Call (RPC) unexpectedly terminated.... then reboots

[ThePassenger]

This is annoying.

Randomly, after bringing the laptop out of sleep I'm getting a little box appearing on screen with this text appearing in it:

System Shutdown initiated by NT Authority\System. Windows must
now restart because the Remote Procedure Call (RPC) terminated
unexpectedly.

And a 50 second countdown until the laptop reboots.

Now, this *sounds* like Blaster, however I'm behind several firewalls, NAT and have AV running (AVG 7.5 with latest patches scans clean), I'm digging through event viewer and it looks like winlogon.exe takes a dumb, with NAT and dhcp following in hot persuit; which suggests something flaky with the network drivers?

[aldi]

Weirdness

It sounds so much like a worm that I'd try leaving it plugged into an empty hub for a while and see if it stops, or get ethereal/wireshark on the case!

[scruffy]

In fact, there is a very easy solution to this...

- Go to services

- Go to properties of "Remote Procedure Call (RPC)"

- Go to "Recovery" tab

- Set first failure, second failure and subsequent failures to "Restart the service" instead of "Restart the computer".

- Press ok.

Works for me and you dont need to fart about with patches or worm removal either. Though I would recommend it...

[spyke]

It could be that your network drivers don't like coming out of hibernation. However, they should be advertising this fact to Windows in the driver capabilities.

Launch device manager and bring up the properties for your network card. Now go to details and change the combo to "Power Capabilities" and there should be 4 "WAKE_FROM.." states in there. This means the drivers support waking up. However, it's entirely possible they've been written by a muppet - have you looked to see if there are any updates to them (either Windows Update or the manufacturer's own site)..?

[ThePassenger]

aldi said:

Weirdness

It sounds so much like a worm that I'd try leaving it plugged into an empty hub for a while and see if it stops, or get ethereal/wireshark on the case!

Yeah, I know... "Random RPC crash related reboots = MS.Blaster" if someone appeared here saying it I'd say the same but this is totally random, I've even checked to make sure nobody with a WiFi card has appeared near me just in case that could be the reason. Actually thinking about it the first time it happened I'd Fn+F2'd the laptop... so it didn't have any network!

As for network traffic, I've just checked, nothing going in or out of the laptop that isn't expected... if it's left alone with no shares open it's silent. Same with the other machines on the LAN.

The only two new peices of software in this rebuild are Firefox 2.0 and AVG-Free 7.5; I'm discounting AVG as I used to run the SOHO 7.5 version for quite a while and never had this... which leaves a bug in Firefox to my mind; although why it's freaking out RPC when I suspend the laptop I dunno.

[ATG]

if you've just rebuilt the machine, I'd definitely be checking the NIC drivers

[ThePassenger]

spyke said:

It could be that your network drivers don't like coming out of hibernation. However, they should be advertising this fact to Windows in the driver capabilities.

Not looked for updates yet, however I used the exact same drivers I did in Feb this year from the Dell restore CD's. Only had the problem with this rebuild...

scruffy said:

- Set first failure, second failure and subsequent failures to "Restart the service" instead of "Restart the computer".

Done, ta muchly for that.

Edited by ThePassenger on Tuesday 14th November 13:29