Just a question about FRST

[jonwade75b]

I'm not sure if this is the right forum so please move this if it's in the wrong place.

If I am using FRST and I get something like: R2 RpcSs; C:\Windows\system32\rpcss.dll (Microsoft Corporation) [File not signed] stating the file is not signed what would I put in the fixlist to have it copy over a valid, signed file in the place of this unsigned one.

Thanks in advance!

[patio]

What is FRST 1st off ? ?

[jonwade75b]

What is FRST 1st off ? ?

This was in the infections forum (where I assumed people would know what it was) and has been moved.
Farbar Recovery Scan Tool = http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

[jonwade75b]

I figured it out in the end.

Use FRST's search function to find the signed file.

Example:
================== Search Files: "rpcss.dll" =============

C:\Windows\WinSxS\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_10.0.10586.0_none_f6507454e837316d\rpcss.dll
[2015-10-30 08:17][2015-10-30 08:17] 0904704 ____A (Microsoft Corporation) B339861C6A2A86FBCA67C2006B461473 [File is digitally signed]

C:\Windows\System32\rpcss.dll
[2015-10-30 08:17][2015-10-30 08:17] 0904704 ____A (Microsoft Corporation) B339861C6A2A86FBCA67C2006B461473 [File not signed]

====== End of Search ======

Then use either copy (cmd) or replace: (FRST fixlist) to copy the signed file over, after making a backup of the not signed file first.

[patio]

Glad you are fixed up..