later to see if there are any updates, using Internet Explorer, click Tools, Windows Update and on the Update page, click the green arrow "Go" button to the right of the message "Get Microsoft Update Today!" That will turn the Microsoft update back on and you will have the wuauclt.exe problem again the next time you reboot (unless it is fixed by then).You can turn your Microsoft Updates back on anytime you want and check for updates or, if you can remember after the next Patch Tuesday, you can turn your Microsoft Updates back on and check for Microsoft Updates then and get whatever updates needed. Youare in control.When you get done with all your updates, either disable the Automatic Update service and reboot, or disable just the Microsoft Update part again and reboot when you are done.Maybe Microsoft will have this figured out soon, but this is what I am doing for the moment.Thanks PA Bear for the notes and other postings.I need YOUR votes for helpful replies and Answers. I am saving up for a pony!

I was wondering of the issue concerning "wuauclt.exe" was resolved? Reason being, I could not find anywhere in Windows Update where it says "disable microsoft update software and let me use Windows Update only." Following is the screen shot I took: http://img148.imageshack.us/img148/870Also, here are my Windows TM screen shots: http://img33.imageshack.us/img33/4517/taskmanager1.jpghttp://img101.imageshack.us/img101/1228/taskmanager2p.jpgHope I cut and paste them correctly and that they work.I had also read another thread concerning "all SVChost.exe files should be in C:\Windows\System32" and that any found in any other location are part of malware. I did a search on my computer and found about 67 items for SVChost.exe. Can I delete any that are not in C:\Windows\System32?: http://img252.imageshack.us/img252/4884/svchostexesearch1.jpgWhat about all the other very old items? Can I delete those as well in an effort to improve performance?After all I've read, and there was plenty, I get that AVG is not good, so I shall eventually remove this program and go with what I had read as suggestions: NDD32 (commercial) or Avast (free) or SAS.Any other information you may need, please let me know.Thank you.