Posts Tagged ‘broken windows’

Fix to sfc /scannow (System File Checker) error “The specific code is 0x000006ba [The RPC Server is unavailable.] “

Friday, December 14th, 2012

I had to fix one Windows XP computer today. The computer was in a terrible state (meak to say), the system was hanging during boot,

None of Windows recovery modes worked,  except when running it through:

Windows Safe Mode (With Command Prompt) mode (pressing F8 before Windows boot with Windows flag screen).


I followed some Usual commands to repair broken Windows XP, as the system was hanging during boot there was obviously some issues with corrupt by Viruses and Malware system binary (.exe) files or some .DLL was substituted in (C:WindowsSystem32 and C:WindowsSystem32DllCacache) with a trojanned version by some "bad ware". 

Thus the logical thing to do was to try:

sfc /scannow


from Safe Mode's cmd prompt. Instead of starting its work as usual System File Checker spitted an error:
 

Windows File Protection could not be initiate a scan of protected system files.  
The specific code is 0x000006ba [The RPC Server is unavailable.]

You can guess my amazement as I see this error for a first time in my life. Actually I don't remember if I run System File Checker scan from a Safe Mode With only Command Prompt ever so I'm not sure if this error was caused by some Virus activity which broke up the Win host, or it is due to the fact RCP Services are not loaded in Safe Mode – With Command Prompt Only.

As the message implies RCP Server is not running and sfc depends on it.

The reason for the error is Windows File Protection (WFP) was disabled by some of the Spyware or Viruses which infested the poor Win PC.

As the problem consisted in unworking RPC Services I tried launching RPC manually with command:

> net start rpcss  

This unfortunately did not succeeded (dunno why).

I've later seen another fix pointed on a couple of forums around, which is using Registry to enable SFC.

Re-enabling SFC is done by:

1. Launching regedit

2. Once launched go to the following reg settings (sub-values)

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon

Use modify on it and change value to be "0"
3. Restart windows and launch again Safe Mode With (Command Prompt Only)

There execute:

> sfc /purgecache
> sfc /scannow

This solves it however, as you never can be sure if the Install time .DLLs are not already rootkited by the Virus-es and Spywares which "posessed" the computer. It is generally a good idea to Launch the Windows Install CD, recovery console and launch SFC using it, or even try using the Windows CD (Repair) mode. Though this is a temporary work around, this system will need a re-install in very short future, or it will most likely came in the same broken state in a very while – I don't believe such an infested computer can be "cured" except with a clean CD Windows re-install.
If this method didn't work for you but something else worked for you, whether you had to fix a Win PC please drop a comment with the solution.