0

I ran the malware scanner Hitman Pro on a Windows Vista computer, and it detected that C:\Windows\system32\rpcss.dll was infected. I uploaded the file to virustotal.com and its analysis said that 28 out of 53 signature databases report it is infected with a trojan/virus, so it is very likely infected.

I did a sfc /scanfile=c:\Windows\system32\rpcss.dll, and Windows said the file was corrupted and that it repaired the file and that I needed to restart. After Vista booted up, all it showed was a black screen with the mouse pointer. It never made it to the login screen. I could move the mouse pointer around, but nothing else worked. CTRL+ALT+DEL didn't do anything, and I had to do a hard power down and power on to restart the computer.

The same black screen with mouse pointer happened when I tried to boot Vista into Safe Mode. Then I tried booting from the Dell Windows Vista DVD, and I tried the "Startup Repair" option, but it said it couldn't find any problems. Running chkdsk didn't find any problems either. So I used the System Restore option to go back to a restore point from yesterday, and the system was finally able to boot up to the login screen. But the rpcss.dll file is still infected according to virustotal.com.

Any idea how to fix the rpcss.dll file and not run into the black screen problem?

  • Did you run chkdsk C: /r already? – and31415 Jul 25 '14 at 8:54
  • Yes I ran chkdsk and it didn't find any problems. – pacoverflow Jul 25 '14 at 15:15
  • Even with the /r switch, right? What's the hard disk model? Try scanning your system with Windows Defender Offline. – and31415 Jul 25 '14 at 17:44
0

boot from the Windows Vista DVD or Windows Recovery Environment (F8), open the command prompt and run this:

sfc /SCANNOW /OFFBOOTDIR=c:\ /OFFWINDIR=c:\windows

Replace C: with the drive letter where you installed Windows.

Is sfc able to restore the infected file?

  • I did do a "sfc /scannow" an hour ago and it said there were corrupt files, but when I restarted I still got the black screen. I didn't include the offbootdir and offwindir options though - apparently those are for offline repairs - what does "offline repair" mean? – pacoverflow Jul 21 '14 at 4:20
  • the "off" means when the Windows is not booted. upload the CBS.log so that we can see which files are still corrupted – magicandre1981 Jul 21 '14 at 4:22
  • I uploaded everything in CBS.log from today: pastebin.com/UuHHViTh – pacoverflow Jul 21 '14 at 4:46
  • according to the log, the rpcss.dll was restored, but the settings.ini from the Sidebar is still broken. so your blackscreen has other causes – magicandre1981 Jul 21 '14 at 17:46
  • @pacoverflow As previously commented, there's only a file which appears to be corrupted: C:\Program Files\Windows Sidebar\settings.ini It's actually a documented false positive, and you can safely ignore it. – and31415 Jul 25 '14 at 8:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.