Recently, one of my Windows XP PC was unable to join a domain controller running on Windows Server 2003 after a reboot. I received an error message saying that the “RPC
server is unavailable” after entering my username and password.

Troubleshoot that I have done:
1. My PC can ping the dc controller.
2. DNS Server is assigned correctly.
3. Netbios name is assigned correctly.
4. RPCSS service is started properly.
5. Port 135 is not blocked by firewall.

I figured out the cause of the “RPC server is unavailable” is due to spyware/rootkit has modified my system files. There is a rootkit driver called “ati2yexx.sys”. It is loaded automatically as a windows driver when my computer is started. Another serious problem is my winlogon.exe is replaced with a fake winlogon.exe which contain virus. There is no way you can remove the virus with anti-virus software. You need to manually remove them in Windows SAFE MODE.

Trojan/Win32.AutoRV.lvo
C:\WINDOWS\winlogon.exe

Trojan/Win32.IEprot.sbr
C:\WINDOWS\yuiabct.exe

Trojan/Win32.IEprot.sbr
C:\TEMP\tmp6.tmp

Solution:
1. Get into SAFE MODE and run “regedit” then search for “ati2yexx.sys”
2. Remove everything that contain “ati2yexx”
3. Remove the file c:\windows\system32\drivers\ati2yexx.dll
4. Insert your winxp cd-rom installer, go to i386 directory.
5. Expand winlogon.ex_ c:\windows\ (replace this unless your PC are infected with Win32.AutoRV.lvo)
(warning: make sure the winlogon.exe is the correct version of your windows, do not replace the old winlogon.exe if you have updated your windows service pack)

If you need any assistance, leave your comments below here.
Hope this post helps you a lot.

Good luck

Popularity: 12%