Seen similar posts but not one for XP. Pretty self-explanatory situation: services.exe runs at 30+% cpu at all times. Virus scans/fixes not helpful.Please help.Thanks,Andrew1 person needs an answerI do too

Hi Olivia and Izzy, Have you observed this happening when working with one particular application? Try the below methods and check for the results:Method 1:Check if the issue persists in safe mode, to boot the computer in safe mode:a. Restart the computer and press and hold F8 key (Press and hold f8 key before the windows logo).b. From the advanced boot option select ‘Safe mode’. Method 2:If the issue does not persist in safe mode, there might be some third-party application causing the issue. To narrow down you may follow the below method: Boot the computer in clean boot and check if the issue still persists. Below link will help you in booting the computer in clean boot: How to configure Windows XP to start in a "clean boot" state: http://support.microsoft.com/kb/310353 If the issue does not persist you may continue with step 2 from the above link. Make sure you reset the computer to normal mode from the section “Steps to configure Windows to use a Normal startup state” Regards:Samhrutha G S - Microsoft Support.Visit ourMicrosoft Answers Feedback Forum and let us know what you think.

I suggest you download Process Explorer.For further information about Process Explorer see here:http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspxThis freeware utility performs a similar function to the Windows Task Manager but it goes much further. In Process Explorer place the cursor on Services.exe, right click and select Properties. Click the Services tab and see what services are registered there. On my computer Event Log and Plug and Play appear there. Plug and Play detects Devices during the boot process. If it encounters a problem it will delay completion of the boot. Go to Device Manager and see if there are question marks against any device? You can locate Device Manager by selecting Start, Settings(some computers),Control Panel, System, Hardware, Device Manager. Another line of enquiry I suggest you may follow. Examine the System Log in Event Viewer for Warnings and Errors. You can access Event Viewer by selecting Start, Control Panel,Administrative Tools, and Event Viewer. When researching the meaningof the error, information regarding Event ID, Source and Description are important. A tip for posting copies of Error Reports! Run Event Viewer and double click on the error you want to copy. Locate the button resembling two pages. Click the button and close Event Viewer. Now start your message (email) and do a paste into the body of the message. Make sure this is the first paste after exiting from Event Viewer.Hope this helps, Gerry Cornell

Hi Samrutha --Thanks for your reply. The problem does not persist in safe mode or clean boot. So it sounds like you're saying it's some third party application. Just not sure what you want me to do by continuing "with step 2 from the above link." Do you want me to slowly add-back applications, rebooting between each one until I find the culprit? Seems laborious but will do so if that's the best/only way to proceed.If helpful, please read my reply to Gerry below.Cheers,Andrew

Hi Gerry --Thanks for getting back to me. I use Process Explorer. And have just the same two services (Event Log and Plug and Play) associated with services.exe that you have.I'm in clean boot mode right now so the problem does not manifest itself (see my response to Samrutha above). But I will return to normal boot, look into the possible Plug and Play issue and post the System Log as you request, shortly.Cheers,Andrew

Hi Gerry --Looking thru the system log, I get the following error message quite frequently:Event Type: ErrorEvent Source: Service Control ManagerEvent Category: NoneEvent ID: 7001Date: 11/29/2010Time: 10:54:53 AMUser: N/AComputer: OFFICEDESKTOPDescription:The Windows Service Pack Installer update service service depends on the Security Accounts Manager service which failed to start because of the following error:The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Is this helpful?I don't think any of the other errors that appear from time-to-time are relevant but I'm no expert.

I would check the status of Services. Click on the Start button and select Control Panel, Administrative Tools, Services. Locate Security Accounts Manager in the list and check that the StartUp type is Automatic. If it is not set to Automatic right click and select Properties, General tab. There is a box after StartUp type. The options are available on a drop down by clicking on the arrow down to the right of the box. After making the change click on Apply and OK. Restart the computer and check whether it has started.If it has not started you will need to check the service which the Security Accounts Manager service depends on. This service is Remote Procedure Call which should also be set to Automatic and should have started. Change the StartUp type if necessary.Please let me know what you find..Hope this helps, Gerry Cornell

Okay. The Security Accounts Manager was disabled. I set it to Automatic and re-booted. System log shows no errors since the re-boot. But services.exe continues to use around 30% of CPU.Do I need to slowly add applications to the manual boot process until I see what causes the CPU needle to jump?Thanks for your continued advice!

Found something that should be relevant: using Process Explorer I see 3 threads under services.exe properties all labeled "kernel32.dll!CreateThread" that are using up the combined 30% of CPU. When I kill them, my system hangs.Tell me that's helpful! :)

You need a reason for changing the StartUp type of a service. The Event Viewer error gave that reason as it pointed to the reason why the error had occurred.What is your setting for Windows Update as my suspicion is that it has not been working. This can cause excessive CPU usage if it tries and fails.Select Start, Control Panel, System, Automatic Updates tab. Which of the four options has been checked?Select Start,Help and Support,Keep your Windows up-to-date with Windows Update.You should arrive at a Window offering two options. Express and Custom. Click on Custom. What happens?Review your Update History. Has the installation of the November updates succeeded or failed? If one or more have failed what is the Failure code? Double click the small red icon in the Status column for the failed update. Hope this helps, Gerry Cornell

Yes that is interesting.Which process is it that kernel32.dll is part of? I would expect it to be svchost.exe. If yes right click on svchost.exe, select Properties and the Services tab. Post a list of the services. That will tell me which copy of svchost.exe is involved.This could be malware. What are your anti-virus and anti-spyware arrangements?It is late here so I will not be able to respond again tonight. I will pick on your again tomorrow. Hope this helps, Gerry Cornell

So the problem seems fixed. I ran the Kraspesky Virus Removal Tool as well as ComboFix -- I'm pretty sure it was ComboFix that did the trick. A Google search on "kernel32.dll services.exe" turned up some other users having troubles. They seemed to get resolution with one of the above malware.Automatic Updates was turned off, by the way, but the history showed no errors in November. It's now on again, and there are no important updates needed.Not sure how I would know which process relates to the kernel32.dll in your question above? As I mentioned, it shows up in the services.exe thread. It still does but not with anything like the CPU utilization it did before.Thanks so much for you help. Happy to answer any more questions, if you're curious.

Just to be clear. Did you have any Windows Update showing for November as I would have expected you to see several updates?Kerenel32.dll - I have now figured where are seeing it.I have never used ComboFix. I guess I need to find out more about it. Too much to do at the moment. Never mind it's good tkeep busy <G>.Regards, Gerry Cornell