RPCSS/Outlook Concern

Discussion in 'other firewalls' started by Herm, Jun 28, 2005.

Thread Status:
Not open for further replies.
  1. Herm

    Herm Registered Member

    Joined:
    Jun 28, 2005
    Posts:
    3
    Here is hoping someone can help.

    I recently had a 'request for internet access' pop up from Zone Alarm for the program RPCSS.EXE. when I tried to open MS Outlook. I refused it as I could not see a reason for the request as Outlook already had access. Outlook proceeded to lock up and through the Task manager I ended the process. When I attempted to open Outlook again it opened after a query whether I wanted safe mode (no) and there was no lock up and I was able to open and use the program without a problem. Since this first incident I have this problem each time I open Oulook for the first time after booting the computer, and then not again until it is shut down. That is until today when I tried to open it after leaving the computer on overnight and the usual problem occured, leading me to believe there is a time element to this problem. I am even more supicious. I have searched for a solution and as yet nothing seems to match the problem I am having

    I am running 98 SE and have Zone Alarm, AVG AV, Spywareblaster, Spy-bot, and Ad-Aware. All of which are up to date and the latest versions and have indicated nothing that seems to relate to the problem I am having. As well all Windows/Explorer security updates are all installed.

    The programs I have recently installed are the latest Java (1.5) and a defrag program from 'Executive Software' (since removed). I use the Java daily without a problem so I am thinking it is not the source of this problem.

    I have done a re-install of Outlook with no effect.

    I am complete loss as to what to do next or even if this is really a problem.

    Any help or direction will be appreciated.
     
  2. FanJ

    FanJ Guest

    Hi Herm,

    You posted in the TDS-3 forum.
    I'm not sure whether TDS-3 is involved here.
    If not, maybe one of the moderators could move your thread to another forum-section where it might get more attention; maybe the firewall forum-section?

    Regards, Jan.
     
  3. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    4,451
    Location:
    North Carolina, USA
    Done ;) ...
     
  4. Jaws

    Jaws Registered Member

    Joined:
    Apr 4, 2005
    Posts:
    210
    Last edited: Jun 28, 2005
  5. Herm

    Herm Registered Member

    Joined:
    Jun 28, 2005
    Posts:
    3
    Thanks for the forum transfer. I was not sure of the best location and I had seen mention of the problem program referenced where I had posted.

    Jaws:

    Checked the links and thanks. I am not sure if these apply but am looking still.

    Just a bit more info. Zone Alarm is indicating a request for Server Status. I am reluctant to allow this as it has never shown up before. I don't know if it means anything but it is to port 1034 or 1026 or 1049 and the IP is 169.254.175.59. Also though the program does not show up in Task Manager it does show as a running program in the System Information .

    Out of frustration I may just re-install 98 and see what happens, but really hate a mystery like this and would rather know why and how this came about. I will continue to poke around for now.

    Herm
     
  6. Jaws

    Jaws Registered Member

    Joined:
    Apr 4, 2005
    Posts:
    210
    Herm, I too run Executive Software diskeeper with no problems. But I know for a fact you can pick up malware though Java.

    Might be a good idea to download and run Ewido and do an on demand scan with something like BITDEFENDER and/or KAV

    Blackspear has a complete thread HERE for scanning for malware if you need to go that far.

    Good Luck,

    Jaws
     
  7. StevieO

    StevieO Guest

    Herm, in 98SE it is perfectly OK to disable RPCSS.EXE

    In fact i have found it is uneeded and a security risk. I renamed it and have had NO issuses whatsoever since doing so.

    XP is a different matter and requires it.

    StevieO
     
  8. CrazyM

    CrazyM Firewall Expert

    Joined:
    Feb 9, 2002
    Posts:
    2,428
    Location:
    BC, Canada
    Did the pop up indicate the type of connection (protocol, remote service)?

    Was this for rpcss.exe again?
    The ip 169.254.175.59 is within a reserved range that you will usually see/used when your system is unable to obtain an IP. Were you having connection problems at the time?

    Any more details in the text logs as to what was blocked?

    Regards,

    CrazyM
     
    Last edited: Jun 29, 2005
  9. Herm

    Herm Registered Member

    Joined:
    Jun 28, 2005
    Posts:
    3
    First, thank you all for the responses.

    Jaws: Apparently Ewido does not work on 98SE but did run both Bitdefender and Kav without success -- no virus. My next step could be Blackspears list of actions. Thanks for that. Oh and yes I am aware of the problems with Java but unfortunately I have two programs that are Java that I must run.

    StevieO: Saw that I could remove rpcss.exe (or rename it) but when I tried it was already running and was denied. Just checked after reboot and without opening Outlook and even though it does not show up in Task Manager it is listed under System Information|Running Procedures. I understand somewhat the purpose of the program but I can think of no setting or operation that I am currently or in the past have run that would require it. Again this was a recent problem but I can't pinpoint its cause or the initiating action.

    CrazyM: The Zone Alarm pop-up is says that the rpcss.exe program 'wants to accept connections from the Internet' with the IP mentioned before and varying ports. It is asking for 'server permission' from what I see. I am having no connection problems at the time of the pop-up and as a matter of fact I have a constant stream of data coming in to the Java program I mentioned earlier. When I deny the request I have noted that as well as Outlook being locked up I am unable to open a new IExplorer window and when I try I end up having to 'End Task' on both Outlook and Internet Explorer. Once this is done I can then open Outlook without a Zone Alarm pop-up and without any further problems at all with any program that I can see. This will continue until I re-boot the compter or to the next day if I don't shut it off overnight.
    I don't know of any other text logs.

    Again thanks everyone and I am trying everything that I see mentioned as I am able to. I am thinking more and more that this is not a virus but something else. I am trying to figure out where to find this call by Outlook for the rpcss program that must be occuring. I haven't mentioned that I get the Outlook Flash Screen and the basic outline for Outlook Today before the program stops loading and the Zone Alarm pop up occurs.

    Well I will keep looking but if nothing turns up I may have a long weekend of re-installing and updating software.

    Herm
     
  10. pcalvert

    pcalvert Registered Member

    Joined:
    May 21, 2005
    Posts:
    203
    Herm,

    I think you are right to be suspicious. Why don't you just try booting into DOS and renaming it?

    Phil
     
Thread Status:
Not open for further replies.