Tech: Hey Max!!! RPCSS.EXE

Subject: Tech: Hey Max!!! RPCSS.EXE
From: GUEST,.gargoyle
Date: 29 Apr 04 - 11:06 PM

Why....(no doubt there is technical application that by-passes my plebian knowledge ((nothing beyound basic HTML)) for the RPCSS.EXE...to activate when contacting the http://mudcat.org....It is not Java, nor MS, nor anyother readily acknowleged application....

WHY does it want to "phone home" and what is it sending.....and why is it here?

Sincerely,

Gargoyle

A paranoid knome.

Subject: RE: Tech: Hey Max!!! RPCSS.EXE
From: Jim McCallan
Date: 29 Apr 04 - 11:26 PM

Enjoy!

Jim

Subject: RE: Tech: Hey Max!!! RPCSS.EXE
From: GUEST,.gargoyle
Date: 29 Apr 04 - 11:43 PM

JIM mCcALLAM!

Thank you for a prompt responce.....so expunged from your sources we have:

ANY program can ask ANY OTHER program on MY MACHINE to do something for it WITHOUT MY KNOWLEDGE?" The sad truth is that, yes, this is true

On Windows 9x, if the author could plant a program that registers itself with the portmapper (rpcss.exe) and communicate with it remotely, it would have unlimited access to the machine. In other words, you'd have a full-blown Trojan horse on your hands

The answere we are missing is.....? Why does MAX want to do this? (profit)(espeonage)(tom-foolery)

Sincerely,
Gargoyle

Subject: RE: Tech: Hey Max!!! RPCSS.EXE
From: Jim McCallan
Date: 29 Apr 04 - 11:54 PM

Interesting subject!

This site may allay a few fears you have, though. It mentions Zone Alarm Firewalls

Jim

Subject: RE: Tech: Hey Max!!! RPCSS.EXE
From: Jim McCallan
Date: 29 Apr 04 - 11:58 PM

... From that last site...

"I've been sorta following this thread a little. Just wanted to comment that the rpcss.exe file is not as evil as everyone thinks and present a little insight from a practical view. it's more a case of it being "ill behaved". In most cases where there has been an incident with the rpcss.exe file it has come back to a case of configuration of networking in some manner. Proper configuration with an outdated file somewhere in the loop - forcing values into the TCP/IP setups for some cable users - dialup networking (for other ISP access) and ADSL software (winpoet) used on the same machine - inproperly configured router software in home networking sceinarios - and just plain old currupt files somewhere on the system - all these can cause problems that point to the rpcss file. rpcss.exe doesnt do anything until it interacts with some other part of the system. But anyway,,,rpcss is needed in some cases for proper functioning. It doesnt hurt to block it from getting out on the net for the most part because rpcss's activities take place on the machine , interacting with other components that do pass information on the net, but the rpcss file its self doesn't. even if your logs show something from rpcss.exe its not really from rpcss its from another item that sent information to rpcss and the rpcss.exe file just passed the information thru - think of it (when it acts this way) as a "mini switch" (not router) that simply directs the info where it wants to go.So yes in a way you could say that it does communicate to the network, and I think in some MS documentation it treats it in that manner.
This is a practical view. I have a whole thing on this from one of my MSCSE class mates but cant find it right now. And if memory serves me correctly we touched on its activity a little in Cisco router school a few years ago as it was just something that somehow came up in conversation while discussing OS interaction with Cisco products."

Jim

Subject: RE: Tech: Hey Max!!! RPCSS.EXE
From: Cattail
Date: 30 Apr 04 - 03:06 PM

Hi all.

I always delete RPCSS.EXE out of my machine, along with ADVPACK.DLL
and AMSTREAM.DLL from the system directory.

In actual fact it's better to create a directory somewhere and move
the files into that. You can then move them back again if something
doesn't work. (*Might* have to use DOS for that though).

I'm using windows '98 second edition by the way, but I can't remember
where I got the tips to remove these files from, it's a long time
back.

It has never seemed to do my machine any harm over the years, but
there again, I don't use streaming audio/video, or any of the other
stuff thats out there. Sooo..... You pays your money and you takes
your choice.

As always, the usual disclaimer. Remove files at your own risk!

Hope this helps.

Cattail !

Subject: RE: Tech: Hey Max!!! RPCSS.EXE
From: GUEST,sorefingers
Date: 30 Apr 04 - 07:58 PM

Abour Malign Intentions and Intelligence.
1
You cannot write a script to slave a machine that has any unique settings
2
100% of computers will have one or more nonstandard settings.
3
Therefore the chances of your being hijacked are about zero UNLESS - ahem Gargoyle - somebody invites the intruder in with an mIRC open port
but that might be the FBI winding you up - YOU NEVER KNOW!

Subject: RE: Tech: Hey Max!!! RPCSS.EXE
From: GUEST,.gargoyle
Date: 01 May 04 - 12:22 AM

Appologies to Max, Joe and the community

It was a personal problem that was resolved through notes on rings of saturn website...(good lynix,unix info)

The problem (based on a date log) originated with the "gift" of a Lexmark Printer/Scanner/Fax. All hell broke loose. Gave the printer back and uninstalled the software according to instructions.

Hell continued.

Using a START/RUN and MSCONFIG.....and the click-power.......LexStart.exe....LexBce.....RPCSS.exe and a couple other beasties....Trickler 3202....and the notorious AIM.exe were removed from the startup file......

Know running a clean, mean, hyper-machine with only 3 to 6 network connections and not the 18 to 24 sloggers from before.

Sincerely sorry,
Gargoyle

Subject: RE: Tech: Hey Max!!! RPCSS.EXE
From: Jim McCallan
Date: 01 May 04 - 12:28 AM

Nice you got it sorted.

Jim

Subject: RE: Tech: Hey Max!!! RPCSS.EXE
From: Max
Date: 01 May 04 - 10:16 PM

I knew you'd sort it out gargoyle. Tom-Foolery is my favorite, but the others are fun too. You're a fine man sir, if you ever come to the east coast, let me know, I'll buy you dinner.

Subject: RE: Tech: Hey Max!!! RPCSS.EXE
From: Big Mick
Date: 01 May 04 - 10:23 PM

Got to give you your props on this one, Garg. Glad you sorted it out.

All the best,

Mick