So what the hell is svchost/rpcss/epmap...

Ledneh

...and why the hell is it raping my machine's CPU use?

Well, raping is a pretty strong word. But after my reformat last night I noticed that I'm getting odd burps in my performance. Like max power for 5 seconds, a 1-2 second burp, then repeat. So I watched the task manager for a while, and saw that svchost.exe was rising to 20% CPU infrequently then dropping back down again. Once in a while csrss.exe burps too.

A bit of skullduggery later, I find out that this svchost.exe is responsible for the RPCSS service, whatever that stands for, and I can't turn it off without shutting down windows. This particular one I found out has a connection listening on port "epmap" according to tcpview. I can't figure anything about csrss.exe.

So my questions follow:

1) Have I been haxored? Being behind a firewall and router, and not being stupid with my internet practices, I sort of doubt it, but I've been wrong before.

2) What the hell is epmap? Google was oddly unhelpful for me on this one.

3) Has anyone else run into either of these situations, and knows what to do about it?

Thanks folks.

Daedalus

csrss is a vital Windows function. I forget which one right now.

JJ

I have about 5 svchost.exes running in my task manager. All of negligible hit to the CPU.

hmmmm.

UncleSporky

epmap is unfamiliar to me and probably killable, but svchosts are vital to the running of Windows. They are basically all the wonderful little programs like "Start Menu 7.0" and "Open Dialog Box 12.5" and "Print Spooler 6.8." RPCSS goes along with that.

Daedalus

svchost is the Windows services host and as such is a container for a whole bunch of background programs, any one of which could be a troublemaker. Open up msconfig and go to the Services tab. Sort by publisher. Don't uncheck any from Microsoft unless you know what you're doing.

Shurakai

My svchosts (I have like 10) usually take up a fair bit of RAM, but not usually CPU. I've heard it can happen, though.

UncleSporky

Here is some good information about RPCSS: http://cexx.org/rpc.htm

Should rpcss.exe be deleted? No. Under Windows 9x, a program may need it to communicate with other components of itself. Of course, you could delete the program, but various unpleasantries could result. Under Windows NT/2000, deleting this critical system component will disable your OS (although I believe Windows 2000's system file protection service will automatically replace it with a backup).

Ledneh

UncleSporky wrote: »

epmap is unfamiliar to me and probably killable, but svchosts are vital to the running of Windows. They are basically all the wonderful little programs like "Start Menu 7.0" and "Open Dialog Box 12.5" and "Print Spooler 6.8." RPCSS goes along with that.

I just figured one part out at least, epmap is another name for port 135. Whatever the hell happens on that port must be causing my issues, but my router/firewall blocks that by default far as I can see. So RPCSS is listening on port 135 for something.

What happens on port 135?

(edit) There's no non-Microsoft services listed that I don't recognize, so no go there

JellyMeetsJam

http://www.processlibrary.com/

Invaluable to someone with your questions

mspencer

You can also get Microsoft Process Explorer at http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx and look at what each process is doing. Anything with a lot of network sockets open might be suspicious. Anything with Internet Explorer settings or registry keys open might be suspicious.

TheSonicRetard

While we're on the topic of tweaking windows, I have two questions

1) how do I disable all bubbles from windows? I don't care that windows firewall is disabled.

2) what can I use to change exactly what starts up? I don't want microsoft messenger starting up.

Aldarez

TheSonicRetard wrote: »

While we're on the topic of tweaking windows, I have two questions

1) how do I disable all bubbles from windows? I don't care that windows firewall is disabled.

2) what can I use to change exactly what starts up? I don't want microsoft messenger starting up.

1)a)Click Start, click Run, type regedit, and then press ENTER.
b)Navigate to the following subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
c)Right-click the right pane, create a new DWORD value, and then name it EnableBalloonTips.
d)Double-click this new entry, and then give it a hexadecimal value of 0.
e)Log off and back on.

Be warned: the registry is a great place to wreck your Windows install, mess with it at your own peril

2)If it's not in your Start Menu "Startup" folder, try going to Start-Run, type in msconfig and hit Enter, then check the Startup tab.

HTH

Edit: IIRC you can stop messenger starting up by going into the program options as well.

thej3w

port 135 is for windows file sharing, so if youre browsing other computers on your network or others are doing the same you might want to keep that running.