RPC service terminated unexpectedly

[pyromaster114]

I have a Sony Vaio VGN-FZ290 notebook computer.
It is running Windows Vista Ultimate
A brief summary of the system specifications are as follows:
2.2GHz Intel Centrino Duo 800MHz FSB
2GB RAM
160GB HDD
Not sure any of that is actually relevant, but I thought I'd list it because this computer is not in the system specs in my profile.

It does some pretty weird $h*t lately. Most of the **** can be attributed to "oh well windows just sucks sometimes."
Some of it however, is just not normal, like the problem I'm experiencing now.

About once every 24 hours, the computer decides that something called "Remote Procedure Call (RPC) service" has shut down unexpectedly. It's solution: Reboot the computer.
Well this happens to be a problem, because it interrupts everything else that's going on.

Here is the message in the event logs that it gives:
Log Name: System
Source: USER32
Date: 1/21/2009 3:07:43 AM
Event ID: 1074
Task Category: None
Level: Information
Keywords: Classic
User: SYSTEM
Computer: Chii
Description:
The process C:\Windows\system32\services.exe (CHII) has initiated the restart of computer CHII on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x30006
Shutdown Type: restart
Comment: Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="USER32" />
<EventID Qualifiers="32768">1074</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-01-21T09:07:43.000Z" />
<EventRecordID>28480</EventRecordID>
<Channel>System</Channel>
<Computer>Chii</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data>C:\Windows\system32\services.exe (CHII)</Data>
<Data>CHII</Data>
<Data>No title for this reason could be found</Data>
<Data>0x30006</Data>
<Data>restart</Data>
<Data>Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly</Data>
<Data>NT AUTHORITY\SYSTEM</Data>
<Binary>06000300</Binary>
</EventData>
</Event>

I have been attempting to read up on this error, and the only thing I've come up with, is that there's this thing that apparently affects XP called a w32.blaster.worm or something. Now, even if that can affect vista, I don't think it's here, because the symantec removal tool for it, and it says that it isn't on the system.

Any ideas how to stop this from happening?

 

[brucethetech]

Your viao has a boatload of Sony utilities on it that use the system services. So before attributing it to windows sucks sometimes, you should confirm that your Sony suites are working as they should and haven't been modified.Also that error happens alot when you're infected by malware of a virus. Have you run a scan? if so what AV Program?

 

[pyromaster114]

I have run a scan with the latest version of AVG 8 Free edition. The database is up to date, and the scan says that there are no infections or errors.

There are a lot of Sony utilities installed, I know that, however they've been causing the event log to accumulate massive amounts of errors since day one, and there have been no new errors from Sony related processes since before this started, at least not that I was able to find. Although if anyone suggests disabling a certain process from Sony's software, I'll certainly try it.

Currently I'm running another virus scan, in hopes that maybe it finds something that it didn't before. (Retarded, yes, but it wouldn't be the first time, and it did update the database this morning.)

 

[Bobbye]

Are you running the Windows Server 2003 (All Versions)? If so, this information would apply:

MS03-026: Buffer Overrun in RPC May Allow Code Execution
http://support.microsoft.com/default.aspx?scid=kb;en-us;823980

This is the ONLY cause I can find for this Error that is not specific to the OS. Consider running an online virus scan also.
Try Kaspersky Detect Viruses and Spyware with our Online Scanner
http://www.kaspersky.com/virusscanner

 

[pyromaster114]

I am not running Windows Server 2003... unless somehow Vista is similar enough to count as running the same system...

What does the RPC service do? Can I disable it?
Whenever I try to go disable it, I run into a problem cause the option to disable it in the services list is ghosted so you can't click it or change it.

 

[Bobbye]

Don't try to disable RPC. The computer won't run.

See this for description. Note the Dependency:
http://www.blackviper.com/WinVista/Services/Remote_Procedure_Call_(RPC).htm

Make sure the DCOM Server Process Launcher is running.

If you cannot resolve this, I suggest you follow the Malware and Virus Cleaning Prelim here:
https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

Attach the three logs when you have finished.

 

[pyromaster114]

I ran a scan at http://www.kaspersky.com/virusscanner as Bobbye suggested. It didn't find anything except my IRC client... with apparently then it says is not a virus. (Wtf? If it's not a virus, then why mention it? Is it a virus only if you don't have an IRC client installed? That's odd.)

The DCOM Server Process Launcher is running and hasn't given any errors that I've seen.

Oddly enough, the computer has stopped rebooting of it's own accord now, and is not giving me any more problems currently. (Messed up, I know.)
I'll assume the latest update to windows that it did the other day fixed the problem. (If not, I'll have to keep looking as to what may have caused it... if I can't find what happened I'll call an exorcist or ask the computer nicely or something strange like that :haha:.)

Out of curiosity, how likely is it that a hardware failure (such as the SATA controller or HDD) caused the errors? It doesn't seem very likely, but I could be wrong.

 

[Bobbye]

Out of curiosity, how likely is it that a hardware failure (such as the SATA controller or HDD) caused the errors? It doesn't seem very likely, but I could be wrong.

If it was a hardware failure, you would most likely still be having the problem,

 

[pyromaster114]

If it was a hardware failure, you would most likely still be having the problem,

As I thought, because it's unusual for a hardware failure causing such a problem to just go away, and would not be very common for it to be intermittent.
However I thought I'd ask because my friend had a similar problem with the same model computer, and that it was intermittent at first. He said that in the end, his motherboard had to be replaced because of a bad SATA controller, although his had different problems as well.

Oh well, I hope that the problem has resolved itself. If not I suppose it's back to square one. (Or call the exorcist. :haha

Thanks for the help guys.

 

[Bobbye]

Going back to your first post: Event 1074, Source: User32 is an Information Event, not an error. The system is just logging what was done at that time.

The process listed in the event provides an important clue as to who or what initiated the shutdown or the restart. The process listed is services.exe. This is the Service Control Manager which maintains a database of installed services in the registry. The database is used by the SCM and programs that add, modify, or configure services.

When a service is started, the SCM performs the following steps:

* Retrieve the account information stored in the database.
* Log on the service account.
* Load the user profile.
* Create the service in the suspended state.
* Assign the logon token to the process.
* Allow the process to execute.

For some unknown reason, there are times when the sequence fails and you have to reboot. My thought is that it could be a RAM problem. While you have sufficient RAM installed, if a chip is bad, after this time period, the system uses up all the available RAM and the necessary RPC Service cannot run. Rebooting restores the RAM.

The only way I know of to check this is to run the memtest. So if this starts happening again, do that:
How to run memtest: HERE

Now you have a starting point if the same problem begins again. (I don't do Exorcisms, so let's hope it doesn't come to that!)