TechSpot

RPC service terminated unexpectedly

By pyromaster114
Jan 21, 2009
  1. I have a Sony Vaio VGN-FZ290 notebook computer.
    It is running Windows Vista Ultimate
    A brief summary of the system specifications are as follows:
    2.2GHz Intel Centrino Duo 800MHz FSB
    2GB RAM
    160GB HDD
    Not sure any of that is actually relevant, but I thought I'd list it because this computer is not in the system specs in my profile.

    It does some pretty weird $h*t lately. Most of the **** can be attributed to "oh well windows just sucks sometimes."
    Some of it however, is just not normal, like the problem I'm experiencing now.

    About once every 24 hours, the computer decides that something called "Remote Procedure Call (RPC) service" has shut down unexpectedly. It's solution: Reboot the computer.
    Well this happens to be a problem, because it interrupts everything else that's going on.

    Here is the message in the event logs that it gives:
    Log Name: System
    Source: USER32
    Date: 1/21/2009 3:07:43 AM
    Event ID: 1074
    Task Category: None
    Level: Information
    Keywords: Classic
    User: SYSTEM
    Computer: Chii
    Description:
    The process C:\Windows\system32\services.exe (CHII) has initiated the restart of computer CHII on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
    Reason Code: 0x30006
    Shutdown Type: restart
    Comment: Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="USER32" />
    <EventID Qualifiers="32768">1074</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2009-01-21T09:07:43.000Z" />
    <EventRecordID>28480</EventRecordID>
    <Channel>System</Channel>
    <Computer>Chii</Computer>
    <Security UserID="S-1-5-18" />
    </System>
    <EventData>
    <Data>C:\Windows\system32\services.exe (CHII)</Data>
    <Data>CHII</Data>
    <Data>No title for this reason could be found</Data>
    <Data>0x30006</Data>
    <Data>restart</Data>
    <Data>Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly</Data>
    <Data>NT AUTHORITY\SYSTEM</Data>
    <Binary>06000300</Binary>
    </EventData>
    </Event>

    I have been attempting to read up on this error, and the only thing I've come up with, is that there's this thing that apparently affects XP called a w32.blaster.worm or something. Now, even if that can affect vista, I don't think it's here, because the symantec removal tool for it, and it says that it isn't on the system.

    Any ideas how to stop this from happening?
     
  2. brucethetech

    brucethetech TS Enthusiast Posts: 229

    Your viao has a boatload of Sony utilities on it that use the system services. So before attributing it to windows sucks sometimes, you should confirm that your Sony suites are working as they should and haven't been modified.Also that error happens alot when you're infected by malware of a virus. Have you run a scan? if so what AV Program?
     
  3. pyromaster114

    pyromaster114 TS Guru Topic Starter Posts: 246

    I have run a scan with the latest version of AVG 8 Free edition. The database is up to date, and the scan says that there are no infections or errors.

    There are a lot of Sony utilities installed, I know that, however they've been causing the event log to accumulate massive amounts of errors since day one, and there have been no new errors from Sony related processes since before this started, at least not that I was able to find. Although if anyone suggests disabling a certain process from Sony's software, I'll certainly try it.

    Currently I'm running another virus scan, in hopes that maybe it finds something that it didn't before. (Retarded, yes, but it wouldn't be the first time, and it did update the database this morning.)
     
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

  5. pyromaster114

    pyromaster114 TS Guru Topic Starter Posts: 246

    I am not running Windows Server 2003... unless somehow Vista is similar enough to count as running the same system...

    What does the RPC service do? Can I disable it?
    Whenever I try to go disable it, I run into a problem cause the option to disable it in the services list is ghosted so you can't click it or change it.
     
  6. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

  7. pyromaster114

    pyromaster114 TS Guru Topic Starter Posts: 246

    I ran a scan at http://www.kaspersky.com/virusscanner as Bobbye suggested. It didn't find anything except my IRC client... with apparently then it says is not a virus. (Wtf? If it's not a virus, then why mention it? Is it a virus only if you don't have an IRC client installed? That's odd.)

    The DCOM Server Process Launcher is running and hasn't given any errors that I've seen.

    Oddly enough, the computer has stopped rebooting of it's own accord now, and is not giving me any more problems currently. (Messed up, I know.)
    I'll assume the latest update to windows that it did the other day fixed the problem. (If not, I'll have to keep looking as to what may have caused it... if I can't find what happened I'll call an exorcist or ask the computer nicely or something strange like that :haha:.)

    Out of curiosity, how likely is it that a hardware failure (such as the SATA controller or HDD) caused the errors? It doesn't seem very likely, but I could be wrong.
     
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    If it was a hardware failure, you would most likely still be having the problem,
     
  9. pyromaster114

    pyromaster114 TS Guru Topic Starter Posts: 246

    As I thought, because it's unusual for a hardware failure causing such a problem to just go away, and would not be very common for it to be intermittent.
    However I thought I'd ask because my friend had a similar problem with the same model computer, and that it was intermittent at first. He said that in the end, his motherboard had to be replaced because of a bad SATA controller, although his had different problems as well.

    Oh well, I hope that the problem has resolved itself. If not I suppose it's back to square one. (Or call the exorcist. :haha:)

    Thanks for the help guys.
     
  10. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Going back to your first post: Event 1074, Source: User32 is an Information Event, not an error. The system is just logging what was done at that time.

    The process listed in the event provides an important clue as to who or what initiated the shutdown or the restart. The process listed is services.exe. This is the Service Control Manager which maintains a database of installed services in the registry. The database is used by the SCM and programs that add, modify, or configure services.

    When a service is started, the SCM performs the following steps:
    For some unknown reason, there are times when the sequence fails and you have to reboot. My thought is that it could be a RAM problem. While you have sufficient RAM installed, if a chip is bad, after this time period, the system uses up all the available RAM and the necessary RPC Service cannot run. Rebooting restores the RAM.

    The only way I know of to check this is to run the memtest. So if this starts happening again, do that:
    How to run memtest: HERE

    Now you have a starting point if the same problem begins again. (I don't do Exorcisms, so let's hope it doesn't come to that!)
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...