Re: Help with infected RPCSS.EXE file

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Frank Saunders, MS-MVP IE/OE (franksaunders_at_mvps.org)
Date: 01/08/05 

Date: Fri, 7 Jan 2005 20:54:30 -0600

Do you have a WindowsXP CD?
If so, go to Start | Run and type
msconfig
and then press <Enter>. On the right there is a button to "Expand File".
Click that. Put in the Windows XP CD and hold down the shift key for 20
seconds. Then enter
rpcss.exe
in the top box. Click Browse beside the Restore from box and browse to the
i386 folder on your CD. For the Save file in box type
C:\Windows\System32
Then click the Expand button. 

-- 
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only.  Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
"Lisa Moats" <jazmama@earthlink.net> wrote in message
news:uMZVJkR9EHA.3708@TK2MSFTNGP14.phx.gbl
> I'm sorry to be ignorant, but a little more detail would be helpful.
> I've opened msconfig and I see the Expand File option, but I don't
> know which .cab file to select to restore from. Can you help some
> more? Thanks.
>
> Also - it will want me to reboot, apparently, before anything actually
> happens.  But I'm afraid to reboot without the rpcss.exe being in the
> proper place.  Should I put the infected file back before I reboot,
> just to be sure I get a clean reboot?
>
> "Frank Saunders, MS-MVP" <franksaunders@mvps.org> wrote in message
> news:eBsgyFR9EHA.3124@TK2MSFTNGP11.phx.gbl...
>> "Lisa Moats" <jazmama@earthlink.net> wrote in message
>> news:ORsZ7$Q9EHA.1452@TK2MSFTNGP11.phx.gbl
>>> My virus software found that the rpcss.exe file in the
>>> windows\system32 folder was infected with a trojan (TROJ_AGENT.AM).
>>> It quarantined the file. I tried to clean it, but that didn't work.
>>>
>>> Based on what I've read, deleting the file is certainly not
>>> advisable. Where can I get a clean version of this file?  Can I
>>> download it from microsoft, or can I reinstall just it from the
>>> Windows XP installation disc? Can I just get a copy from someone
>>> running the same OS and replace the infected one?
>>>
>>> Thanks for any help.
>>
>> Use msconfig to expand it from your winXP CD.
>>
>> --
>> Frank Saunders, MS-MVP, IE/OE
Quantcast