Today I ran into more complicated malware that is putting up a fight. It all started with the customer complaining about their internet explorer crashing up, and freezing up when opening. As usually i went in and removed unwanted add-ons and removed the unwanted search engines. After that I went in and started a scan with Malwarebytes and hitman pro. Some malware was found and removed by the programs. Then I went in and restarted the computer. I managed to get IE working for a 3 days.
After that I got the PC back again, the user complaining about the same issue. I went in and checked the Event manager, no luck. Then based on other issues with outlook freezing up and crashing, because of bad drive sectors, I went and did a check disk, nothing no luck. I then went took the computer home and started a defragmentation. After running for about 3 hours, i noticed that it got stuck on a single file. I then went and made a search for that file. Noticed that it was on the Temp folder, I went and deleted it. Immediately after I deleted the file, the AVG Virus warning came up. It said that it had found a Trojan running in the background. I then went and tried to delete it, no luck. Went I did a Hitman Pro scan, it found the file rpcss.dll infected with a Trojan. Unfortunately Hitman pro was unable to remove it, since it was a Windows system file. It was able to replace it, after 2 more scans, it stooped showing up as infected.
This infected file was the one causing all the issues, after removing that file, Internet Explorer worked ok not perfect, but ok. The only reason I was able to find this file was because of the defragmentation process that was being held by another file.
Obtain a clean copy of rpcss.dll file here.
I was going through my stats, and noticed that there have been several searches for this file as a replacement. Since people want a replacement files, I want to go ahead and give you guys a replacement file.
- Boot to safemode and go to the c:\windows\system32\ folder.
- rename the rpcss.dll file to rpcss.dll.old and bring the new file in, simply drag and drop.
- Here is the rpcss.dll file inside a zip folder,
- Save the zip folder on the desktop, and unzip, then drag and drop on system32 folder.
Windows XP file: rpcss
Due to the fact that I get a lot of users searching for a rpcss.dll file for Windows 7, I have taken the time to copy a rpcss.dll file from a new Win 7 install. I have this Windows 7 rpcss.dll in a zip folder here:
Windows 7 file: rpcss-Win7x64