Here is an odd windows service problem

[Carol Haynes]

How do you remove a service that isn't listed in the registry?

I have been trying to get rid of a bunch of logged errors for a service that won't start because a SYS file is missing.

I thought OK : SC DELETE xxxxx

No go  - it reappears on every boot.

Looked int he registry and deleted xxxxx under Services for all users and Legacy stuff with the same name. Scan the registry now for xxxxx and it is not listed anywhere.

Restart the computer - and service is still trying to load!!! It isn't listed in the registry anywhere and it isn't listed under devices or the services applet???

Seems to be a common problem on this particular ancient Dell - it was installed by Dell but not removed when a device driver was updated. It is now redundant.

Anyone any idea how a service not listed anywhere in the registry, devices or services can still be trying to start and logging errors (and slowing down boot in the process)?

The only work around I have found it to put the registry stuff back and mark the service as Start=4 for each user. That stops the problem but I am mystified why I can't just delete the beggar?

[40hz]

Is there something in the system startup that's loading it? And is it in fact loaded as an actual service? Sounds more like it's an autostart program.

[4wd]

Sounds like a job for Process Explorer followed by Autoruns.

[x16wda]

Can you give us a hint on what the service or driver was?  Or what hardware?  One person's "ancient Dell" might be another's "newest stuff we got"...

One of our clients still has a stash of Gx1s, although I think they finally got rid of their 6300s.  In fact we just junked a 2400, most of their plants are running with 2500s now (with a smattering of newer boxes).  Cost avoidance is really big with some sectors of US manufacturing...

[app103]

Sounds like a job for Process Explorer followed by Autoruns.

-4wd (March 07, 2013, 06:19 PM)

Process Monitor might help, too, especially with finding out what exactly keeps adding it back into the Registry. Might be able to watch it in real-time. 

[Carol Haynes]

Is there something in the system startup that's loading it? And is it in fact loaded as an actual service? Sounds more like it's an autostart program.

-40hz (March 07, 2013, 12:24 PM)

No - absolutely nothing in Startup folder or registry Run, RunOnce etc. keys related to this item.

Can you give us a hint on what the service or driver was?  Or what hardware?  One person's "ancient Dell" might be another's "newest stuff we got"...

One of our clients still has a stash of Gx1s, although I think they finally got rid of their 6300s.  In fact we just junked a 2400, most of their plants are running with 2500s now (with a smattering of newer boxes).  Cost avoidance is really big with some sectors of US manufacturing...

-x16wda (March 07, 2013, 06:47 PM)

It is a Dell 1525 Inspiron latop running Vista SP2 Basic, 32-bit.

The service concerned is BCM42RLY - which is apparently related to an old Broadcom wifi driver which is no longer needed or relevant since Vista SP1. A new Broadcom driver has been installed and doesn't actually contain and BCM42xxx files.

I have found lots of references to the problem through Google - and a lot of frustrated users! I have not found a solution other than to change the registry Start key from 3 to 4 to prevent windows trying to load the service.

Sounds like a job for Process Explorer followed by Autoruns.

-4wd (March 07, 2013, 06:19 PM)

Process Monitor might help, too, especially with finding out what exactly keeps adding it back into the Registry. Might be able to watch it in real-time. 

-app103 (March 07, 2013, 07:15 PM)

There doesn't seem to be any processes that I can see that are related.

SC DELETE BCM42RLY

confirms deletion, and looking in the registray a Delete Pending key is generate - but after restart the only thing removed is the delete pending flag!!

The service is not protected by odd permissions  - I can backup and delete the Service entries in the registry and they are gone - and don't return after reboot.

Nevertheless - even though BCM42RLY is no long present any where in the registry as a string it still automatically attempts to start during start up.

Something distinctly odd is going on.


Having restored the registry entries and set Start to 4 the issue no longer appears (the setting is retained) but this is just a workaround which helps to stop pauses at boot time. I am intrigued as to what could be doing this?

[app103]

It could have a lot in common with the infamous ctfmon.exe that many can't seem to stop from loading. For that, changing a setting in something else gets rid of it, once and for all.

My guess is that something else that is set to load at startup or perhaps even a dll from something somehow is causing this to also startup. Does it startup when in safe mode? That could offer some clue, or even narrow it down a bit, as to what is causing this.

[J-Mac]

Carol,

You may have to restore (or create) three registry entries for BCM42RLY.sys and change (or initially set) their values to 4.

See this page:  http://msmvps.com/blogs/donna/archive/2009/01/17/dell-and-broadcom-need-to-fix-this-bcm42rly-issue-on-vista-system.aspx

Jim

[Carol Haynes]

Yes that is precisely what I have done - I am just curious as to why you can't simply remove this service, and how it is being initiated anyway?

[Tinman57]

  I had this problem with an HP computer once.  Turned out it was another HP app running in the background that kept bringing this service back to life every time it started at bootup.  I used a program (can't remember which one though) that logged everything from bootup and discovered the app that was recreating the service.  I replaced the app with another that didn't do this....

[Carol Haynes]

Yeah - that's probably it. I have returned the annoyance to its owner today so I can't play with it any more.

Maybe I am being stupid but I thought if you wanted to run something as a service it had to be registered as a service??

[x16wda]

Maybe I am being stupid but I thought if you wanted to run something as a service it had to be registered as a service??

-Carol Haynes (March 08, 2013, 08:09 PM)

Think of all the viruses and rootkits that found a way around that... 

[Tinman57]

Yeah - that's probably it. I have returned the annoyance to its owner today so I can't play with it any more.

Maybe I am being stupid but I thought if you wanted to run something as a service it had to be registered as a service??

-Carol Haynes (March 08, 2013, 08:09 PM)

  Well, with the ways these programmers are taking shortcuts now, there's no telling.