Jump to content

Trouble with Trojan.Zekos.Patched

Recommended Posts

I have been trying to rid a friends computer of Trojan.Zekos.Patched and I'm having trouble fully removing it. I would greatly appreciate any and all assistance in neutralizing this threat! There are and never were any audio ads that we know of, but Malwarebytes keeps displaying a blocked threat even after I ran MBAR which said it was removed and replaced. Attached are logs from FRST. Thank you for your time!



Link to post
Share on other sites

This is the problem: rpcss.dll is patched

[2014-06-11 23:01] - [2010-11-20 09:27] - 0512512 ____N (Microsoft Corporation) D7869A8E778FB52845D8CBE167D025A9

ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.



Run FRST again and.............

Type the following in the edit box after "Search:".


It then should look like:

Search: rpcss.dll

Click Search button and post the log (Search.txt) it makes to your reply.


Link to post
Share on other sites

There's already copies on your computer to use, don't download any.
I used the one in the ERUNT folder
So I would copy that one over to the system32 folder and see what happens:

[2013-10-31 18:28][2010-11-20 09:27] 0512000 ____A (Microsoft Corporation) 5C627D1B1138676C0A7AB2C2C190D123 [File is signed]

[2009-07-13 20:00][2009-07-13 21:41] 0509440 ____A (Microsoft Corporation) 7266972E86890E2B30C0C322E906B027 [File is signed]

[2013-10-22 14:40][2009-07-13 21:41] 0509440 ____A (Microsoft Corporation) 7266972E86890E2B30C0C322E906B027 [File is signed]

C:\Users\Doom Satan\Downloads\rpcss.dll
[2014-06-11 23:00][2014-06-11 23:00] 0395776 ____A (Microsoft Corporation) 5C83A4408604F737717AB96371201680

Link to post
Share on other sites

I have replaced the missing rpcss.dll file with the one from the erdnt folder and it has booted normally again! No messages from MBAM saying that it has blocked anything. I will run a scan with MBAM and MBAR to be on the safe side...but it's looking good so far! Thank you so much for your time and assistance!

Link to post
Share on other sites

Sorry about that but according to the fix log it was replaced.
I'm not sure what happened but glad you got it fixed.

C:\Windows\System32\rpcss.dll => Moved successfully.
C:\Windows\erdnt\cache64\rpcss.dll copied successfully to C:\Windows\System32\rpcss.dll



Take a look at My Preventive Maintenance to avoid being infected again. (My Preventive Maintenance  also found HERE)
Good Luck and Thanks for using the forum, MrC
Link to post
Share on other sites

  • 2 weeks later...
  • Root Admin

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.