Boot disk/cd

Starman Ghost · Post by **Starman Ghost** » Mon Dec 04, 2006 10:02 pm

Cna nyone recommend a boot disk/cd I can download that can allow access to ntsf drives so I can delete a file?

funkyass · Post by **funkyass** » Mon Dec 04, 2006 10:54 pm

bart PE discs will do.

which file are you trying to delete?

Starman Ghost · Post by **Starman Ghost** » Tue Dec 05, 2006 4:43 am

I'm trying to delete rpcc.dll. It's associated with Trojan RPCC Payload. It seems to always be loaded, even in safe mode and before explorer has been loaded. I don't know how I got this shit nothing I'm using can seem to get rid of it. Bart PE can be downloaded for free?

Deathlike2 · Post by **Deathlike2** » Tue Dec 05, 2006 4:54 am

Starman Ghost wrote:I'm trying to delete rpcc.dll. It's associated with Trojan RPCC Payload. It seems to always be loaded, even in safe mode and before explorer has been loaded. I don't know how I got this shit nothing I'm using can seem to get rid of it. Bart PE can be downloaded for free?

You should be able to disable the service (unless MMC is already compromised) associated with the trojan.

funkyass · Post by **funkyass** » Tue Dec 05, 2006 5:09 am

BartPE is free.

you do need a XP cd however, as you need to make it yourself.

there should other recovery CD's based off of bartPE.

AntoineWG · Post by **AntoineWG** » Tue Dec 05, 2006 9:42 am

Try Spybot or HijackThis!. Spybot can run at startup before drivers and services load. HijackThis! can delete files for you at boot time. Or you could just use the recovery console that comes with Windows, but you need an installation CD.

Starman Ghost · Post by **Starman Ghost** » Wed Dec 06, 2006 7:04 pm

AntoineWG wrote:Try Spybot or HijackThis!. Spybot can run at startup before drivers and services load. HijackThis! can delete files for you at boot time. Or you could just use the recovery console that comes with Windows, but you need an installation CD.

Spybot can't get it, even before everything loads, even in safe mode before everything loads too. I haven't tried HijackThis! before, maybe give it a whirl.

Starman Ghost · Post by **Starman Ghost** » Fri Dec 08, 2006 5:54 pm

I'm also curious if anyone knows what tmp_h.dll is. My searches for it have come up with nothing. It's located in system32 and is run from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows. Anyone got an idea?

AntoineWG · Post by **AntoineWG** » Fri Dec 08, 2006 6:59 pm

Uncheck it in msconfig and see what happens.