Member Avatar for chan_preet23

error rpcSs.exe 100 cpu usage with no application running on windows nt workstatin 4. :-|

  • 3 Contributors
  • 4 Replies
  • 535 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by Catweazle

Dani AI

Generated

Short expert summary and practical steps.

This is a known Windows NT 4.0-era failure mode: the RPC service (rpcss.exe) can be driven into an endless error loop by malformed or spoofed RPC traffic and consume 100% CPU even when no user application is running. Microsoft documented RPC-spoofing/DoS problems that produce exactly this behaviour and published hotfixes. (learn.microsoft.com)

Why removing NetBEUI likely helped (and why the problem can start later)
NetBEUI/NBF is a broadcast, local‑only transport that older Windows networking used; removing that transport reduces the ways malformed/broadcast RPC traffic can reach the RPC stack. Microsoft also notes that, during an active attack or error loop, temporarily disconnecting the system from the network will usually stop the high-CPU condition — which matches ’s observation. (learn.microsoft.com)

Quick, reproducible checks (in order)

  1. If rpcss is pegged now, immediately disable the NIC or unplug the network cable to confirm a network-triggered loop (disconnecting often breaks it). (learn.microsoft.com)
  2. Check Event Viewer (System/Application) for RPC, spooler, or named‑pipe errors.
  3. Look for connections to RPC port 135:
    netstat -an | find "135"
  4. Capture traffic with Network Monitor / Wireshark and filter for TCP/UDP port 135 to spot malformed or repeated RPC packets.
  5. Verify rpcss.exe is the genuine system file (WINNT/System32) and run up‑to‑date anti‑malware/rootkit scans as @bentkey recommended.

What fixes to apply
Install the Microsoft RPC hotfixes mentioned in the security bulletins and the NT4 service pack updates that include them (the MS98‑014 and MS98‑017 bulletins and the KB that describes the port‑135/telnet issue are the relevant references). If patching is not feasible, block TCP/UDP 135 at your perimeter and remove unnecessary transports (NetBEUI) from exposed adapters. If the machine must remain online long‑term, plan migration to a supported OS. (learn.microsoft.com)

References: MS98‑014 (RPC spoofing), KB162567 (telnet/port‑135 bug), MS98‑017 (named‑pipes over RPC).

Recommended Answers

All 4 Replies

Member Avatar for bentkey

Start by doing a thorough scan for virues and malware. Go to the Security forum and read the top "Sticky" posts for help on how to start.

Member Avatar for chan_preet23

Start by doing a thorough scan for virues and malware. Go to the Security forum and read the top "Sticky" posts for help on how to start.

I have tried virus scan and spy ware but no gain
i have removed NetBUIE protocol and my system it running like a tiger & horse
but i want to know that it was installed before three months and problem has occured now why? :?: :?:

Member Avatar for bentkey

Impossible to say. The rpc service is used to allow remote procedure calls from another pc on the network to run application services on the local machine. There are various rpc attacks that can be performed across a network against the ports the rpc service listens on. Since we don't know if you are even on a local network, this may or may not be a possiblity. In any case, you don't need netbui and since you don't need it, you're better off without it.

Member Avatar for Catweazle

All Service packs installed?

Tried Google?

(Sorry, I'm unfamiliar with NT 4.0)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.