Process Running-->>RPCSS.EXE

[8*B@LL]

odd, but i just checked the running services on my win2k box and its not running. i do have a "CSRSS.EXE" running, but no "RPCSS.EXE"

OT: i must agree that TFC is MUCH better than CS Mucolaca. i assume you play, what name you use?

[slarty]

Ok, I spoke to soon. RPCSS is not a *core* component, but a process which runs some services. If you stop all the services it runs, then it will go away.

I'm not too sure what these services are, it might vary between windows versions.

I have often seen it running though. Don't kill it.

[VictorKaum]

OK ppl don't be afraid for the RPCSS it's M$ Remote Procedure Call Service and it's an often used service at NT / 2000 boxes.

Here's some info on it by RjN:


RjN sheds some light on the RPCSS process:
The RPCSS program ... is the Microsoft Remote Procedure Call Service.

It facilitates the development and debugging of distributed applications, apps that are resident on machines other than the local one. While I’m unaware of any current exploits the software is designed to make it easier for “nonresident,” i.e. non-local applications to run on your machine, and vice versa.


The RPCSS program is installed by certain Microsoft products such as MS Visual Studio and Visual C++, Visual Basic, Interdev, and J++. I actually had this on my own system for some time--since its appearance seemed to coincide with my installation of the Microsoft "Evil Movie Player" (necessary for playing all those .ASF files college people on networks insist on passing around), I assumed it was some kind of multimedia handler a la MPREXE and MMTASK.

Behavior
RPCSS opens ports on your machine (usually 135 as well as some "random" ports in the low 1000s) and proceeds to try and access the Internet, setting off programs such as Zone Alarm and firewalls with its suspicious activity. While the RPCSS program is probably supposed to serve some kind of legitimate purpose, it has nonetheless been cited for numerous stability problems as well as security concerns. (Not to mention the unverified, but fairly wide-spread, other allegations...)

The Microsoft Machine Debug Manager (mdm.exe), to my knowledge, does not connect to the Internet itself. However, it is still a rather ill-behaved program that leaves scads of temporary files on the hard drive that it never deletes, and fails to unload properly (on shared computers, when a user logs on a new instance of mdm.exe may start, but it won't necessarily exit when the user logs off. Depending on how many users have used the PC since the last reboot, dozens of copies of this program could be simultaneously running, eating up CPU and memory!).

Solutions
While privacy implications of these programs have yet to be established, the RPCSS program is known to cause crashes and fatal errors on some PCs using Dial-Up Networking, as described here. The program doesn't seem to do anything useful for most people, and several users have reported deleting it without any ill effects. (Note: RPCSS appears to be critical to Windows NT operation--see warning below.) The Debug Manager may be useful to power users and software developers, but for the majority of users it is probably just wasting memory. My recommendation for Windows 95 users is to rename these files (rpcss.exe ->rpcss.ex_, mdm.exe ->mdm.ex_) if you are concerned about them, or if they cause problems on your system. The RPCSS file is normally located in C:\Windows\System and the MDM.EXE file may be located either there or C:\Windows -- but for best results, use Windows' Find to locate all copies. Renaming the files allows you to restore them later if you ever need to.
Note: Microsoft suggests that users can safely remove mdm.exe without ill effects. See http://support.microsoft.com/support.../q221/4/38.asp for more information.

Source: http://www.cexx.org/rpcss.htm

more info available on:
http://www.cexx.org/rpcss.htm
http://www.cexx.org/rpc.htm

Summary: ppl using Win 95 / 98 can safely rename the RPCSS when they do not run or need those "power" services. However Win NT / 2000 users should NOT delete nor rename those files. see http://support.microsoft.com/support.../q221/4/38.asp

[VictorKaum]

For Win 95 / 98 / Me users, check out this forum thread it explains some probs with RPCSS.exe

RPCSS can cause 100% CPU activity when some1 does a spoof attack on your box. This prob is explained in the M$ knowledge article q193233
http://support.microsoft.com/default...;EN-US;q193233

I hope this and my previous info gives you all a clue what RPCSS is all about

You can also visit this forum thread about RPCSS
or
this forum thread
or this page

[Mucolaca]

oh of couse I play my name is --==Mad**Cow==-- I moslty just play on the Smooth server if u want the IP I'll send it to ya

[Mucolaca]

oh yeah if u don't have nt or 2k u can d/l the RPS I think I saw this at www.windowsxp.nu

[linuxcomando]

Put Unix on it that will rid yah of the problem