Tuesday, February 25, 2014

Audio virus (Trojan.Zekos.Patchedww2)

A user experienced a problem where their laptop would play audio ads when started.

OS: Windows Vista

After trying all the usual tools the audio ads continued to play.  Running Malwarebytes Anti-Rootkit BETA v1.07.0.1009 found a virus (Trojan.Zekos.Patchedwv2) in C:\Windows\System32\rpcss.dll.

Other symptoms:
  • DCOM Launcher and PlugPlay services have high CPU utilization
  • Vista restarts with message "Windows must now restart because the DCOM Server Process Launcher service terminated unexpectedly".  This message does not allow you to prevent the machine from rebooting, the only option is "Close"
Other steps tried (unsucessfully):
  • Malwarebytes (regular version)
  • Every pertinent tool on Hiren Rescue CD
  • Panda Antivirus scan
  • Kapersky TDSSKiller
  • RKill