I am looking for information on a file (and executable process) that
is part of Microsoft Windows called RPCNET.EXE.   On my computer
(running Windows XP), this process occasionally hangs and prevents
Windows from shutting down.  I have searched the entire Web, Usenet,
and the Microsoft KnowledgeBase and there is ZERO info on what this is,
what it does, or what might cause it to hang?

---

Request for Question Clarification by vinods-ga on 21 Oct 2002 14:35 PDT

Hello, 

Please provide a list of installed software and items from 

CONTROL PANEL > ADD/REMOVE SOFTWARE 

Warm regards
Vinods-ga

---

Request for Question Clarification by vinods-ga on 21 Oct 2002 14:45 PDT

Hi, 

At the onset, RPC most probably refers to Remote Procedure Call. And
RPCNET should relate to something network-related.

Please let me know what kind of networking options you are running on
your machine. The problems seem to stem from some aspect of net
communication. This may prove to be a tough one but I would like to
make a sincere attempt to see you through.

Maybe some more information form you may help me start off in a
particular direction.

warm regards
Vinods-ga

---

Request for Question Clarification by vinods-ga on 21 Oct 2002 15:04 PDT

Hi, 


RPC on MS search provides the following:

[ http://search.microsoft.com/Default.asp?&so=RECCNT&boolean=ALL&siteid=us&p=1&nq=NEW&qu=RPC&btnsearch=Go&IntlSearch=&ig=1&ig=2&ig=3&ig=4&ig=5&ig=6&ig=7&ig=8&ig=9&ig=10&i=00&i=01&i=02&i=03&i=04&i=05&i=06&i=07&i=08&i=09
]

I am getting more positive that it has do with your networking or
Internet access or some program that is requesting access. Not a real
'answer' yet!

warm regards
vinods-ga

---

Request for Question Clarification by vinods-ga on 21 Oct 2002 15:11 PDT

Hi, 

Search for RPC in the registry on a machine running WIN XP
professional yields result:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc

Snippets, snippets. Well, I will not post for a while, until I hear
some clarifications from you! Sorry to be spammer-like!

warm regards
Vinods-ga

---

Clarification of Question by jgp95125-ga on 21 Oct 2002 15:31 PDT

There are some 65 applications listed in the Add/Remove Programs
window, so rather than list them all, please let me know which
particular ones you're interested in?

As mentioned in the Comments, I have good reason to believe the
offending application is Netscape 7.0.

I am aware of what an RPC is, and that the issue is somehow
network-related.  I am looking for specifics on what Windows
function(s) RPCNET.EXE performs, or for specifics on when an
application may invoke RPCNET.EXE, to give me some clues for isolating
what actions cause the second process to start and hang.

Thanks.

---

Request for Question Clarification by vinods-ga on 22 Oct 2002 09:29 PDT

Hi, 

If you have good reason to believe it is NETSCAPE, please try
uninstalling it and see if the problem persists.

warm regards
vinods-ga

---

Request for Question Clarification by spot_tippybuttons-ga on 25 Oct 2002 05:45 PDT

This is a long shot, but try this:

From Explorer, right click on RPCNET.EXE and choose Properties. You
should see a properties dialog with a tab that reads "General". There
may or may not be a second tab that reads "Version". If the "Version"
tab exists, can you post the contents?

Thanks,

Spot

---

Request for Question Clarification by spot_tippybuttons-ga on 25 Oct 2002 05:48 PDT

Ignore that last post... sorry, didn't see the comment about the
Version tab in the comments area.

---

Clarification of Question by jgp95125-ga on 27 Oct 2002 23:13 PST

In answer to vinods-ga, I have tried uninstalling and re-installing
Netscape to no avail.

---

Request for Question Clarification by legolas-ga on 12 Nov 2002 22:59 PST

I think I may have the answer for your question: do you have the
Mersenne Prime Search program installed on your machine? I have a
feeling that it is RPCNET.DLL (which IS used in that program to
communicate back answers to the main server). Please let me know and I
should have an answer for you!

Thanks,

Legolas-ga

Hi, jgp95125-ga:

I believe that, despite the timestamp similarity of this file with
others in your C:\Windows\System32 directory, RPCNET.EXE is not part
of Windows XP nor indeed a program authored by Microsoft or any other
reputable vendor.

You have confirmed that the file lacks any "Version" attributes by the
absence of such a tab when viewing the properties of the file.  The
vast majority of Microsoft or third party distribution .EXE files in
Windows\System32 will have these attributes.

There should only be a tiny number of .EXE files in this directory
which lack "Version" attributes.  For those few, checking the
"Compatibility" tab under the file Properties should suffice to pick
out which are genuinely part of the Windows XP distribution.  With a
Windows XP executable one sees this description:

"Compatibility modes cannot be set on this program because it is part
of Windows XP."

The remaining .EXE files will have a "Compatibility" tab that states:

"If you have problems with this program and it worked correctly on an
earlier version of Windows, select the compatibility mode to match
that earlier version."

Therefore I suggest you check the "Compatibility" tab, and I predict
you will find that your RPCNET.EXE falls into the latter category. 
Here, for the sake of comparison, are the counts on my machine
(Windows XP Pro installed over a factory installation of Windows XP
Home):

334 total .exe files in Windows\System32

all but 16 have version information; of those:
 - 14 are WinXP distribution by the Compatibility tab info as above
 - 2 of them are not part of WinXP and have non-matching file dates

In my case the two non-Windows files turned out to come from a Java
1.1.6 installation.

You give another argument as to why you believe that RPCNET.EXE is
part of the Windows operating system, namely that it is running (in
the first instance) under the SYSTEM account.  However this is a weak
argument.  The SYSTEM account has no password and can under some
circumstances be "impersonated":

http://www.cgisecurity.com/archive/webservers/iis_4.0-5.0-local-priv-gain.txt

http://www.spearheadsecurity.com/support/alerts/xp.shtml

Therefore I see the fact that this "unknown" program is running under
the SYSTEM account as consistent with suspicion of a malware program
having been added to your machine without your knowledge.  I would
certainly begin with a good virus scan, followed by the "spyware"
checking program Ad-Aware available at:

http://www.lavasoft.de

As you have observed there is no mention of any RPCNET.EXE file on the
Web, and no one but you seems to have found this file on their machine
(I checked my Win98, WinNT, and Win2K machines as well).  As Legolas
points out, there is a file RPCNET.DLL which is part the "GIMPS"
(Great Internet Mersenne Prime Search) distribution, but this would
not explain a file called RPCNET.EXE.  The files that are used by
Windows XP to support the Remote Procedure Call service are
svchost.exe and rpcss.dll (while RPC Locator service uses
locator.exe), and these files are indeed in the Windows\System32
directory but do not account for your mystery file.

In summary I believe that we have collectively exhausted all the
possible legitimate explanations for the file, and that a certain
amount of suspicion is called for now.  I would investigate how the
program is launched.

My first step would be to search your registry for the string
"RPCNET".  On my own machine all I find are data entries corresponding
to recent "file find" searches done with the Windows Explorer tool and
a MS SQL Server key called RPCNetLib (mainly just a placeholder for
empty values).

Because of the association you have reported with running Netscape, I
believe it may turn out that there are registry entries for Netscape
and one other place in the registry that trigger the execution of this
program.  One way to confirm this would be to create a harmless
program of the same name and replace it in Windows\System32, e.g. a
copy of Notepad.exe.

I'm sure that I have raised more questions than I have been able to
answer for you, so please let me know how I can clarify the points
that are of greatest concern.

regards, mathtalk-ga

---

Clarification of Answer by mathtalk-ga on 14 Nov 2002 18:06 PST

In response to what I assume was your microsoft.public newsgroup
posting, "Bob" replied that RPCNET.EXE appeared on his Win2K machine
after installing sp3.  I have sp3 on my Win2K machine, and there is no
such file.

The "fixes" notes for Win2K sp3 do include several resolutions of RPC
related problems.  This one especially:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q298012

gives (about one-quarter of the way down the page) a list of affected
files required for the resolution.  RPCNET.EXE is not among them.

regards, mathtalk-ga

---

Clarification of Answer by mathtalk-ga on 14 Nov 2002 20:55 PST

Another thing I tried is searching the current Platforms DVD from the
MSDN subscription disks (all versions of WinXP, Win2K, and "Whistler")
for anything with RPCNET in the filename.  Nada.  Other distribution
files, like RPCSS.DL_ and REDIR.EX_, turned up as expected.

-- mathtalk

---

Clarification of Answer by mathtalk-ga on 19 Nov 2002 08:46 PST

Hi, jgp95125-ga:

One final clarification concerns what might be causes the "hang" in
the shutdown of Windows XP.  Without a copy of this program to analyze
in hand, what I can say about this is necessarily in the realm of
speculation.  However if the program is some sort of Trojan or "back
door" program, the second copy may be trying to "hook" an interface to
the keyboard, etc. that the first copy already has.  This probably
causes the second copy to fall into a loop in which it does not
respond to "close" messages, and hence at shutdown it fails to end
gracefully.

The "firewall" component of the McAfee Virus Scan 6.0 Professional (or
later) software would tell us what Internet ports, if any, are being
attempted by this program.  Of course the name RPCNET.EXE suggests an
Internet connection is involved, but what's in a name?

Here are some ways that you could submit the program for analysis once
the steps outlined above convince you this is not a legitimate
Microsoft offering:

[Symantec/Norton Virus Sample Submission]
http://securityresponse.symantec.com/avcenter/submit.html

[Network Associates/McAfee Virus Sample Submission]
http://www.mcafeehelp.com/displaydoc.asp?docid=60953&CategoryId=243

[Panda Software Virus Sample Submission]
http://www.pandasecurity.com/submitvirus.htm

best wishes, mathtalk-ga

Tell us a bit more:

Are you running Adobe Photoshop?

What makes you so sure that RPCNET.EXE is causing the hang?

I am sure it is RPCNET.EXE because I started watching the Task Manager
when this started happening.  Although the RPCNET.EXE process is
always running under the "System" username, it is only when a second
RPCNET.EXE process under my username appears that the system hangs on
shutdown.

If I manually kill the second RPCNET.EXE process from the Task
Manager, Windows will shut down properly.  And interestingly, if I
forget to check the Task Manager before shutting down and I run into
this problem and have to turn off the power, the second RPCNET.EXE
process remains running after I reboot!

I am not running Adobe Photoshop.  My best guess is that Netscape 7.0
is causing this, because it only started happening after I installed
that.  But it doesn't happen every time I run Netscape 7.0, and I
haven't been able to isolate any partiular actions in Netscape (or any
other application) which triggers the second RPCNET.EXE process.

Hmmm.  

You're right about the non-existence of "RPCNET.EXE" out there on the
web.  There is company called RPCNET that makes downloadable software
for rendering 3 dimensional images out of 2-D starting material. 
Their site mentions a specific problem with Windows XP and Photoshop
(which is why I asked).  Take a look at http://www.rpcnet.com/ and see
if anything looks familiar.

In addition, you might want to do a "Find" files search on your own
system (including subdirectories) to see if you can identify where
RPCNET.EXE (or better yet, just search for RPCNET) is housed, and what
program it's associated with.  That might offer some clues.

Good luck.

RPCNET.EXE is part of Windows (appears only in the C:\Windows\System32
folder) and has the same date and time stamp as all other Windows
executable files.

I am a pretty decent web researcher on my own, but can find NOTHING on
this file anywhere.  I have never before found any search term which
gave no results in any search engine!  Hence my query to the Google
"professionals"!  :^)

are you *sure* it came with windows?  look at the file's properties
and see what it says on the version tab....  I don't have a file
called rpcnet.exe on my own copy of WindowsXP, so perhaps it really
came with Netscape 7.0 or some other software?

The date and time on RPCNET.EXE are: 8/18/2001 5:00 AM, which is the
same as almost all the other files in that folder (and well before
Netscape 7.0 was released).  Since this machine is only a couple
months old and had no software installed on it in 2001, I'm pretty
sure this is part of Windows, especially since the first instance of
the process runs under the "System" username.

There is no Version tab on my Properties window.

I am running the Home Version of Windows XP, if that matters.  I know
there are certain security and network features in Windows XP Pro that
are not in the Home Edition.

I did a search on the Windows XP Pro install CD
(you can search cab and zip files by searching 
for 'text' rpcnet in 'files' *.*) and didn't
find the file on the install disk.

It also strikes me as odd that windows would open
a second instance of a service that is already
running - I haven't seen that in the time I've
worked with W2K or XP.

I would monitor the services window after opening
each application, to see what initiates the entry
under your username. This should isolate the program
responsible, though it may be tedious.

hi jgp95125,
maybe you can see in Control Panel | Administrative Tools | Services
for any services by the name RPCNET.

regards,
guybrush152

Using Control Panel | Administrative Tools | Services, the service is
listed as:

Name: "Remote Procedure Call (Net)"
Description: <blank>
Status: "Started"
Startup Type: "Automatic"
Log On As: "Local System"

When I right click on this and click "Properties", there are tabs for
General, Log On, Recovery, and Dependencies.  The first 3 just repeat
the above values.  On the Dependencies tab, it says:

This service depends on the following system components:
<No Dependencies>

The following system components depend on this service:
<No Dependencies>

Also listed in the Services window are:

Name: "Remote Procedure Call"
Description: "Provides the endpoint mapper and other miscellaneous RPC
services."
Status: "Started"
Startup Type: "Automatic"
Log On As: "Local System"

Name: "Remote Procedure Call (RPC) Locator"
Description: "Manages the RPC name service database."
Status: <blank>
Startup Type: "Manual"
Log On As: "Network Service"

Had the same exact problem in W2k.  The remote proceedure call, along
with the RPC Locator, are set to automatic in services. In my
experience, if these are set to disable or manual, all internet
activity will stop, as they provide endpoint mapping and other
internet services.  Your hunch that Netscape is the problem is
probably right. IE or a mail client, and Netscape and both executing
an RPC.  One solution would be to uninstall/reinstall Netscape, and
then make sure it's set as your default browser.  Are you using a
third party mail client, or Outlook (not Outlook Express)?  If so make
sure your choice is set as default. Hope this helps.

You could try completely disabling the service, rebooting, and then
looking to see whether this affected anything else on your system. If
it _did_ affect an application, then that would be the guilty party
which installed it. If it didn't, then keep it disabled!

jgp...

I'm using Windows 2000, and have the same settings
you described. The 'blank' status of RPC locator
means that it hasn't been started and isn't running.

Try stopping the service (if applicable), renaming rpcnet.exe to
rpcnet.bak in whatever directory it's in -- and rebooting ... If this
doesnt work, try doing anything it takes (including booting into safe
mode, from a boot disk, etc) - to rename this file or move it out of
whatever path it's currently in... When you've successfully done this
and have rebooted, check the functionallity of all your apps, internet
connectivity, etc... As mentioned in the answer -- It may be a Virus,
as they frequently like to run as EXE's in the background...