SVCHost.exe / RPCSS making my CPU load 100%

[greenman100]

Why?

[Dubbin1]

Its hard to say without knowing more. Is the problem still there after a restart?

[greenman100]

Oh yeah, its there as soon as I start.

[Dubbin1]

Have you scanned for a virus yet? Also check in msconfig and see if theres anything new starting up.

[greenman100]

Dubbin1, thanks for the help, but I'm sure that's not it. Something is wrong with the service RPCSS.

[stool]

Point is, a couple of the virus's out there screw up your RPC setup, either bogging you down to the point that it takes forever to get onto the 'net, or preventing yopu from even doing so and getting to sites that could help you.

[jrbob]

Check this out on MS site

http://search.microsoft.com/search/results.aspx?st=b&View=en-us&na=82&qu=RPCSS.EXE


From MS site
Overview
This is the Microsoft Windows XP Embedded with Service Pack 1 component update to address MS03-039: Buffer Overrun In RPCSS Service Could Allow Code Execution (824146).

Remote Procedure Call (RPC) is a protocol used by the Windows operating system. RPC provides an inter-process communication mechanism that allows a program running on one computer to seamlessly access services on another computer. The protocol itself is derived from the Open Software Foundation (OSF) RPC protocol, but with the addition of some Microsoft specific extensions.

There are three identified vulnerabilities in the part of RPCSS Service that deals with RPC messages for DCOM activation— two that could allow arbitrary code execution and one that could result in a denial of service. The flaws result from incorrect handling of malformed messages. These particular vulnerabilities affect the Distributed Component Object Model (DCOM) interface within the RPCSS Service. This interface handles DCOM object activation requests that are sent from one machine to another.

[greenman100]

Originally posted by jrbob
Check this out on MS site

http://search.microsoft.com/search/results.aspx?st=b&View=en-us&na=82&qu=RPCSS.EXE


From MS site
Overview
This is the Microsoft Windows XP Embedded with Service Pack 1 component update to address MS03-039: Buffer Overrun In RPCSS Service Could Allow Code Execution (824146).

Remote Procedure Call (RPC) is a protocol used by the Windows operating system. RPC provides an inter-process communication mechanism that allows a program running on one computer to seamlessly access services on another computer. The protocol itself is derived from the Open Software Foundation (OSF) RPC protocol, but with the addition of some Microsoft specific extensions.

There are three identified vulnerabilities in the part of RPCSS Service that deals with RPC messages for DCOM activation— two that could allow arbitrary code execution and one that could result in a denial of service. The flaws result from incorrect handling of malformed messages. These particular vulnerabilities affect the Distributed Component Object Model (DCOM) interface within the RPCSS Service. This interface handles DCOM object activation requests that are sent from one machine to another.


I think that's it, but wtf? I thought I already installed this patch?

[Dubbin1]

Originally posted by greenman100
Dubbin1, thanks for the help, but I'm sure that's not it. Something is wrong with the service RPCSS.

I was just helping you narrow things down since you didnt give us much info to go off of.

[greenman100]

I still have this problem, it didn't go away. It's not there as SOON as I restart, but about 2 minutes in, it load my CPU to 100%.

<edit> possibly fixed.

[wired14]

what command do you type to see these in your cmd window

[greenman100]

tasklist /svc

[snvpa]

maybe try disabling rpc.

Also do virus scanners show up with nothing I had a problem very similar recently and it turned out to be a virus.

[greenman100]

lol, disabling RPC = pulling the 7 spark plugs out of a 8 cylinder engine.

aka....your system will run like crap.

[snvpa]

Lol yeah i don't think that would work very well. Sorry bout the poor suggestion. I'm really just learning how to fix strange and difficult windows problems. keep us posted.

[Tazon]

i had a virus infecting my SVChost.exe file. AVG antivirus fixed it. it was a worm.