Help with infected RPCSS.EXE file

[Lisa Moats]

My virus software found that the rpcss.exe file in the windows\system32
folder was infected with a trojan (TROJ_AGENT.AM). It quarantined the file.
I tried to clean it, but that didn't work.

Based on what I've read, deleting the file is certainly not advisable.
Where can I get a clean version of this file? Can I download it from
microsoft, or can I reinstall just it from the Windows XP installation disc?
Can I just get a copy from someone running the same OS and replace the
infected one?

Thanks for any help.

 

[Frank Saunders, MS-MVP]

My virus software found that the rpcss.exe file in the
windows\system32 folder was infected with a trojan (TROJ_AGENT.AM).
It quarantined the file. I tried to clean it, but that didn't work.

Based on what I've read, deleting the file is certainly not advisable.
Where can I get a clean version of this file? Can I download it from
microsoft, or can I reinstall just it from the Windows XP
installation disc? Can I just get a copy from someone running the
same OS and replace the infected one?

Thanks for any help.

Use msconfig to expand it from your winXP CD.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx

 

[Lisa Moats]

I'm sorry to be ignorant, but a little more detail would be helpful. I've
opened msconfig and I see the Expand File option, but I don't know which
..cab file to select to restore from. Can you help some more? Thanks.

Also - it will want me to reboot, apparently, before anything actually
happens. But I'm afraid to reboot without the rpcss.exe being in the proper
place. Should I put the infected file back before I reboot, just to be sure
I get a clean reboot?

 

[Frank Saunders, MS-MVP IE/OE]

Do you have a WindowsXP CD?
If so, go to Start | Run and type
msconfig
and then press <Enter>. On the right there is a button to "Expand File".
Click that. Put in the Windows XP CD and hold down the shift key for 20
seconds. Then enter
rpcss.exe
in the top box. Click Browse beside the Restore from box and browse to the
i386 folder on your CD. For the Save file in box type
C:\Windows\System32
Then click the Expand button.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx

 

[Kelly]

http://www.google.com/search?hl=en&q=rpcss.exe+&btnG=Google+Search

--
All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com