0

I ran the malware scanner Hitman Pro on a Windows Vista computer, and it detected that C:\Windows\system32\rpcss.dll was infected. I uploaded the file to virustotal.com and its analysis said that 28 out of 53 signature databases report it is infected with a trojan/virus, so it is very likely infected.

I did a sfc /scanfile=c:\Windows\system32\rpcss.dll, and Windows said the file was corrupted and that it repaired the file and that I needed to restart. After Vista booted up, all it showed was a black screen with the mouse pointer. It never made it to the login screen. I could move the mouse pointer around, but nothing else worked. CTRL+ALT+DEL didn't do anything, and I had to do a hard power down and power on to restart the computer.

The same black screen with mouse pointer happened when I tried to boot Vista into Safe Mode. Then I tried booting from the Dell Windows Vista DVD, and I tried the "Startup Repair" option, but it said it couldn't find any problems. Running chkdsk didn't find any problems either. So I used the System Restore option to go back to a restore point from yesterday, and the system was finally able to boot up to the login screen. But the rpcss.dll file is still infected according to virustotal.com.

Any idea how to fix the rpcss.dll file and not run into the black screen problem?

Improve this question
3
  • Did you run chkdsk C: /r already?
    – and31415
    Jul 25, 2014 at 8:54
  • Yes I ran chkdsk and it didn't find any problems.
    – pacoverflow
    Jul 25, 2014 at 15:15
  • Even with the /r switch, right? What's the hard disk model? Try scanning your system with Windows Defender Offline.
    – and31415
    Jul 25, 2014 at 17:44

1 Answer 1

Reset to default
0

boot from the Windows Vista DVD or Windows Recovery Environment (F8), open the command prompt and run this:

sfc /SCANNOW /OFFBOOTDIR=c:\ /OFFWINDIR=c:\windows

Replace C: with the drive letter where you installed Windows.

Is sfc able to restore the infected file?

Improve this answer
8
  • I did do a "sfc /scannow" an hour ago and it said there were corrupt files, but when I restarted I still got the black screen. I didn't include the offbootdir and offwindir options though - apparently those are for offline repairs - what does "offline repair" mean?
    – pacoverflow
    Jul 21, 2014 at 4:20
  • the "off" means when the Windows is not booted. upload the CBS.log so that we can see which files are still corrupted
    – magicandre1981
    Jul 21, 2014 at 4:22
  • I uploaded everything in CBS.log from today: pastebin.com/UuHHViTh
    – pacoverflow
    Jul 21, 2014 at 4:46
  • according to the log, the rpcss.dll was restored, but the settings.ini from the Sidebar is still broken. so your blackscreen has other causes
    – magicandre1981
    Jul 21, 2014 at 17:46
  • @pacoverflow As previously commented, there's only a file which appears to be corrupted: C:\Program Files\Windows Sidebar\settings.ini It's actually a documented false positive, and you can safely ignore it.
    – and31415
    Jul 25, 2014 at 8:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .