Solve : Just a question about FRST?

1.	Solve : Just a question about FRST?
Answer» I'm not sure if this is the right forum so please move this if it's in the wrong place. If I am using FRST and I get something LIKE: R2 RpcSs; C:\Windows\system32\rpcss.dll (Microsoft CORPORATION) [FILE not SIGNED] stating the file is not signed what would I put in the fixlist to have it copy over a valid, signed file in the place of this unsigned one. Thanks in advance!What is FRST 1st off ? ? QUOTE from: patio on May 01, 2016, 11:05:52 AM What is FRST 1st off ? ? This was in the infections forum (where I assumed people would know what it was) and has been moved. Farbar Recovery Scan Tool = http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/I figured it out in the end. Use FRST's search function to find the signed file. Example: ================== Search Files: "rpcss.dll" ============= C:\Windows\WinSxS\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_10.0.10586.0_none_f6507454e837316d\rpcss.dll [2015-10-30 08:17][2015-10-30 08:17] 0904704 ____A (Microsoft Corporation) B339861C6A2A86FBCA67C2006B461473 [File is digitally signed] C:\Windows\System32\rpcss.dll [2015-10-30 08:17][2015-10-30 08:17] 0904704 ____A (Microsoft Corporation) B339861C6A2A86FBCA67C2006B461473 [File not signed] ====== End of Search ====== Then use either copy (cmd) or replace: (FRST fixlist) to copy the signed file over, after making a backup of the not signed file first.Glad you are fixed up..

Answer»

I'm not sure if this is the right forum so please move this if it's in the wrong place.

If I am using FRST and I get something LIKE: R2 RpcSs; C:\Windows\system32\rpcss.dll (Microsoft CORPORATION) [FILE not SIGNED] stating the file is not signed what would I put in the fixlist to have it copy over a valid, signed file in the place of this unsigned one.

Thanks in advance!What is FRST 1st off ? ? QUOTE from: patio on May 01, 2016, 11:05:52 AM

What is FRST 1st off ? ?

This was in the infections forum (where I assumed people would know what it was) and has been moved.
Farbar Recovery Scan Tool = http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/I figured it out in the end.

Use FRST's search function to find the signed file.

Example:
================== Search Files: "rpcss.dll" =============

C:\Windows\WinSxS\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_10.0.10586.0_none_f6507454e837316d\rpcss.dll
[2015-10-30 08:17][2015-10-30 08:17] 0904704 ____A (Microsoft Corporation) B339861C6A2A86FBCA67C2006B461473 [File is digitally signed]

C:\Windows\System32\rpcss.dll
[2015-10-30 08:17][2015-10-30 08:17] 0904704 ____A (Microsoft Corporation) B339861C6A2A86FBCA67C2006B461473 [File not signed]

====== End of Search ======

Then use either copy (cmd) or replace: (FRST fixlist) to copy the signed file over, after making a backup of the not signed file first.Glad you are fixed up..

Solve : Just a question about FRST?

Discussion

No Comment Found

Related InterviewSolutions

Reply to Comment