Process Running-->>RPCSS.EXE

RPSCC.EXE

Everytime my computer loads, this service loads and tries to connect to the internet. My firewall shows two instances running, one connecting to a port number, and the other to DCOM. They don't send or recieve, just sit there and listen.

I've done the google thing, and found that it's supposed to have something to do with Visual Studio, which I do have installed. However, it seems to serve no actual purpose, and is accused of security issues as well as causing instability. There were also another several articles that accused it of being a M$ trojan that reports back to them.

Long story short, I want it gone. In comes the problem I'm posting about. I can't get rid of the damn thing. I can locate the file in Windows>System. Attempting to simply delete it results in the "This program is in use" message. However, I've been unable to find any way to shut it down. Taskmanager doesn't show it's running. Msconfig doesn't show an entry for it. My firewall (Outpost) offers the option to break the connection. Great idea, except that it doesn't work. It's on the list of blocked services, but runs anyway. Tried renaming it, and that doesn't work either.

I'm running Windows ME.

Does anyone have -any- ideas here?

-Keisha

download this prog:
http://www.webmasterfree.com/procview.html#
it shows all running processes under windows 9x/me
there should be your RPSCC.EXE somwhere. if you mark it in the list in the window beneath there will be the path to the application. then kill the app and then delete it
this should help...

--------------------------------------------------------------------------------------------------------------------
"Knowledge is the Real Power"

I don't know if ME has dos, if it doesn't download it and put it on a boot disk. Boot up dos and delete it that way. Then windows can't do anything about it and your problem is solved. I hope this helped. :)

Okay, I think you should tackle it via BIOS level.

By the way, nice tweaking docs you posted last ;)

Wich port does it open?

I've read a post on Agnitum Outpost (I use it too) about services, and someone said then although the service is running they couldn't stop it ( they could but, it would give you a BSOD ) but they assured that altough it was running the firewall was blocking it.

I don't have the link here at work but i can post it when i got home.

You can try search their forum, it's got good tips for the firewall....

http://www.agnitum.com/forum/

I wouldnt worry about it man. I noticed the same thing about a year ago, researched it and left it alone. You will probably see no issues with it. If you want to see the open TCP and UDP connections and there owning processes DL this little tool, hxxp://online.securityfocus.com/tools/1896, (sorry, I dont post direct links in forums).

RPCSS.exe is a key core component of window NT / windows 2000

It will open some sockets at boot time, you cannot stop this. You can firewall them from outside if you like, it shouldn't affect it, but DON'T KILL THE PROCESS

This is not a trojan, do not kill it. Otherwise you'll be sorry. Really :)

Of course this doesn't stop someone writing a trojan which is called RPCSS.EXE, but the one which runs by default isn't one.

On windows 95/98 anything called RPCSS.EXE probably IS a trojan and should be killed immediately.

Keisha.I agree with Slarty dont kill the process!
Do the msconfig thing but look for Dcom and uncheck it.
It opens ports 135,500 and1025.
To see if it is running on your comp look in the win folder if you see a lot of files starting with fff then its running. it seems to bypass firewalls somehow
Hope this helps
mike

Oops! process to uncheck is MDM microsoft debug manager under startup sorry.
This problem has been around since 1999

I got all of the start up methods from some site. I think the orginal site is www.TLSecurity.net not sure though but anyway here they are just look in all of these places for what ever is starting up...sure u could do it the easy way and d/l a app and have it show u the path but well uh um this funner if u do this and u ummm learn to..yeah thats it any way here it is.

All Known and (so called) Unknown Windows Autostart Methods (10/03/2001)

1. Autostart folder

C:\windows\start menu\programs\startup {english}
C:\windows\Menu Démarrer\Programmes\Démarrage {french}
C:\windows\All Users\Menu Iniciar\Programas\Iniciar { Portuguese, Brasilian }

This Autostart Directory is saved in :
* [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
Startup="C:\windows\start menu\programs\startup"

* [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
Startup="C:\windows\start menu\programs\startup"

* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders]
"Common Startup"="C:\windows\start menu\programs\startup"

* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders]
"Common Startup"="C:\windows\start menu\programs\startup"


By setting it to anything other then C:\windows\start menu\programs\startup will lead to execution
of ALL and EVERY executable inside set directory.
Addendum : as of 10/03/2001 Subseven 2.2 now uses this method.


2. Win.ini
[windows]
load=file.exe
run=file.exe

3. System.ini
[boot]
Shell=Explorer.exe file.exe

4. c:\windows\winstart.bat
'Note behaves like an usual BAT file. Used for copying deleting specific files. Autostarts everytime.

5. Registry

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Whatever"="c:\runfolder\program.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]
"Whatever"="c:\runfolder\program.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Whatever"="c:\runfolder\program.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Whatever"="c:\runfolder\program.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Whatever"="c:\runfolder\program.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Whatever"="c:\runfolder\program.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Whatever"="c:\runfolder\program.exe"


6. c:\windows\wininit.ini

'Often Used by Setup-Programs when the file exists it is run ONCE and then is deleted by windows
Example content of wininit.ini :
[Rename]
NUL=c:\windows\picture.exe
' This example sends c:\windows\picture.exe to NUL, which means that it is being deleted.
This requires no interactivity with the user and runs totaly stealth.

7. Autoexec.bat

Starts everytime at Dos Level.

8. Registry Shell Spawning

[HKEY_CLASSES_ROOT\exefile\shell\open\command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\comfile\shell\open\command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\batfile\shell\open\command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\htafile\Shell\Open\Command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\piffile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\htafile\Shell\Open\Command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command] @="\"%1\" %*"
The key should have a value of Value "%1 %*", if this is changed to "server.exe %1 %*", the server.exe
is executed EVERYTIME an exe/pif/com/bat/hta is executed.
Known as Unkown Starting Method and is currently used by Subseven.

9. Icq Inet
[HKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps\test]
"Path"="test.exe"
"Startup"="c:\\test"
"Parameters"=""
"Enable"="Yes"
[HKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps\
This key includes all the APPS which are executed IF ICQNET Detects an Internet Connection.

10. Explorer start-up

Windows 95,98,ME
Explorer.exe ist started through a system.ini entry, the entry itself contains no path information
so if c:\explorer.exe exist it will be started instead of c:\$winpath\explorer.exe.

Windows NT/2000
The Windows Shell is the familiar desktop that's used for interacting with Windows. During system
startup, Windows NT 4.0 and Windows 2000 consult the "Shell" registry entry,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, to determine the
name of the executable that should be loaded as the Shell.

By default, this value specifies Explorer.exe.

The problem has to do with the search order that occurs when system startup is in process.
Whenever a registry entry specifies the name of a code module, but does it using a relative path,
Windows initiates a search process to find the code. The search order is as follows:

* Search the current directory.
* If the code isn't found, search the directories specified in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path, in the order
in which they are specified.
* If the code isn't found, search the directories specified in HKEY_CURRENT_USER\Environment\Path,
in the order in which they are specified.

More info : http://www.microsoft.com/technet/sec...n/fq00-052.asp
Patch : http://www.microsoft.com/technet/sup....asp?ID=269049

General :
If a trojan installs itself as c:\explorer no run keys or other start-up entries are needed.
If c:\explorer.exe is a corrupted file the user will be locked out of the system. Affects all windows
version as of today.

10. Active-X Component

[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\KeyName]
StubPath=C:\PathToFile\Filename.exe

Believe it or not, this does start filename.exe BEFORE the shell (explorer.exe) and any other Program normaly
started over the Run Keys.


11. Misc Information

[HKEY_LOCAL_MACHINE\Software\CLASSES\ShellScrap] @="Scrap object"
"NeverShowExt"=""

The NeverShowExt key has the function to HIDE the real extension of the file (here) SHS.
This means if you rename a file as "Girl.jpg.shs" it displays as "Girl.jpg" in all programs including Explorer.
Your registry should be full of NeverShowExt keys, simply delte the key to get the real extension to show up.

hope this helps someone and if it hurts some one I'm sorry

odd, but i just checked the running services on my win2k box and its not running. i do have a "CSRSS.EXE" running, but no "RPCSS.EXE"

OT: i must agree that TFC is MUCH better than CS Mucolaca. i assume you play, what name you use?

Ok, I spoke to soon. RPCSS is not a *core* component, but a process which runs some services. If you stop all the services it runs, then it will go away.

I'm not too sure what these services are, it might vary between windows versions.

I have often seen it running though. Don't kill it.

OK ppl don't be afraid for the RPCSS it's M$ Remote Procedure Call Service and it's an often used service at NT / 2000 boxes.

Here's some info on it by RjN:


RjN sheds some light on the RPCSS process:
The RPCSS program ... is the Microsoft Remote Procedure Call Service.

It facilitates the development and debugging of distributed applications, apps that are resident on machines other than the local one. While I’m unaware of any current exploits the software is designed to make it easier for “nonresident,” i.e. non-local applications to run on your machine, and vice versa.


The RPCSS program is installed by certain Microsoft products such as MS Visual Studio and Visual C++, Visual Basic, Interdev, and J++. I actually had this on my own system for some time--since its appearance seemed to coincide with my installation of the Microsoft "Evil Movie Player" (necessary for playing all those .ASF files college people on networks insist on passing around), I assumed it was some kind of multimedia handler a la MPREXE and MMTASK.

Behavior
RPCSS opens ports on your machine (usually 135 as well as some "random" ports in the low 1000s) and proceeds to try and access the Internet, setting off programs such as Zone Alarm and firewalls with its suspicious activity. While the RPCSS program is probably supposed to serve some kind of legitimate purpose, it has nonetheless been cited for numerous stability problems as well as security concerns. (Not to mention the unverified, but fairly wide-spread, other allegations...)

The Microsoft Machine Debug Manager (mdm.exe), to my knowledge, does not connect to the Internet itself. However, it is still a rather ill-behaved program that leaves scads of temporary files on the hard drive that it never deletes, and fails to unload properly (on shared computers, when a user logs on a new instance of mdm.exe may start, but it won't necessarily exit when the user logs off. Depending on how many users have used the PC since the last reboot, dozens of copies of this program could be simultaneously running, eating up CPU and memory!).

Solutions
While privacy implications of these programs have yet to be established, the RPCSS program is known to cause crashes and fatal errors on some PCs using Dial-Up Networking, as described here. The program doesn't seem to do anything useful for most people, and several users have reported deleting it without any ill effects. (Note: RPCSS appears to be critical to Windows NT operation--see warning below.) The Debug Manager may be useful to power users and software developers, but for the majority of users it is probably just wasting memory. My recommendation for Windows 95 users is to rename these files (rpcss.exe ->rpcss.ex_, mdm.exe ->mdm.ex_) if you are concerned about them, or if they cause problems on your system. The RPCSS file is normally located in C:\Windows\System and the MDM.EXE file may be located either there or C:\Windows -- but for best results, use Windows' Find to locate all copies. Renaming the files allows you to restore them later if you ever need to.
Note: Microsoft suggests that users can safely remove mdm.exe without ill effects. See http://support.microsoft.com/support.../q221/4/38.asp for more information.

Source: http://www.cexx.org/rpcss.htm

more info available on:
http://www.cexx.org/rpcss.htm
http://www.cexx.org/rpc.htm

Summary: ppl using Win 95 / 98 can safely rename the RPCSS when they do not run or need those "power" services. However Win NT / 2000 users should NOT delete nor rename those files. see http://support.microsoft.com/support.../q221/4/38.asp

For Win 95 / 98 / Me users, check out this forum thread it explains some probs with RPCSS.exe

RPCSS can cause 100% CPU activity when some1 does a spoof attack on your box. This prob is explained in the M$ knowledge article q193233
http://support.microsoft.com/default...;EN-US;q193233

I hope this and my previous info gives you all a clue what RPCSS is all about :)

You can also visit this forum thread about RPCSS
or
this forum thread
or this page

oh of couse I play my name is --==Mad**Cow==-- I moslty just play on the Smooth server if u want the IP I'll send it to ya

oh yeah if u don't have nt or 2k u can d/l the RPS I think I saw this at www.windowsxp.nu

Put Unix on it that will rid yah of the problem ;)