Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: pcb on July 08, 2003, 12:50:04 PM
-
With referrence to my former posting:
http://www.avast.com/forum/index.php?board=2;action=display;threadid=647,
I have taken "Avast!" and "ashmaiserve" out of Startup programs, and yes, it seems as though it is Avast that is using RPCSS.exe.
I am concerned about this, as it (RPCSS.exe) has been trying to access the internet, on a number of occasions (it has just made another attempt) Even though I block it with Kerio PF, it gets through and I find it in the Kerio's filter rules and Application MD5's ( I delete these entries, and they appear again each time).
Please would one of the moderators (Vlk or Pavel?) please respond to this in order to put my mind at rest:
- is this normal activity?
- why is RPCSS.exe trying to access the internet?
- why does Avast use RPCSS.exe?
I am running Windows 98se and Avast4.0.235 Home edition.
Many thanks.
PcB
PS. I have seen this report:http://cexx.org/rpcss.htm
but I'm afraid it doesn't help me regarding Avast and RPCSS.exe.
-
pcb,
I am sure one of the moderators will get back to you shortly, but please keep all postings on the same subject under the same string.
Just sign back into the forum, go back to your question and "reply".
It keeps things all together for us to review instead of opening half a dozen strings.
Anyway, AVAST does need to access the internet so that it can check for updates to the database and program. I am almost sure that it uses the RPC to get things going and access the internet.
If you block the RPC access with Kerio, AVAST will not update the database and you have created another problem. If Kerio "alert window" tells you that AVAST is using the RPC, then it should be ok to allow it. To make you feel more comfortable, only allow it for that one time. This way you will know when the RPC is activated and by what program.
One of the moderators should be able to provide a more detailed explanation.
Good luck
-
pcb
The Windows RPC endpoint mapper service, Rpcss.exe, may not correctly handle reentrancy (more than one pending request). If the RPC endpoint mapper is concurrently accessed by two processes, or twice within one process, an invalid page fault (exception 0E) may occur in Rpcss.exe.
This behavior is somewhat timing-dependent, and may not occur consistently on all computers.
There are no known issues with Windows 98 systems, and that is probably why it randomly occurs.
Try removing non-essential programs from the startup list to isolate which one conflicts with Avast when it trys to access the rpcss.exe
I will continue research into this for you.
:o
-
techie101,
Many thanks for your replies. I hadn't thought of RPCSS.exe being used for updating Avast (I would appreciate it if one of the moderators would verify this).
I actually don't have the auto-update feature enabled, but ask for notification.
Whatever, when Kerio notifies me that RPCSS.exe is trying to access the net, nowhere is AVAST mentioned-if it were, I would naturally grant it access!
I presume your second reply, techie101, is really for Joel, who is getting RPC errors, which I am not.
Once again my thanks for your knowledge.
I would still very much like to have official confirmation that RPCSS.exe is used by Avast purely to seek Avast updates.
Thanks,
PcB
-
So would I.
-
Well, I have found out via the program TaskInfo, that RPCSS.exe is indeed called up by Ashserv.exe, the main Avast module.
I have sent VLK a PM but he hasn't replied-probably gone on holiday.
I feel sure that RPCSS.exe is only used by Avast to get updates.
Nobody seems interested in
Nobody seems interested in enlightening us !
Take care,
PcB
-
pcb,
Indeed it does! Avast uses the Avserv.exe to establish a connection on the internet to the Avast server to check for updates. Depending on how you have your defaults set, Avast will either download them, or alert you to the new update/s.
I am not sure of when the moderators are scheduled online. You can tell by the green screen under the username. I have also sent them IM messages and have not received answers either.
Enlightment is found by those that refuse to stand in the shade!
Seek knowledge from others, and give it freely to them!
That's my motto....That's why I am here.
Take Care,
:D
-
Cheers Techie101,
I seek enlightenment, but keep out of the sun!
PcB
PS. What's this "I'm a llama" business?
-
Sorry people, but those who could enlighten you, such as the mighty Vlk, have really left for holiday for some time, so you should be patient... I hope you'll get your light soon 8)
-
Thanks, Igor,
I thought as much. Hope they have a good time.
PcB
-
Cheers Techie101,
PS. What's this "I'm a llama" business?
It's better than being a turtle!!!
*You can change this in Profiles if you which.... ;D
-
Aha!
Thankyou Techie101 for pointing me in the right direction.
I never venture far from reading or posting on forums..I still don't know lot's of things I'm sure I should.
I must say, given the choice I'd rather be a turtle, lugubriously paddling round the tropical oceans.
Mind you, things often make me want to spit, so maybe a llama's more appropriate!
cheers,
PcB
-
Cheers Techie101,
PS. What's this "I'm a llama" business?
It's better than being a turtle!!!
*You can change this in Profiles if you which.... ;D
I'm NOT a lama! LOL
-
Now I have discovered that even if you set the update for both Virus Database and Program to manual (ie. not auto, or notify), Avast still loads RPCSS.exe.
Now, if the program is set to not look for updates, then why is RPCSS.exe loaded at all?
I'm going to leave both settings to manual, and see if RPCSS.exe is still accessing the net, (or trying to).
Will let you know soonest if it does.
PcB.
-
Count me as ANOTHER worried user.
There is no doubt that Avast does initialise the RPCSS command, which is basically a local server which kicks in PRIOR to my firewall. (hence no point blocking it)
The question we gotta ask peeps, is W H Y ? ? ? ?
This aint no conflict with another program or anything to do with the updating (which still works after I shut RPCSS.EXE down, which I gotta use a utility to do as it doesn't appear under the active tasks menu....shady underhand process)
So c'mon MODS, where's the answers to these questions?????
1. Why does your program NEED TO start the RPCSS.EXE process?
2. Can we stop your program from executing this process?
3. How do you think your users would respond if they were informed that the security product they are using actually invites a hacker to target a specific port.
Hang on a minute.......
Maybe that IS the point!
Make the PC vunerable to hackers so that when the antivirus software kicks to protect us from the scummy no life low life, we all think, 'Hey, I'm glad I had this software!'
I'm assuming the mod's that were away when this thread started are now back from sunning themselves, SO LETS HAVE SOME ANSWERS before I delete this brilliant software.
Yes, I know I've had a good whinge, but I really DO love the software, resources are sweet compared to other memory hogging alternatives, but I just can't cope with this daft, and seemingly pointless server it starts.
-
There is no doubt that Avast does initialise the RPCSS command, which is basically a local server which kicks in PRIOR to my firewall. So c'mon MODS, where's the answers to these questions?????
After doing a little Boardsearch, i think i found the answer you looking for. For the rest wait untill VLK is back!:)
http://www.avast.com/forum/index.php?board=2;action=display;threadid=220;start=0
-
well, Jusme,
I'm surprised to find another person concerned about this issue-only Techie101, and now you, have voiced any concern.
You say that RPCSS.exe is not used in updating the virus signatures. If you did the updating manually, then I am not too surprised, as I presume that the RPC is only used to LOOK for updates. I have just tried updating manually after killing RPCSS.exe, and it worked fine, as you say.
However, I have been permitting the RPC service to access the net, and I received an update about an hour ago ( before trying the manual update).
( I have set the update service to advise me when an update is found).
I reckon that we will discover, when the moderators get back from their R&R, that there is nothing to worry about..at least I certainly hope so-I am beginning to like this program.
take care,
PcB
-
raman,
I wish you had posted this earlier-I would have had my answers then, and saved a lot of bother, lol.
I actually did a search before I posted originally, looking for "RPCSS.exe", and your link did not come up.
If I had known, I would not have posted.
I still think, however, that someone more knowledgable than me should query this further:
Most importantly: is RPCSS.exe , in fact, seeking access to the internet in order to look for updates, or not? ( is it OK to NOT allow it permission to access the net with a firewall?)
Does Avast really need RPC ? Can it not use some other service: what do other AV programs use to look for updates, or to communicate with themselves internally, as VLK seems to be asserting?
Is the RPC communicating with itself continuously, or only when it is looking for updates?
Cheers all,
PcB
-
I wish you had posted this earlier-I would have had my answers then, and saved a lot of bother, lol.
I did not follow this thread and i am certainty the wrong person to answer that question!:)
-
Thought you might be interested in this:-
Microsoft has released a patch for a critical flaw in Windows Exchange Server 2003, Windows XP, 2000 and NT 4.
The flaw involves the Remote Procedure Call (RPC) protocol, which deals with inter-computer communications. Microsoft warned that, under certain circumstances, the RPC might not check messages sent to the PC properly.
If a malformed message is sent to the target PC it can be routed through port 135 and used to run code on the infected PC.
A patch is now available.
"Microsoft has rightly classified this vulnerability as 'critical', said Pete Philips, penetration tester with security vendor Integralis.
"Any host with port 135 open to a hostile environment, such as the internet, is very vulnerable. We'd recommend patching as a matter of urgency."
Note the last line particularly.
Note also that the patch is not valid for Win 98.
I too am very concerned that RPCSS is called into action by Avast and have blocked it with my firewall. I am finding a steady stream of inbound UDP messages heading for port 135 getting stopped by the wall. Activating RPCSS allows remote control and configuration of your computer by a remote operator as far as I am aware. I would rather have a virus!!!
I have not yet found out how to disable RPCSS in Win 98 since the DCOM config commands from Win 2000 etc do not seem to be available.
-
Here's a quick fix that doesn't stop the process running, but strips the 'gummings' it needs to enable a server.
Disable the virus scanner from starting up using START/RUN then type msconfig and click ok.
Select the STARTUP tab in the pop up window, then uncheck the box alongside avast! to stop it loading.
Restart the PC.
If the virus scanner fails to start which is what you need, you can then simply go to C:\WINDOWS\SYSTEM and look for a dll file named Rpcltscm.dll.
Rename this to Rpcltscm.txt (note the change of extension)
Now run mscofig again to re-enable the virus scanner (check the box you un-checked earlier)
Restart the PC.
Avast still runs, still updates as normal, but now this pesky server is history.
Remember, the process RPCSS.EXE still starts and runs in the background, it just doesn't know how to run as a server anymore.
I don't know how effective this workaround is, the dll file may get re-written at some point, but so far, so good.
-
Hi pcb.
No I didn't update manually, avast still does that despite disabling RPCSS.EXE !!! (it updated with a new fileset only today)
Now someone still try to tell me it's used for updating!
Also, not allowing it to connect to the net does not seem to affect the functionality of the software, mine starts and seems to be running fine.
I gotta say MODS, all this seems a little fishy to me.
Microsoft have ADMITTED (under pressure, as usual) that there is security flaw with RPCSS, yet you seem unwilling to even explore this further despite these posts.
Can I ask, does your company use the RCPSS process for comunicating with our PC's, or have you enabled it for someone else, maybe for a fee?
Someone like..................................................MICROSOFT?
I know we've been asked to wait for a reply, but waiting 'aint one of my attributes, especially when it takes 3 hours to rebuild my operating system from scratch just because some scrote thinks he's Neo and has the right to fcuk with my PC!
-
Microsoft have ADMITTED (under pressure, as usual) that there is security flaw with RPCSS, yet you seem unwilling to even explore this
Like i said, i did not follow this thread, but if you do not like this Microsoft service why not disable it?
-
JusMe:
You have already read it above: VLK will be back on Monday and I can't help you with this technical question relevantly. If waiting 'aint one of your attributes, you can read the opinion VLK expressed in the thread above several times.
Can I ask, does your company use the RCPSS process for comunicating with our PC's, or have you enabled it for someone else, maybe for a fee?
Total bullshit. We are working hard on our antivirus programs for 15 years this month (well at least some of us ;) ) and we still like it. The reason why avast! Home is free is that we want to help to the home users and well, to make avast! a little bit more famous as well .
If you do not trust your antivirus vendor, how you can trust his programs? If you believe there is some kind of spyware/backdoor in avast, please by so kind and deinstall it immediately. But do not spread false accusations without any facts, please!
Pavel
-
Pavel,
I come from a place where the saying 'calm down' is sort of a catchphrase.
That was the first thing I thought of when reading your response, especially when I got to the bit that said:
-
OOOOPS!!!
-
Pavel,
It's nice to hear from you..it's been a long time since a moderator has responded to this thread.
I realise the others are on holiday, and you must be pretty busy.
Please realise that we are just concerned about this issue.
I don't know about anybody else posting here, but I am not a computer expert, though neither am I a newbie.
I have been letting RPCSS.exe access the internet, believing it to be a legitimate action, used by Avast to get virus updates.
At first, I blocked it, but then later, as it seemed OK to give it access, I did so, and have been doing so for the last 2 days.
Now, if this is NOT Avast calling on it to access the net, what have I been allowing to be sent in and out of my computer?
I hope you can appreciate my/our concern.
I would like to add that I have never even come across RPCSS.exe intill I installed Avast a short while ago.
If it turns out that RPCSS.exe has nothing to do with the Virus signature updating service, and can be blocked by a firewall without preventing Avast from doing it's job, (please see Jusme's last posting though, which I quote below) then I'll be quite happy, and won't bother anyone about it again.
I am, apart from this one issue, very impressed with Avast, and once reassured about this issue, and have a fuller understanding of how/why RPCSS.exe is used by the Avast, I will be a devoted user, I am sure.
Thankyou. I look forward to hearing from one of the software authors, hopefully on Monday or soon after.
Jusme..
you say: No I didn't update manually, avast still does that despite disabling RPCSS.EXE !!! (it updated with a new fileset only today)
and:
Also, not allowing it to connect to the net does not seem to affect the functionality of the software, mine starts and seems to be running fine.
.
If what you say is true, then what Pavel and Vlk said in this posting: http://www.avast.com/forum/index.php?board=2;action=display;threadid=220;start=0
is not true.
Raman,
I must believe them- that the RPC service is needed for Avast to be fully functional.
Cheers, all,
PcB
-
Strange, the preview is posting???
Anyway.........
the bit where you say I'm spreading false accusations.
Not to be too bitchy about it, I think you'll find they were questions, which you have ANGRILY denied.
Ok, I do beleive you (dunno why? jus do. maybe trust has to start somewhere)
I never really suspected your company of this type of underhand tactic.
What would be the point?
In the short term, yeah, make a quick killing by bundling, but in the long term you'd be doomed once the techies were onto it.
Lets just say the 'MS theory/QUESTION' was my way of 'opening doors'.
I love this scanner up to now, I even like the scanning GUI, and want it to work on my PC 'cause others I've tried just hog too much resource, so don't be putting me off by tellin' me to 'uninstall' just because I've said something that you don't like.
Isn't that called washing your hands?
I've read the previous on this, seen the comments VLK made.
Local ports can be routed to, so it 'aint safe.
An open port is an open port, be it local or otherwise.
The fact the program is RUNNING and LISTENING is a security threat.
Along with Microsoft themselves admiting this process can be exploited, I just cannot believe this is not seen as problem.
VLK has said he see's no problem with letting it run in the background.
There are many out there that disagree, including myself, but I look forward to seeing what the man has to say on his return in light of these postings.
At the end of the day, I've disabled it, and if you guys are happy with that, then so am I.
Still leaves one nigglin question though.
Why?
Guess I'll have to be patient :p'
-
PcP
I'm sorry, but I think I've got you confused a bit.
You have misunderstood what I have actually disabled on my PC.
I have not disabled RPCSS.EXE, VLK is right, it IS needed. (just try renaming it, see if avast works after that, you'll find it wont)
What I HAVE disabled is the DLL that allows REMOTE ACCESS.(Rpcltscm.dll)
That is not the same as disabling the WHOLE RPCSS process.
Sorry about that.
-
Boy....this turned out to be one heck of a thread!
Anyway...everyone please calm down! Name calling and insults (and cursty language) won't get this matter resolved. We ALL are interested in this now.
One thing I can add. My W98 system has RPCSS.exe called up whenever Avast is running, BUT DOES NOT ASK FOR INTERNET ACCESS. I have this blocked by my firewall, therefore, VLK's remarks that this process is used by Avast for inter-process communication seems believable.
I think that at this point, it has been determined that Avast uses the RPCSS not only for updating, but for the On line Protection Control, and all of it's other internal components since Avast will not function when RPCSS is disabled (not just blocked from internet access)
My FW has not recorded any attempts by the RPCSS process to communicate with, or to be used by any outside server other than "local machine".
I certainly take exception to the remark that Avast put a backdoor in to secretly communicate with our pcs.
Bunk on that one!
The Avast team has proven themselves in doing everything they can to make Avast one of the best av programs around. With every new release, "a bug" can creep in, but with cooperation from users......it gets fixed! If you can't stand with them and cooperate in a proper manner, then go find another av to use.
;)
-
Techie 101,
Unlike you, I have had RPCSS.exe access the net, and also receive, regularly. This is one of the "alerts" from my Firewall:
"Someone from c-134-76-211.b.dial.de.ignite.net [62.134.76.211], port 4944 wants to send UDP datagram
to port 135 owned by 'Distributed COM Services' on your computer" "c:\windows\system\rpcss.exe" . )
I have queried Ripe Whois about that address, which came up with this:
inetnum: 62.134.64.0 - 62.134.127.255
netname: BT-IGNITE-DIAL-5
descr: BT Ignite Dialin
country: DE
admin-c: BCCC-RIPE
tech-c: BNMC-RIPE
status: ASSIGNED PA
remarks: was VIAG-DIAL-5
remarks: appr. RIPE-NCC-20000918
mnt-by: IGNITE-DE-MNT
changed: dave.pratt@viaginterkom.de 20001017
changed: katrin.bihlmayer@btignite.de 20020115
changed: hermann.maser@btignite.de 20020404
source: RIPE
route: 62.134.0.0/16
descr: DE-VIAG-20000918
origin: AS8472
mnt-by: IGNITE-DE-MNT
changed: david.pratt@viaginterkom.de 20000919
source: RIPE
role: BT Ignite Customer Care Centre
address: Mergethaleralle 6-8,
address: 65760, Eschborn, Germany
phone: +49 69 3307 6611
fax-no: +49 69 3307 1111
e-mail: bccc.internet@btignite.de
trouble: SPAM/COMPLAINTS to: btignite-abuse@btignite.de
trouble: SPAM/COMPLAINTS to other addresses will probably be ignored.
admin-c: KM2133-RIPE
tech-c: HK376-RIPE
tech-c: ST378-RIPE
tech-c: SR1985-RIPE
notify: ripe@de-ignite.net
nic-hdl: BCCC-RIPE
mnt-by: IGNITE-DE-MNT
changed: dp@planning.viaginterkom.de 20010703
changed: hermann.maser@btignite.de 20020227
changed: hermann.maser@btignite.de 20020429
source: RIPE
Looks harmless, and maybe even helpful (an anti-spam service?)- I presume the BT is my telecoms provider: British Telecom. ( I have emailed Dave Pratt asking for information)
Why should my RPCSS.exe be wanting access to the net, and not yours?
As I mentioned earlier, I started off by blocking the service( when I didn't know what it was all about), but then, as it appeared to be a legitimate use by Avast I have been allowing both in & out...(stopping it all from now though!)
Jusme,
Thanks for your tip on how to disable RPCSS.exe without in fact disabling it ;-).
Yes, I'm sorry, I misunderstood. (Reading too fast, I suppose).
I would like to have this workaround verified as acceptable by the experts.
By the way, you could try not to be too wild in your accusations. I think that Pavel was pretty restrained in his reply to you, considering!
This for the Avast team:
If Avast does not assign RPCSS.exe to access the net, why has a warning (that it might do so and can be safely blocked by a firewall) not been included (in the installation process or the readme or the helpfile) ? And to advise users to block it with a firewall.
Surely this would have been sensible, so as to avoid this worrying misunderstanding?
(Of course not everyone uses firewalls. I can see the problem there for you. Other AV programs don't seem to use RPC, (with great respect) could you not find some other way to fulfil the same function?
All the best,
PcB
-
Ok guys, point taken.
I'm a little rough around the edges, I know ok, lol
Never been very....errr.... diplomatic.
(thats real close to an apology you know)
Maybe I did fly off the handle a bit, said some controversial shi......hmmm......and 'crusty' stuff, but I was real mad when I realised I was connected to the net with a listening port known to be EASILY exploited.
I musta presumed you guy's would know better than to let this happen, so I thought you'd musta done it on purpose.
Not sure which is more worrying.
You knowing, or not knowing........
I'm calm and mellow now, (disabling the server listening on 135 helped)
Along with a little more research, I now beleive this to be just another UNINTENTIONAL SECURITY FLAW.
Pavel. Another thing.
I don't know who you guys are.
I'm sure you really are straight up, but remember, I've just walked in off the street.
Am I to just instantly trust EVERYBODY that produces software?
(My experience says no, suss 'em out first!)
Yet another thing.
Would you be telling me to uninstall if I'd paid for it?
Sorry if it sounds like I'm having a go again, it's only self defense : )
**********************************************
A nose walked into a bar and asked for a shot of JD.
"No chance" said the barman, "your off your face"
-
Hi JusMe.
Thanks for the tip about disabling the rpcltscm.dll.
Have renamed it and am happy to see that RPCSS no longer has any connections open to the outside world.
I feel better now, even though I already had the firewall blocking it.
While I really like the quick incremental upgrades for Avast and a number of other features, it does appear to have a few rough edges like this, but I suppose that's why it's free.
Took me a while to realize that it was Avast which had activated RPCSS on my PC as I did a number of simultaneous changes recently (always a bad idea) and it was only discovering this forum which confirmed my suspicions.
Really do not like the idea of a server running on my Win98 machine, even if it is hiding behing a firewall!
-
Unlike you, I have had RPCSS.exe access the net, and also receive, regularly......
Why should my RPCSS.exe be wanting access to the net, and not yours?
pcb,
I wish I had an answer for you, but my rpcss does not communicate with the internet. I have never heard of Ignite, but that may be a service in Europe that does not extend itself to the US.
Hopefully, VLK who is the senior guru might come back with some more information.
Fact remains, if you disable rpcss completely, Avast will not do anything!
If we keep "asking".....we may get a more detailed answer from the Avast Team.
Wish I had more to offer on this, but I am as puzzled as you.
:-[
-
Many thanks for all your input, Techie101, Svenouk, and Jusme,
Looks like we're getting this sorted out, without Avasts' help. Just our luck that they are on holiday!
Jusme & Svenouk, by disabling the rpcltscm.dll, are you sure you're not preventing some other important/useful program/process from working?
Does anybody have any in-depth knowledge on this one?
Cheers all,
PcB
-
Does anybody have any in-depth knowledge on this one?
The one with the dll is a bit quick and dirty. There is a good german "how to disable Windows XP/2000 Services" guide http://www.kssysteme.de/s_content.php?id=fk2002-01-31-3823 (http://www.kssysteme.de/s_content.php?id=fk2002-01-31-3823)
A quick google search brings up this site. Maybe it is usefull(did not read it completly) http://www.overclockersclub.com/windowsxpservices.shtml
But be carefull, if you not know what you doing, it could affect the "behavior" of your Computer!
-
Raman,
Thanks for the input and links. I'm afraid, though that I'm still using 98se, so wonder whether what goes for XP goes for 98se in this case.
Anyway, given what was mentioned on the second link:
Remote Procedure Call (RPC) (Automatic) -Critical! Leave this set to Automatic. Just about everything depends on this service to be running.
Remote Procedure Call (RPC) Locator (DISABLE) -Manages the RPC name service database. I have not found a reason to keep this service running. If something on your network breaks after you disable this service, put it back to Manual or Automatic.
...which RPC are we talking about here..the locator (seemingly OK to disable), or the former (Critical!) one?
I'm still unwilling to follow Jusme's tip, until more sure of what can transpire.
PcB
-
Hi snevouk.
Your welcome, although raman is right, it is a dirty fix, (but as you've found, it does work.)
pcb
Don't think you need to worry about it affecting your PC, remember the majority of RPCSS still runs, just the bit that starts the SERVER is 'hacked off'.
Other programs that need the process should still work unless they need to act as a SERVER FROM YOUR PC.
At the end of the day, if anything DOES go wrong, just rename it back, no harm done.
Servers mean letting people gain access to your PC, not for me that's sure.
Having said that, it seems you CAN kill RPCSS once avast has STARTED.
As far as I can tell, NOT ONE PART OF RPCSS IS USED FOR UPDATING or KEEPING THE PROGRAM FUNCTIONAL.
Try it.
Get a decent 'background programs' viewer, there are free ones if you look around.
Some viewers will also let you Kill the running tasks it finds.
Kill the RSPCC program.
Avast doesn't 'die', and it still scans, updates and works fine.
It's just that avast won't STARTUP if RSPCC is disabled or removed, for example, if you re-boot your PC, hence the need for dll 'hatchet job' if you want avast to run as normal, but not start this unnecesary and dangerous service.
I'm quite pleased with the product up to now, like snevouk said, just the odd burr that needs filing down to give a nice and smooth, sleek product.
A bit worried about the limited and lengthy time to respond though.
It seems we have to wait for one guy to come back from his hol's before anything can even be looked at, never mind fixed and resolved.
In the meantime, many of us could be broadcasting away to the underbelly of the WWW.
Who knows, we may get some answers this coming week.
-
JusMe,
I have in fact a couple of process viewers..started using them when I discovered RPCSS.exe in my TaskKiller list -wanted to find out about it.
And yes, I too have killed RPC on several occasions, without any apparent effect on Avast, but I wasn't sure if it was effecting it's ability to do it's job properly.
You say that NOT ONE PART OF RPCSS IS USED FOR UPDATING (we all know that now) OR KEEPING THE PROGRAM FUNCTIONAL
..but if Avast needs the service to communicate between it's modules, won't killing it prevent this "communication"?
Raman doesn't seem too keen on your dll renaming trick. I expect it's fine to do it, but I'm afraid I'm still not 100% convinced.
I think I'll wait for more opinions, with respect.
all the best,
PcB
-
Hello!
I have a dial-up connection, and so every time Avast! tries to access the net on its own whim it can cost me money, and it's also a waste of time and an annoyance.
I tried the RPCSS dll solution, but apparently on WindowsME it isn't as effective as on other platforms, because Avast!/RPCSS still initiated a dial-up connection at startup.
Also, on WinME it's much harder to rename the dll in the first place: the renaming needs to be done in Safe Mode, because otherwise the automatic System File Protection (SFP) restores a copy of the file within seconds after it is modified!
I thought I'd include some info from my firewall program in case this can assist anyone:
Connection origin :File Version : 4, 0, 234, 0
File Description : avast! antivirus service
File Path : C:\Program Files\Alwil Software\Avast4\ashServ.exe
Process ID : FFFEC159 (Heximal) 4294885721 (Decimal)
local initiated
Protocol : ICMP
Local Address : 203.220.231.46
ICMP Type : 8 (Echo Request)
ICMP Code : 0
Remote Name : www.avast.com
Remote Address : 64.246.6.135
Ethernet packet details:
Ethernet II (Packet Length: 44)
Destination: 20-53-52-43-00-00
Source: 44-45-53-54-00-00
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 20 bytes
Flags:
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 64
Protocol: 0x1 (ICMP - Internet Control Message Protocol)
Header checksum: 0xb675 (Correct)
Source: 203.220.231.46
Destination: 64.246.6.135
Internet Control Message Protocol
Type: 8 (Echo Request)
Code: 0
Data (4 bytes)
Binary dump of the packet:
0000: 20 53 52 43 00 00 44 45 : 53 54 00 00 08 00 45 00 | SRC..DEST....E.
0010: 00 1C 0A A3 00 00 40 01 : 75 B6 CB DC E7 2E 40 F6 | ......@.u.....@.
0020: 06 87 08 00 EC FF 02 00 : 09 00 00 00 | ............
I'm not totally sure about this, but I think that RPCSS is also responsible for the Scandisk disruptions which have been an issue for some users (see separate thread: scandisk).
Overall, RPCSS seems to me to be an outdated, annoying, and unreliable protocol.
Anyway, that's all. For now...
Cheers.
-
Raman,
Thanks for the input and links. I'm afraid, though that I'm still using 98se, so wonder whether what goes for XP goes for 98se in this case.
Anyway, given what was mentioned on the second link:
Remote Procedure Call (RPC) (Automatic) -Critical! Leave this set to Automatic. Just about everything depends on this service to be running.
Remote Procedure Call (RPC) Locator (DISABLE) -Manages the RPC name service database. I have not found a reason to keep this service running. If something on your network breaks after you disable this service, put it back to Manual or Automatic.
...which RPC are we talking about here..the locator (seemingly OK to disable), or the former (Critical!) one?
I'm still unwilling to follow Jusme's tip, until more sure of what can transpire.
PcB
Hi, on my W2k-SP4
RPC ist set to automatic, but RPC-Locator to manual
I don't know if I set the locator settings myself though ;D ;D
but, no probs here
-
Well, I have renamed the RPCLTSCM.dll as suggested by JusMe.
And RPC is not longer opened up to the net.
I feel much better, so long as no problem occurs as a result.
Thanks Jusme.
PcB
-
Hi Flash,
Unfortunate, the dll 'chop' will only disable the server (which I'd do whether your on dial-up, cable or ANY INTERNET CONNECTION, just stop that damn server if it's running : port 135)
I've removed all dial up features from my PC, so not sure which process is responsible for starting your connection, but to be honest, from your report, I'd say its avast ITSELF, dialing up to check for updates, a TOTALLY seperate process from what RPCSS does.
Have you disabled the avast auto update?
As for that system restore...........blahhhhh........
I'm the same as you pcb, not to keen on having to hack away at my system, so I'm as keen to hear the views of the sunburnt techies at avast. lol
-
OK guys, I feel lots of you are eagerly waiting for me to write something to this thread but I wish I had something new for you... ;)
I will try to be as technical as possible - I believe there has been enough haggling already. :)
avast! uses RPC for its communication between ashServ.exe and ashDisp.exe (under NT based OSs only). I know most of you are not programmers but I can assure you that using RPC for such a purpose is a completely normal, supported, and recommended way of doing such things, and there must be hundreds of Windows programs that do just same... And, in fact, Windows itself uses LRPC (i.e. local RPC) for internal communication between some of its parts. It's not that it is "listening on a port" - RPC is just a shell on top of other protocols (transports). One of these protocols is TCP/IP (so only in this case we could be talking about listening on a port), but avast does not use it. It just uses the LRPC - a custom, Windows-proprietary protocol that never ever touches the network and that you really don't have to worry about - next time, you could have concerns about the security of displaying blue bitmaps on your screen, -- little paranoid, don't you think...? What I'm trying to say is that (the consumer edition of) avast never uses RPC for any kind of network communication, be it updating or anything else.
- the other thing is that all the RPC stuff is hosted in the RPC service (RPCSS), and I'm not familiar with a way to selectively disable RPC's individual transports. If the DLL hack you've described works, good for you. But please note that what you're doing has really nothing in common with avast -- the RPC service is part of Windows (and by default, it's ON). If you don't like, you can disable it (or otherwise hack it) but you must be prepared that some other apps just won't work. E.g. both Exchange Server and Outlook rely heavily on RPC over TCP/IP (as do things like NFS under Unix, though - just FYI).
Hope this helps,
Vlk
-
Vlk,
Good to hear from you..hope you enjoed your holiday.
After all the initial brouhaha, I am now happy that the RPC issue is not of serious concern. However, Avast does launch it as a process, and mine has regularly sought access to the net, and has received data, as you can see from my postings.
You say that avast! uses RPC for its communication between ashServ.exe and ashDisp.exe (under NT based OSs only)
...if this is so, then it is not used by Avast on 98se systems (mine). Why, then, is it then launched?- surely you could write the program so that it isn't, on non NT base OSs? Maybe in the next version?
For now, is there any way for us to prevent it's launch by Avast, in our present installations!? (out of sight, out of mind).
Thanks for your prompt response, and many thanks for a great program. Wish I had thought of downloading it long ago.
All the best,
PcB
-
...if this is so, then it is not used by Avast on 98se systems (mine). Why, then, is it then launched?- surely you could write the program so that it isn't, on non NT base OSs? Maybe in the next version?
What do you mean "launched"?? Avast doesn't launch it, really. Under Win98, it uses RPC ONLY for the virus chest (i.e. to communicate between the virus chest and the rest of the system). Nothing more...
Vlk
-
Vlk,
I mean "launched" as a running process.
the following is copied from Task Info:
[Process Pane]
|Process| |% CPU| |LT % CPU| |Time| |Sw/s| |InMem KB| |Total KB| |Th||Pri| |Ver| |State| |Path|
+ Idle 89.88% 76.18% 50:16 80 0 0 1 Very Idle 4.0 Idle
+ KERNEL32.DLL 0.33% 0.44% 0:14 18 32 44 3 High 4.3 32 C:\WINDOWS\SYSTEM\KERNEL32.DLL
+ MSGSRV32.EXE 0.04% 0.03% 0:13 1 168 220 1 Norm 4.0 16 Sys C:\WINDOWS\SYSTEM\MSGSRV32.EXE
+ MPREXE.EXE 0 336 556 1 Norm 4.0 32 Sys C:\WINDOWS\SYSTEM\MPREXE.EXE
+ mmtask.tsk 0.04% 0 92 120 1 Norm 4.0 16 Sys C:\WINDOWS\SYSTEM\mmtask.tsk
+ ASHSERV.EXE 0.12% 1.43% 0:12 21 8,696 21,592 24 Norm 4.0 32 Sys C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
+ EXPLORER.EXE 0.31% 1.69% 0:11 13 7,204 16,964 14 Norm 4.0 32 C:\WINDOWS\EXPLORER.EXE
+ TASKMON.EXE 0 132 232 1 Norm 4.0 32 Sys C:\WINDOWS\TASKMON.EXE
+ SYSTRAY.EXE 0.01% 0 1,020 3,700 2 Norm 4.0 32 C:\WINDOWS\SYSTEM\SYSTRAY.EXE
+ RPCSS.EXE 1 1,144 2,524 4 Norm 4.0 32 Con Sys C:\WINDOWS\SYSTEM\RPCSS.EXE
+ SPEEDKEY.EXE 0.04% 0 1,620 6,400 1 Norm 4.0 32 C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
+ POINT32.EXE 0 924 2,896 1 Norm 4.0 32 C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
+ HF.EXE 0.04% 0.02% 0:01 3 1,988 5,356 1 Norm 4.0 32 Sys C:\PROGRAM FILES\HIDEFOLDERS\HF.EXE
+ STIMON.EXE 0.09% 0.68% 0:07 14 2,996 19,428 4 Norm 4.0 32 C:\WINDOWS\SYSTEM\STIMON.EXE
+ FPDISP4A.EXE 0.04% 0.01% 0 1,492 4,964 2 Norm 4.0 32 C:\WINDOWS\SYSTEM\FPDISP4A.EXE
+ ASHMAISV.EXE 0.17% 0.10% 0:09 6 4,728 15,396 6 Norm 4.0 32 C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
+ TTMAN.EXE 0.63% 0 2,588 6,356 1 Norm 4.0 32 C:\PROGRAM FILES\HACE\TASKBAR EXECUTIVE\TTMAN.EXE
+ WINEJECT.EXE 0 644 2,452 1 Norm 4.0 32 C:\PROGRAM FILES\WINEJECT\WINEJECT.EXE
+ INVISIBLE.EXE 0.04% 0.01% 0 1,384 4,528 2 Norm 4.0 32 C:\PROGRAM FILES\MINDBEAT\INVISIBLE! 2001\INVISIBLE.EXE
+ WMIEXE.EXE 0.04% 0 428 812 3 Norm 4.0 32 Sys C:\WINDOWS\SYSTEM\WMIEXE.EXE
+ CIDIAL.EXE 2 1,880 6,536 1 Norm 4.0 32 C:\PROGRAM FILES\CIDIAL-MANUALLY INSTALLED\CIDIAL.EXE
+ RNAAPP.EXE 0.65% 0:02 4 1,980 6,932 3 Norm 4.0 32 C:\WINDOWS\SYSTEM\RNAAPP.EXE
+ TAPISRV.EXE 0.04% 0.01% 0:03 0 1,036 1,948 6 Norm 4.0 32 Sys C:\WINDOWS\SYSTEM\TAPISRV.EXE
+ SPOOL32.EXE 0 972 3,684 2 Norm 4.0 32 Sys C:\WINDOWS\SYSTEM\SPOOL32.EXE
+ MOZILLAFIREBIRD.EXE 5.90% 6.81% 6:09 69 32,744 41,472 9 Norm 4.0 32 C:\PROGRAM FILES\MOZILLA FIREBIRD\MOZILLAFIREBIRD\MOZILLAFIREBIRD.EXE
+ TASKINFO.EXE 0.56% 6.43% 0:01 26 2,320 6,696 1 High 4.0 32 C:\PROGRAM FILES\IARSN\TASKINFO2000 3.0\TASKINFO.EXE
+ VxD NTKERN 0 0 0 6 Norm 4.3 VxD NTKERN
[Current Process Pane]
CMD =RPCSS
Curr Dir =C:\Program Files\Alwil Software\Avast4
Started by =C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
Data KB =1,232 in mem = 628 in use = 504
Code KB =1,292 in mem = 516 in use = 444
Handles Count =30
Windows = 2
You can see RPCSS.exe is a running process -#10 in the list, and at the bottom (under "current process pane") you can see that it was "started by" Avast.
Surely this means that Avast is "launching/loading" RPCSS.exe as a process?
Cheers,
PcB
-
Vlk,
At first, you said that:
avast! uses RPC for its communication between ashServ.exe and ashDisp.exe (under NT based OSs only).
which I took to mean that Avast does not use RPC (at all) on non-NT based systems, eg 98se. (Hense my last post)
..and now you say:
under Win98, it uses RPC ONLY for the virus chest (i.e. to communicate between the virus chest and the rest of the system)
So, if this last is correct, it is, in fact, necessary for Avast to "start" RPCSS.exe as a running process on non-NT based OSs, and there is nothing to be done.
Can this procedure not be done some other way in future versions?
I do not seem to be alone in being concerned about having this process opening a port to the net, constantly.
(Jusme's dll renaming trick may turn out to be problematic)
PcB.
-
Hi,
on my W2k i have 22 services (some disabled) potentially dependend on RPCSS
even on W98, I'd guess there is also some other stuff which uses rpcss except from avast..
so whether Avast USES it or not, I'd guess rpcss will be needed once in a while..
-
Whocares,
Your point is accepted...all I can say is, I have not seen RPCSS.exe in my running tasks before installing Avast, and it certainly has never tried accessing the net: I've never had a relevant alert from my firewall in the 3 years or so I've been using one.
And it is definitely Avast that is starting RPC as a running process.
-
Hello!
Today finds me feeling very pleased with myself. :)
I have, I think, solved almost all of my problems with Avast!.
After reading the replies to my post of yesterday (thanks!), I realised that the dll modification had actually worked, in as far as that whilst Avast! was still causing dial-up-behaviour, the Avast!/RPCSS process was no longer contributing toward this.
It then occurred to me that I had seen references to an .ini file modification in several threads, and so I edited my Avast! .ini file (whilst I was at it I also altered some timeout values which seemed far too low).
Now my firewall traffic log shows that neither Avast! nor RPCSS is constantly listening/attempting to access the internet.
Enough of my gloating.
In reading this thread, I have been struck by the fact that many seem not to understand the fundamental differences between NT/2000 & 98/ME.
Many network protocols and the associated services and processes are native to NT/2000 and are run automatically and by default. RPC is, I think, one of these.
Most of these protocols/services/processes are not native to 98 or ME and are tacked on for reasons of cross-platform compatability. But they don't always play nicely.
So, in NT/2000, RPCSS would almost certainly be running anyway. However, in ME (and I suspect 98), RPCSS is not widely utilized and certainly on my machine it was not used by any of my autorun services until I installed Avast!.
So, there you have it.
Cheers;
Flash.
-
In my last message I forgot to say that my tinkering also seems to have cured the problems I had been experiencing with Scandisk disruptions since I installed Avast!
Also, since installation I had been experiencing some sporadic login problems, especially when rebooting, and these might be gone (I hope)...
-Flash.
-
Hi flash
Hay you have the exact same setup as i do. win me ,avast4,
sygate personal, a dial-up. But I already had RPCSS as a process
RPCSS is distributed com services, and it is set to ask me for access, I cant remember when I noticed it, your right its not installed along with the system ,I think though works or something Else put it there, and needs it,rpcss by itself cannot access the internet neither will avast so maybe you have something else set to auto-update or autodial ?
at least The way I'm understanding it , and rpcss is necessary for parts of some program's to talk to other parts of itself and other programs
though maybe you have some sleeping monster and now that its active, alows it to awaken ,,
Have you been to spf's forum
some places Ive looked:
http://www.cexx.org/rpc.htm
http://www.computing.net/security/wwwboard/forum/2553.html
http://www.annoyances.org/exec/forum/winme/t1028301859
Well there is no end to it on google.
Regards
Lonny
-
Hi!
Thanx Lonny - your response was very much appreciated.
I suspect that there are many factors at play in motivating our PCs' strange behaviours.
Since I seem to have solved most of my problems (for now...), I guess I'll have to be satisfied with that.
Cheers;
Flash.
-
Like flash says, problem solved as far as I'm concerned too, so this will probably be the end of this thread for me.
Thanks for all your views and ideas.
Wouldn't say no to a link to that thread you found though flash (avast.ini)
I'm happy now to allow RPCSS to run, but still without the Rpcltscm.dll. (It DOES work for me lol)
VLK is right when he says it's required for the virus chest, with RPCSS disabled you are unable to move a file to the chest, so if you wanna use that function, or if any other program needs RPCSS, leave it running.
I think it's clear now that avast does not need to start this server to function, VLK backs this up, but IS wrong about RPCSS being enabled as default.
As pcb pointed out, your program STARTS the RPCSS process on our OS.
If I disable your software, RPCSS does NOT start on my machine.
Avast may not use the networking side of things, but when RPCSS starts, it also then kicks off a load of other services, including the dll I mentioned which STARTS THE SERVER which DEFFO LISTENS ON PORT 135 (trust me! lol).
By the way, I've now blocked all incoming blue bitmaps from passing through the firewall just to be sure (I AM that paranoid lol)
Anyway, if you think think this thread is long, check this out!
http://computing.net/windows95/wwwboard/forum/3943.html.
Gives a lot of theories including a conspiracy theory that suggests 135 is opened so Microsoft can check on piracy!
(Woooooahhh, now I really AM worried! lol)
A far more productive and extremley informative page can be found at http://www.cexx.org/rpcss.htm
C'y'all soon.
-
Cheers Jusme,
Thanks once again for your excellent dll renaming tip.
And all your other input.
and Flash,
I too would like to know more on your Avast4.ini tweak. Would you mind sharing your expertise?
Thanks,
PcB