Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

RPC (rpcss) random errors?


  • Please log in to reply

#1
gust0208

gust0208

    Member

  • Member
  • PipPipPip
  • 311 posts
Hey everyone,

I have been having occasional errors with the Remote Procedure Call which forces a reboot in 1 minute (running Windows XP SP2 with all updates). I searched online and found information linking it with a few viruses, most namely the old MSBlaster worm. I did a full scan with Symantec Anti-virus and found one virus and removed it. Further scans are clean. The system is also clean when scanning for adware/spyware with SpyBot and Adaware. The error seems to occur randomly and not connected with any certain activity and can happen anywhere from once a day to around once a week. It can be cancelled with the "shutdown -a" command.

Any ideas on where to look for the ghost in the machine? I had similar errors around 1.5 years ago and cleared up on its own.

Cheers,
Tom
  • 0

Advertisements


#2
Sintic

Sintic

    Member

  • Member
  • PipPip
  • 22 posts
Tried running the actual MSBlaster removal tool, if of course it is that?

http://securityrespo...moval.tool.html

It is also possible to disable RPC from shutting down the computer, it's the kind of thing i would do, but probably not recommended to keep disabled :whistling:

start>run> SERVICES.MSC /S
Click properties for Remote Procedure Call (not Remote Procedure Call Locater)
Then locate the Recovery tab, you will see.

Edited by Sintic, 22 April 2006 - 12:10 PM.

  • 0

#3
gust0208

gust0208

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 311 posts
Thanks for the reply and I wasn't clear in my first post. The virus found was not the MSBlaster bug, but something named "HackTool" or "HackerTool". I searched on them and did not find much information. I have kept my Symantec up to date, so I was frankly suprised to find anything when doing the initial scan.

Cheers,
Tom

Tried running the actual MSBlaster removal tool, if of course it is that?

http://securityrespo...moval.tool.html


  • 0

#4
gust0208

gust0208

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 311 posts
Hey Sintic,

Thanks for the tip on the changing what it does on failure in the services tab! That was awesome! Now I can fidget it with it, and if nothing else change the number of minutes to restart to some arbitrary large number or have it run "shutdown.exe -a" in response.

Thanks again,
Tom

Tried running the actual MSBlaster removal tool, if of course it is that?

http://securityrespo...moval.tool.html

It is also possible to disable RPC from shutting down the computer, it's the kind of thing i would do, but probably not recommended to keep disabled :whistling:

start>run> SERVICES.MSC /S
Click properties for Remote Procedure Call (not Remote Procedure Call Locater)
Then locate the Recovery tab, you will see.


  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP