[peter plus]

File attached

Attached Files

•  cbs.txt   919.03KB   223 downloads

[Advertisements]

Looks like it did what it is supposed to. Let's verify since malware was involved. Please do the following again.

 

Step#1 - File Identification
1. Run FRST by Right-Clicking on the file and choosing Run as administrator.
2. Type rpcss.dll into the Search box of the FRST window.
3. Click the Search Files button.
4. When the search is done it will open a notepad window with the results. Please copy/paste the contents of this window into your next post.

[BrianDrab]

Looks like it did what it is supposed to. Let's verify since malware was involved. Please do the following again.

 

Step#1 - File Identification
1. Run FRST by Right-Clicking on the file and choosing Run as administrator.
2. Type rpcss.dll into the Search box of the FRST window.
3. Click the Search Files button.
4. When the search is done it will open a notepad window with the results. Please copy/paste the contents of this window into your next post.

[peter plus]

Farbar Recovery Scan Tool (x86) Version: 29-05-2015

Ran by Pauline at 2015-05-31 19:49:52

Running from C:\Users\Pauline\Desktop

Boot Mode: Normal

 

================== Search Files: "rpcss.dll" =============

 

C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_6bd245e79c221747\rpcss.dll

[2011-07-09 12:47][2015-05-31 16:45] 0376832 ____A (Microsoft Corporation) 7660F01D3B38ACA1747E397D21D790AF [File is signed]

 

C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_69a1321f9f3393ad\rpcss.dll

[2015-05-31 16:45][2015-05-31 16:45] 0376320 ____A (Microsoft Corporation) B82CD39E336973359D7C9BF911E8E84F [File is signed]

 

C:\Windows\System32\rpcss.dll

[2009-07-14 00:45][2009-07-14 02:16] 0376832 ____A (Microsoft Corporation) 7660F01D3B38ACA1747E397D21D790AF [File is signed]

 

C:\SFCFix\Backups\C\windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_6bd245e79c221747\rpcss.dll

[2015-05-31 16:45][2010-11-20 13:21] 0376832 ____A (Microsoft Corporation) 7660F01D3B38ACA1747E397D21D790AF [File is signed]

 

C:\SFCFix\Backups\C\windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_69a1321f9f3393ad\rpcss.dll

[2015-05-31 16:45][2009-07-14 02:16] 0376832 ____A (Microsoft Corporation) 7660F01D3B38ACA1747E397D21D790AF [File is signed]

 

====== End of Search ======

[BrianDrab]

Thank you. Please do the following.

 

Step#1 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Download attached file and save it to the Desktop.  fixlist.txt   161bytes   202 downloads
Note. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
2. Run FRST by Right-Clicking on the file and choosing Run as administrator.
3. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
4. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.

[peter plus]

Fix result of Farbar Recovery Scan Tool (x86) Version: 29-05-2015

Ran by Pauline at 2015-05-31 20:13:32 Run:1

Running from C:\Users\Pauline\Desktop

Loaded Profiles: Pauline (Available Profiles: Pauline)

Boot Mode: Normal

 

==============================================

 

fixlist content:

*****************

replace: C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_6bd245e79c221747\rpcss.dll C:\Windows\System32\rpcss.dll

*****************

 

C:\Windows\System32\rpcss.dll => Moved successfully.

C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_6bd245e79c221747\rpcss.dll copied successfully to C:\Windows\System32\rpcss.dll

 

==== End of Fixlog 20:13:33 ====

[BrianDrab]

And for good measure, please run this one more time.

 

Step#1 - File Identification
1. Run FRST by Right-Clicking on the file and choosing Run as administrator.
2. Type rpcss.dll into the Search box of the FRST window.
3. Click the Search Files button.
4. When the search is done it will open a notepad window with the results. Please copy/paste the contents of this window into your next post.

[peter plus]

Farbar Recovery Scan Tool (x86) Version: 29-05-2015

Ran by Pauline at 2015-05-31 20:18:40

Running from C:\Users\Pauline\Desktop

Boot Mode: Normal

 

================== Search Files: "rpcss.dll" =============

 

C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_6bd245e79c221747\rpcss.dll

[2011-07-09 12:47][2015-05-31 16:45] 0376832 ____A (Microsoft Corporation) 7660F01D3B38ACA1747E397D21D790AF [File is signed]

 

C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_69a1321f9f3393ad\rpcss.dll

[2015-05-31 16:45][2015-05-31 16:45] 0376320 ____A (Microsoft Corporation) B82CD39E336973359D7C9BF911E8E84F [File is signed]

 

C:\Windows\System32\rpcss.dll

[2009-07-14 00:45][2015-05-31 16:45] 0376832 ____A (Microsoft Corporation) 7660F01D3B38ACA1747E397D21D790AF [File is signed]

 

C:\SFCFix\Backups\C\windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_6bd245e79c221747\rpcss.dll

[2015-05-31 16:45][2010-11-20 13:21] 0376832 ____A (Microsoft Corporation) 7660F01D3B38ACA1747E397D21D790AF [File is signed]

 

C:\SFCFix\Backups\C\windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_69a1321f9f3393ad\rpcss.dll

[2015-05-31 16:45][2009-07-14 02:16] 0376832 ____A (Microsoft Corporation) 7660F01D3B38ACA1747E397D21D790AF [File is signed]

 

====== End of Search ======

[BrianDrab]

Let's continue on your Windows Update issue. Please do the following.

 

System Update Readiness Tool (SUR)
1. Download and run the following file.
2. When it asks you if you wish to install, please answer yes. Note: It could take 15 minutes or more to run. Please don't cancel.
3. You will get an Installation Complete screen when it's done running.
4. Please post the contents of the log from the following location. C:\Windows\Logs\CBS\CheckSUR.log

[peter plus]

I did this cancel this after running for 50 mins.

 

=================================

Checking System Update Readiness.

Binary Version 6.1.7601.22471

Package Version 26.0

2015-05-31 20:35

 

Checking Windows Servicing Packages

 

Checking Package Manifests and Catalogs

 

Checking Package Watchlist

 

Checking Component Watchlist

 

Checking Packages

 

Checking Component Store

 

Summary:

Seconds executed: 3156

 No errors detected

[BrianDrab]

Odd that it didn't finish on it's own but thank you. Please do the following.

 

Step#1 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Download attached file and save it to the Desktop.
Note. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
2. Run FRST by Right-Clicking on the file and choosing Run as administrator.
3. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
4. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.

 

Step#2 - SFC Scan

• Click on the Start button and in the search box, type Command Prompt
• When you see Command Prompt on the list, right-click on it and select Run as administrator
• When command prompt opens, copy and paste the following commands into it, press enter after each
  
  sfc /scannow
  
  Wait for this to finish before you continue
  
  copy %windir%\logs\cbs\cbs.log %userprofile%\Desktop\cbs.txt
• This will create a file, cbs.txt on your Desktop. Please attach this to your next post.

Please Note:: if the file is too big to upload to your next post please upload via a service such as Dropbox or One Drive or SendSpace and just provide the link.

 

Step#3 - File Identification
1. Run FRST by Right-Clicking on the file and choosing Run as administrator.
2. Type rpcss.dll into the Search box of the FRST window.
3. Click the Search Files button.
4. When the search is done it will open a notepad window with the results. Please copy/paste the contents of this window into your next post.

 

 

 

Items for your next post

1. Fixlog.txt

2. CBS.txt

3. Search.txt

[BrianDrab]

I just realized something and I have to sincerely apologize. The malware patched your rpcss.dll file. In Step#1 above we are removing it which may likely result in a reboot and then my guess is that you won't be able to get back in to your machine. So if you already performed Step#1 above and are in this situation, please follow the instructions below to resolve. If you didn't do the steps yet please don't. Obviously you'll likely be reading this post on another machine or your phone.

Put back rpcss.dll with a good copy.
1. Reboot your computer and begin tapping F8 on the keyboard as it restarts.
2. This should bring you to the Advanced Boot Options screen and one of the options should be "Repair Your Computer". (If you don't have this option stop and let me know).


3. Hit enter on Repair Your Computer.
4. Select a keyboard layout and enter username/password if prompted.
5. Click on Command Prompt in the System Recovery Options window.
6. Type notepad in the command prompt window and hit enter.
7. Select the File menu and choose Open. Double click on Computer so you see all of your drive letters. You will see drive letter X: as well as others. Identify which one is your Local Disk. It won't be X.
8. Now you can cancel out of this window. You can also close notepad.
9. Now type the following into the command prompt window exactly as shown and hit enter.

copy D:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_6bd245e79c221747\rpcss.dll D:\Windows\System32\rpcss.dll     <------please ensure you change the letter d to the drive letter you identified previously. There is a space before the letter D in both instances above.

10. If done correctly it should say 1 file(s) copied within the command prompt window.
11. Type exit in the command-prompt window and hit enter.
12. Click the Restart button and restart your machine normally.
13. Log in and let me know how this went.

[peter plus]

Cannot reboot the PC. Tapping F8 only gives me Safe Mode options.

[peter plus]

Will not reboot in Safe Mode

[BrianDrab]

No problem. I just need to confirm that you did in fact run into the issue where your machine will no longer boot normally correct?

[peter plus]

That's correct