Author Topic: Avast/RPCSS.exe accessing the internet..worried user  (Read 44231 times)

0 Members and 1 Guest are viewing this topic.

pcb

  • Guest
Avast/RPCSS.exe accessing the internet..worried user
« on: July 08, 2003, 12:50:04 PM »
With referrence to my former posting:
 http://www.avast.com/forum/index.php?board=2;action=display;threadid=647,

 I have taken "Avast!" and "ashmaiserve" out of Startup programs, and yes, it seems as though it is Avast that is using RPCSS.exe.

I am concerned about this, as it (RPCSS.exe) has been trying to access the internet, on a number of occasions (it has just made another attempt) Even though I block it with Kerio PF, it gets through and I find it in the Kerio's filter rules and Application MD5's ( I delete these entries, and they appear again each time).

Please would one of the moderators (Vlk or Pavel?) please respond to this in order to put my mind at rest:

- is this normal activity?
- why is RPCSS.exe trying to access the internet?
- why does Avast use RPCSS.exe?

I am running Windows 98se and Avast4.0.235 Home edition.

Many thanks.
PcB

PS. I have seen this report:http://cexx.org/rpcss.htm
 but I'm afraid it doesn't help me regarding Avast and RPCSS.exe.
« Last Edit: July 08, 2003, 01:52:32 PM by pcb »

techie101

  • Guest
Re:Avast/RPCSS.exe accessing the internet..worried user
« Reply #1 on: July 08, 2003, 04:09:29 PM »
pcb,

I am sure one of the moderators will get back to you shortly, but please keep all postings on the same subject under the same string.
Just sign back into the forum,  go back to your question and "reply".
It keeps things all together for us to review instead of opening half a dozen strings.
Anyway, AVAST does need to access the internet so that it can check for updates to the database and program.  I am almost sure that it uses the RPC to get things going and access the internet.

If you block the RPC access with Kerio, AVAST will not update the database and you have created another problem.  If Kerio "alert window" tells you that AVAST is using the RPC, then it should be ok to allow it.  To make you feel more comfortable, only allow it for that one time.  This way you will know when the RPC is activated and by what program.

One of the moderators should be able to provide a more detailed explanation.

Good luck

techie101

  • Guest
Re:Avast/RPCSS.exe accessing the internet..worried user
« Reply #2 on: July 08, 2003, 04:28:30 PM »
pcb

The Windows RPC endpoint mapper service, Rpcss.exe, may not correctly handle reentrancy (more than one pending request). If the RPC endpoint mapper is concurrently accessed by two processes, or twice within one process, an invalid page fault (exception 0E) may occur in Rpcss.exe.

This behavior is somewhat timing-dependent, and may not occur consistently on all computers.

There are no known issues with Windows 98 systems, and that is probably why it randomly occurs.

Try removing non-essential programs from the startup list to isolate which one conflicts with Avast when it trys to access the rpcss.exe

I will continue research into this for you.

 :o


pcb

  • Guest
Re:Avast/RPCSS.exe accessing the internet..worried user
« Reply #3 on: July 08, 2003, 04:54:08 PM »
 techie101,

Many thanks for your replies. I hadn't thought of RPCSS.exe being used for updating Avast (I would appreciate it if one of the moderators would verify this).
I actually don't have the auto-update feature enabled, but ask for notification.
Whatever, when Kerio notifies me that RPCSS.exe is trying to access the net, nowhere is AVAST mentioned-if it were, I would naturally grant it access!
 
I presume your second reply,  techie101, is really for Joel, who is getting RPC errors, which I am not.

Once again my thanks for your knowledge.
I would still very much like to have official confirmation that RPCSS.exe is used by Avast purely to seek  Avast updates.

Thanks,

PcB


techie101

  • Guest
Re:Avast/RPCSS.exe accessing the internet..worried user
« Reply #4 on: July 08, 2003, 11:47:48 PM »
So would I.

pcb

  • Guest
For Techie101
« Reply #5 on: July 09, 2003, 10:53:48 PM »
Well, I have found out via the program TaskInfo, that RPCSS.exe is indeed called up by Ashserv.exe, the main Avast module.
I have sent VLK a PM but he hasn't replied-probably gone on holiday.

I feel sure that RPCSS.exe is only used by Avast to get updates.  
Nobody seems interested in

Nobody seems interested in enlightening us !

Take care,

PcB

techie101

  • Guest
Re:Avast/RPCSS.exe accessing the internet..worried user
« Reply #6 on: July 09, 2003, 11:15:32 PM »
pcb,

Indeed it does!  Avast uses the Avserv.exe to establish a connection on the internet to the Avast server to check for updates.  Depending on how you have your defaults set, Avast will either download them, or alert you to the new update/s.

I am not sure of when the moderators are scheduled online.  You can tell by the green screen under the username.  I have also sent them IM messages and have not received answers either.

Enlightment is found by those that refuse to stand in the shade!

Seek knowledge from others, and give it freely to them!

That's my motto....That's why I am here.

Take Care,
 :D

pcb

  • Guest
Re:Avast/RPCSS.exe accessing the internet..worried user
« Reply #7 on: July 09, 2003, 11:22:30 PM »
Cheers Techie101,

I seek enlightenment, but keep out of the sun!

PcB

PS. What's this "I'm a llama" business?
« Last Edit: July 09, 2003, 11:24:24 PM by pcb »

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re:Avast/RPCSS.exe accessing the internet..worried user
« Reply #8 on: July 10, 2003, 08:54:12 AM »
Sorry people, but those who could enlighten you, such as the mighty Vlk, have really left for holiday for some time, so you should be patient... I hope you'll get your light soon  8)

pcb

  • Guest
Re:Avast/RPCSS.exe accessing the internet..worried user
« Reply #9 on: July 10, 2003, 09:35:17 AM »
Thanks, Igor,

I thought as much. Hope they have a good time.


PcB

techie101

  • Guest
Re:Avast/RPCSS.exe accessing the internet..worried user
« Reply #10 on: July 10, 2003, 04:45:57 PM »
Cheers Techie101,

PS. What's this "I'm a llama" business?

It's better than being a turtle!!!

*You can change this in Profiles if you which.... ;D

pcb

  • Guest
Re:Avast/RPCSS.exe accessing the internet..worried user
« Reply #11 on: July 10, 2003, 05:14:45 PM »
Aha!

Thankyou Techie101 for pointing me in the right direction.
I never venture far from reading or posting on forums..I still don't know lot's of things I'm sure I should.

I must say, given the choice I'd rather be a turtle, lugubriously paddling round the tropical oceans.
Mind you, things often make me want to spit, so maybe a llama's more appropriate!

cheers,
PcB
« Last Edit: July 10, 2003, 05:15:14 PM by pcb »

jdong

  • Guest
Re:Avast/RPCSS.exe accessing the internet..worried user
« Reply #12 on: July 10, 2003, 05:35:26 PM »
Cheers Techie101,

PS. What's this "I'm a llama" business?

It's better than being a turtle!!!

*You can change this in Profiles if you which.... ;D


I'm NOT a lama! LOL

pcb

  • Guest
Re:Avast/RPCSS.exe accessing the internet..worried user
« Reply #13 on: July 11, 2003, 09:52:23 AM »
Now I have discovered that even if you set the update for both Virus Database and Program to manual (ie. not auto, or notify), Avast still loads RPCSS.exe.
Now, if the program is set to not look for updates, then why is RPCSS.exe loaded at all?

I'm going to leave both settings to manual, and see if RPCSS.exe is still accessing the net, (or trying to).

Will let you know soonest if it does.

PcB.

JusMe

  • Guest
Re:Avast/RPCSS.exe accessing the internet..worried user
« Reply #14 on: July 17, 2003, 05:42:00 PM »
Count me as ANOTHER worried user.
There is no doubt that Avast does initialise the RPCSS command, which is basically a local server which kicks in PRIOR to my firewall. (hence no point blocking it)

The question we gotta ask peeps, is   W H Y  ?  ?  ?  ?

This aint no conflict with another program or anything to do with the updating (which still works after I shut RPCSS.EXE down, which I gotta use a utility to do as it doesn't appear under the active tasks menu....shady underhand process)

So c'mon MODS, where's the answers to these questions?????

1. Why does your program NEED TO start the RPCSS.EXE process?
2. Can we stop your program from executing this process?
3. How do you think your users would respond if they were informed that the security product they are using actually invites a hacker to target a specific port.

Hang on a minute.......
Maybe that IS the point!
Make the PC vunerable to hackers so that when the antivirus software kicks to protect us from the scummy no life low life, we all think, 'Hey, I'm glad I had this software!'

I'm assuming the mod's that were away when this thread started are now back from sunning themselves, SO LETS HAVE SOME ANSWERS before I delete this brilliant software.

Yes, I know I've had a good whinge, but I really DO love the software, resources are sweet compared to other memory hogging alternatives, but I just can't cope with this daft, and seemingly pointless server it starts.