SFC wont check files rpc server running

[bob urz]

i had a recent bout with the windows 2011 antivirus antispyware drive by
download. It read on the scanners Changed SFC virus.
i finally got rid of it and the pop ups have stopped. but SFC wont run
right. If i launch a command window and just type sfc, it runs and gives
you the menu choices. If i run SFC /scannow, it comes up with error
0x00006ba, and says the RPC server is unavailable. i went into computer
management and both RPC server lines were set to automatic and were
running. SO, what do i check from here? Is there anyway to do a SFC
from a remote machine or put the hardrive in a know good machine to scan
it? Machine seems to be working and is on the internet now.
how can i trouble shoot the RPC server further if its suppose to be running?

bob

 

[philo]

i had a recent bout with the windows 2011 antivirus antispyware drive by
download. It read on the scanners Changed SFC virus.
i finally got rid of it and the pop ups have stopped. but SFC wont run
right. If i launch a command window and just type sfc, it runs and gives
you the menu choices. If i run SFC /scannow, it comes up with error
0x00006ba, and says the RPC server is unavailable. i went into computer
management and both RPC server lines were set to automatic and were
running. SO, what do i check from here? Is there anyway to do a SFC
from a remote machine or put the hardrive in a know good machine to scan
it? Machine seems to be working and is on the internet now.
how can i trouble shoot the RPC server further if its suppose to be
running?

bob

Unless you have kept your SFC repository updated...
do not even think of running SFC
it will do more harm than good

 

[Paul]

i had a recent bout with the windows 2011 antivirus antispyware drive by
download. It read on the scanners Changed SFC virus.
i finally got rid of it and the pop ups have stopped. but SFC wont run
right. If i launch a command window and just type sfc, it runs and gives
you the menu choices. If i run SFC /scannow, it comes up with error
0x00006ba, and says the RPC server is unavailable. i went into computer
management and both RPC server lines were set to automatic and were
running. SO, what do i check from here? Is there anyway to do a SFC
from a remote machine or put the hardrive in a know good machine to scan
it? Machine seems to be working and is on the internet now.
how can i trouble shoot the RPC server further if its suppose to be
running?

bob

There is an explanation here. It could be a registry setting.
The registry was probably adjusted by the malware, to make
the infection work.

http://www.winhelponline.com/blog/fix-sfc-error-0x000006ba-rpc-unavailable

If your system files are coming off an installer CD, the recommendation here,
is to use an installer CD slipstreamed to the same Service Pack level as
your current OS install. If you installed WinXP SP1, added SP3 later, then your
SFC should be done with a slipstreamed WinXP SP3 disc.

http://www.pcug.org.au/boesen/SFC/SFC.htm

Paul

 

[philo]

There is an explanation here. It could be a registry setting.
The registry was probably adjusted by the malware, to make
the infection work.

http://www.winhelponline.com/blog/fix-sfc-error-0x000006ba-rpc-unavailable

If your system files are coming off an installer CD, the recommendation
here,
is to use an installer CD slipstreamed to the same Service Pack level as
your current OS install. If you installed WinXP SP1, added SP3 later,
then your
SFC should be done with a slipstreamed WinXP SP3 disc.

http://www.pcug.org.au/boesen/SFC/SFC.htm

Paul

That still will lead to major problems since there have been over 100
updates since SP3

SFC is just a plain bad idea as very few people ever keep their SFC
repository properly updated

 

[Paul]

That still will lead to major problems since there have been over 100
updates since SP3

SFC is just a plain bad idea as very few people ever keep their SFC
repository properly updated

It probably wasn't designed with malware repair in mind.

The description here, seems to be saying that "signing" is how corrupt
files are detected. So the 100 updates since SP3, they'll all be on the
C: drive, signed, and the signature can be compared against the
file on disk. The problem would be, if all copies of some Windows Update
file have been corrupted, where will SFC look ? It makes sense, for
install CD files, or Service Pack files, a slipstreamed CD gives the
best match there, but you're right, that things like Security Updates
are only stored on the disk.

http://support.microsoft.com/kb/222193/EN-US

Is SFC smart enough to go to Windows Update for its needs ?

http://msdn.microsoft.com/en-us/library/aa382540.aspx

"* Windows Service Pack installation using Update.exe
* Hotfixes installed using Hotfix.exe
* Operating system upgrades using Winnt32.exe
* Windows Update"

That suggests all those file updating mechanisms, support
signing so that a scan can detect a problem. But so far,
I can't find a description of how it goes about repairing
a Windows Update corruption, where nothing on C: is correct
for a particular Windows Update.

*******

Restoring from an (offline) backup would fix it, or "level and reload"
would fix it. At the risk of stating the obvious

Paul