FAQ
TL;DR: One scheduled task caused the startup error; "rundll32.exe winscomrssrv.dll,SrvMainHost" exposed persistence. Use FRST with the correct Fixlist.txt to remove that task and clean leftovers. [Elektroda, Kolobos, post #17808804]
Why it matters: This FAQ helps Windows users whose antivirus removed malware but still see winscomrssrv.dll popups at boot, and shows the safe fix.
Quick Facts
- Persistence location: Task Scheduler path Microsoft\Windows\WDI\SrvHost executes rundll32.exe winscomrssrv.dll,SrvMainHost at startup. [Elektroda, Kolobos, post #17808804]
- Remediation method: Run FRST with a proper Fixlist.txt placed next to FRST.exe, then click Repair/Fix. [Elektroda, Anonymous, post #17806132]
- Risk note: A wrong fixlist can remove AIM SC808 drivers, Microsoft mouse/keyboard software, codecs, or an activation loader. [Elektroda, dt1, post #17806187]
- Outcome: After applying the correct Fixlist.txt, the user reported, "It's ok now." [Elektroda, Zajonc753, post #17810207]
- Cleanup: Delete the C:\FRST folder after finishing to remove tools and logs. [Elektroda, RADU23, post #17811636]
What triggers the winscomrssrv.dll error at startup?
A scheduled task named Microsoft\Windows\WDI\SrvHost calls rundll32 to load winscomrssrv.dll at boot. When the DLL is missing, Windows shows an error. In this case, one task entry invoked that DLL. [Elektroda, Kolobos, post #17808804]
Did my antivirus actually remove winscomrssrv.dll?
Yes. A helper confirmed the antivirus identified winscomrssrv.dll as malicious, then removed or moved it. [Elektroda, adamegah, post #17806100]
How do I apply an FRST fixlist safely?
Use FRST only with a trusted Fixlist.txt.
- Download FRST and the specific Fixlist.txt.
- Place Fixlist.txt in the same folder as FRST.exe.
- Run FRST and click Repair (Fix).
This applies the cleanup precisely. [Elektroda, Anonymous, post #17806132]
What exactly did the correct Fixlist.txt change?
It targeted broken shell extensions and the malicious startup task. The list included CustomCLSID entries and a context menu handler cleanup. It also removed the Microsoft\Windows\WDI\SrvHost task calling "rundll32.exe winscomrssrv.dll,SrvMainHost." [Elektroda, Kolobos, post #17808804]
Is it safe to run any fixlist someone posts?
No. As one expert warned, "I would not be doing this fixlist above!" It could remove audio drivers, input software, codecs, or an activator. Always request a tailored fixlist for your logs. [Elektroda, dt1, post #17806187]
I already ran a bad fixlist—what now?
Rescan the system and provide fresh diagnostic logs. The helper recommended re-scanning and uploading new logs after running an incorrect fixlist. [Elektroda, dt1, post #17808638]
Should I run Malwarebytes and empty quarantine?
Yes. Download Malwarebytes, run a full scan, and remove detected items. Then open Quarantine and delete everything kept there. [Elektroda, Anonymous, post #17806132]
AdwCleaner didn’t fix it—what should I do next?
Use a targeted FRST cleanup. The correct Fixlist.txt removed the startup task that invoked winscomrssrv.dll, resolving the boot error. [Elektroda, Kolobos, post #17808804]
How do I confirm the issue is resolved?
Reboot and watch for the popup. Success means no winscomrssrv.dll message at startup. The original poster confirmed, "It's ok now" after applying the fix. [Elektroda, Zajonc753, post #17810207]
What risks come with incorrect fixlists?
A wrong fixlist can remove legitimate components. Examples include AIM SC808 audio software, Microsoft mouse/keyboard tools, codecs, and an activation loader. That can break audio or licensing. [Elektroda, dt1, post #17806187]
Should I delete the FRST folder after finishing?
Yes. Remove the C:\FRST folder when cleanup is complete. This discards the tool and its logs safely. [Elektroda, RADU23, post #17811636]
Should I also uninstall unnecessary programs?
Yes. The helper advised uninstalling unnecessary software during remediation. This complements malware removal and reduces clutter. [Elektroda, Anonymous, post #17806132]
