Yet Another Windows (XP) Question from a Mac Person

My girlfriend’s PC, a Sony tower of recent vintage running XP, has exhibited a behavior I’ve never seen before, and done it twice in the last two days.

With no apparent provocation, the system has performed its own shutdown with countdown, complaining of the RCP Locator service (or process?) having quit. With frantic seconds remaining, we did sudden saves and bookmarked open web pages and whatnot, in a couple of cases freaking like deer in the headlights at questions like “The document blahblah was saved more recently than the ~blahblah document that was recovered which is currently open. Do you want to revert to the older document which was previously saved which you are currently working on or save the document which was not more recent than the recovery of the existing document? yes/no/cancel” until the time ran out and did something by default without asking us.

Her connection to the internet is DSL with a non-static IP address. She has fairly standard built-in firewall settings, AFAIK, and has an antivirus package that was current as of time of purchase + spontaneous upgrade upon installation, don’t know if it has updated itself automatically in the background or not. She doesn’t utilize file sharing and doesn’t open file attachments from folks she doesn’t know.

So WTF? What would cause RCP Locator to croak twice within 24 hours (actually more like 18 hours)?

PS – unrelated except for also being w/regards to her computer – I brought home a USB keyboard for her to try out. She already had a USB Zip drive and a USB label printer. However, the USB keyboard is designed to let you daisy-chain USB devices, so I didn’t get a hub. I knew I wanted to daisy-chain the label printer, so I yanked its USB cord from the computer, put the keyboard’s USB plug in its place, then ran the label printer’s cord to the expansion USB port on the keyboard. Problem is, XP immediately noticed the absence of label printer and made a beep, and when I plugged it back in to the keyboard it made another beep and “noticed new hardware” and popped up the Add Hardware Wizard. After a couple of Next’s it requested the installation CD for the label printer.

So…ummmmm…it saw that I’d removed the label printer and decided of its own initiative “Gee, I guesss we’ll not be needing these here silly USB printer drivers, then will we? I’ll just erase 'em” – ??? So no biggie, it’s a mainstream brand, and I surf to their site and download the bloody drivers and install them to a location and run Add Hardware again. Now we’ve got two – two – two USB printers installed for one ::sigh:: so I open the Printers and Faxes doohickey in Setting and go to delete the older version of the USB printer (since the newer one works and the old one shows a status of “Offline”) and several decently large chunks of an hour later plus a restart XP is still in the process of “Deleting” the original printer but it is still in the list of printers.

a) What stupid ignorant Mac thing did I do that I shouldn’t have done, aside from not shutting down the freakin’ computer to unplug/replug the printer and add the keyboard etc? (Next time I’ll shut down and do it while the computer is under anesthesia instead of considering it an office procedure)

b) How the fuck do I delete the ghost printer so that the computer forgets about it and it doesn’t appear in the list of printers and so forth? Or if I leave it to its own :ahem: devices will it finish “deleting” the printer some time between now and 2 in the morning?

I think you mean RPC Locator. This is just a guess, but someone may be remotely exploiting a bug in Windows. Have you applied all the latest patches from Windows Update?

Great. :frowning:

But why would someone want to exploit a bug in Windows to the effect of making her computer shut down and restart itself? Or is something more sinister amiss?

Also: with a dynamically assigned IP, how the heck did anyone find her?

We have cable, and while our address is also assigned dynamically, it’s been the same for over a year. If the server can assign your computer the same IP it had before (read: someone else hasn’t taken it), it most often will. Alternately, someone could have just scanned all addresses in some range and found her computer by pure chance.

Printer issue: Try unplugging it, deleting all instances of it, and plugging it back in. I’ve noticed with USB devices that Windows XP wants you to install the drivers each time you plug it into a new USB header. For example, I have 6 USB ports total, three sets of two. Plugging something into any of those three sets makes XP recognize it as a “new” device, but only the first time it’s plugged into that particular set. My guess is that XP sees her keyboard as a new set of USB ports.

Why is does this, I have no idea.

It’s from the Microsoft Bug… most likely you are on IRC or some other 3rd party program or have a cable or dsl modem and people are exploiting you… As in the post by ‘Number’ make sure you have the most current Windows Updates/Patches/Fixes.

http://windowsupdate.microsoft.com/

Also run yourself a LOCAL FIREWALL… otherwise you are just asking for trouble.