What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Need help against wmpqd.exe, a new generation malware

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi to all… I need a really helpful solution to delete this malware
My OS is Windows XP SP 2 & I use Avast AV, Spybot destroyer and Spyware Terminator to guard my PC but alas they are totally failed to protect my PC

This malware is being know as wmispqd.exe & had been known to be created per Nov 30, 2009
The malware also know as able to bypassing AVG, Avast, and Smartdav too

The symptoms in my PC are :
- Slowing my PC
- Avast detected Win32:Malware-gen with name like husbkorf.sys & trfxcmys.sys when I scanned the PC in safe mode
- Limited ALL the process & working in PC
Exp : You can only open 1 application at max, opening a Firefox and a notepad will guarantee an instant hang
- Creating other process to disable other process
- Disabling ALL ANTI VIRUS & GUARDIAN SOFTWARE (Avast is not working with warning like \\\"AAVPM detected a RPC error\\\" while Spybot Destroyer & Spyware Terminator will not respond to work when I double clicked them both from shortcuts & the file directly)
- Disabling IceSword, HijackThis, Prevx & Combofix to work BOTH in normal mode & safe mode (even Combofix copied in desktop is not working at all) so I can\\\'t even generated ANY LOG since the tools to create the log had failed to working properly

According to my goggling, also the malware known symptoms are :
# Ability to execute files automatically on your PC
# Automatically changes your firewall settings to allow itself or other programs to communicate over the internet
# Adds a Registry Key (RUN) to auto start Programs on system start up
# Writes to another Process\\\'s Virtual Memory (Process Hijacking)
# Executes a Process
# This Process Deletes Other Processes From Disk
# Injects code into other processes
# Registers a Dynamic Link Library File
# Copies files
# This process creates other processes on disk
# Creates new folders on the system
# Modifies firewall settings, without user permission so it is not blocked from accessing the Internet
# Uses Instant Messaging to communicate without the user\\\'s knowledge
# Uses embedded Instant Message Channel Settings
# The Process is packed and/or encrypted using a software packing process

WMISPQD.EXE has been the subject of the following behavior:

* Created as a process on disk
* Executed as a Process
* Has code inserted into its Virtual Memory space by other programs
* Registered as a Dynamic Link Library File
* Deleted as a process from disk
* Copied to multiple locations on the system
* Added as a Registry auto start to load Program on Boot up


I have try to search the file & till this time, I had found ONE of the file named \\\"wmispqd.exe\\\" is residing in register in HKLM\\\\microsoft\\\\windows\\\\windowsNT\\\\ImageFileExtension\\\\ctfmon.exe debugger wmispqd.exe
The file is known as debugger in register editor & when I try to modify & delete, the deleted file will appear again when I refresh the page

I also found the malware to reside in C:\\\\Windows\\\\system32\\\\wmispqd.exe sized 233Kb (its a hidden file & when I check the folder option to show the hidden file, its showed itself but unfortunately, I can\\\'t delete that wmispqd.exe file since windows detected there is other process still using that file & in just a matter of seconds, the file will vanish & hidden itself again
When I try to search \\\"wmispqd.exe\\\" by using searching in win explorer, its been found to reside in system restore with filename like wmispqd.exe.pf despite I had DISABLE THE SYSTEM RESTORE even before Nov 18, 2009 !

I am very distressful to know that there are just too few news about this new malware in internet & I failed to find any reliable working solution against this \\\"wmispqd.exe\\\" malware
Since I am a newbie user too, I don\\\'t know anything about cleaning this malware

I appreciate any viable & logical help
Thank you

PS : sorry for my very bad English

Next question :

Since I am a newbie, I want to ask that do I need to scan it in SAFE MODE or in WINDOWS MODE ?
Also there are new symptom like my svchost.exe & ati2evxx.exe are increasing

There are total 6 svchost.exe in my process which :
1. 3 with user name for SYSTEM
2. 2 with user name for NETWORK SYSTEM
3. 1 with user name for LOCAL SYSTEM

Also there are 2 ati2evxx.exe for user name SYSTEM too

Somehow with miracle, I able to generate a HijackThis Log file too for NOW…
I try to post the log too


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:21:19, on 05/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\\\\WINDOWS\\\\System32\\\\smss.exe
C:\\\\WINDOWS\\\\system32\\\\winlogon.exe
C:\\\\WINDOWS\\\\system32\\\\services.exe
C:\\\\WINDOWS\\\\system32\\\\lsass.exe
C:\\\\WINDOWS\\\\system32\\\\Ati2evxx.exe
C:\\\\WINDOWS\\\\system32\\\\svchost.exe
C:\\\\WINDOWS\\\\System32\\\\svchost.exe
C:\\\\WINDOWS\\\\system32\\\\Ati2evxx.exe
C:\\\\Program Files\\\\Alwil Software\\\\Avast4\\\\aswUpdSv.exe
C:\\\\Program Files\\\\Alwil Software\\\\Avast4\\\\ashServ.exe
C:\\\\WINDOWS\\\\system32\\\\spoolsv.exe
C:\\\\WINDOWS\\\\system32\\\\CTsvcCDA.exe
C:\\\\WINDOWS\\\\system32\\\\crypserv.exe
C:\\\\Program Files\\\\Common Files\\\\Microsoft Shared\\\\VS7DEBUG\\\\MDM.EXE
C:\\\\Program Files\\\\Spyware Terminator\\\\sp_rsser.exe
C:\\\\WINDOWS\\\\system32\\\\UAService7.exe
C:\\\\WINDOWS\\\\system32\\\\MsPMSPSv.exe
C:\\\\WINDOWS\\\\system32\\\\svchost.exe
C:\\\\Program Files\\\\Alwil Software\\\\Avast4\\\\ashMaiSv.exe
C:\\\\Program Files\\\\Alwil Software\\\\Avast4\\\\ashWebSv.exe
C:\\\\WINDOWS\\\\Explorer.EXE
C:\\\\Program Files\\\\ATI Technologies\\\\ATI Control Panel\\\\atiptaxx.exe
C:\\\\Program Files\\\\ASUSTek\\\\ASUSDVD\\\\PDVDServ.exe
C:\\\\PROGRA~1\\\\ALWILS~1\\\\Avast4\\\\ashDisp.exe
C:\\\\Program Files\\\\Creative\\\\SBAudigy\\\\TaskBar\\\\CTLTask.exe
C:\\\\Program Files\\\\Spybot - Search & Destroy\\\\TeaTimer.exe
C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe
C:\\\\WINDOWS\\\\system32\\\\NOTEPAD.EXE
C:\\\\Program Files\\\\Trend Micro\\\\HijackThis\\\\HijackThis.exe

R0 - HKCU\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Main,Start Page = http://www.mail.yahoo.com/
R1 - HKCU\\\\Software\\\\Microsoft\\\\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R1 - HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet Settings,ProxyServer = 192.168.2.100:8080
F2 - REG:system.ini: UserInit=C:\\\\WINDOWS\\\\system32\\\\userinit.exe,C:\\\\Documents and Settings\\\\NetworkService\\\\ehrtq.exe \\\\s
O2 - BHO: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\\\\Program Files\\\\Orbitdownloader\\\\orbitcth.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\\\\Program Files\\\\Java\\\\jre1.5.0_06\\\\bin\\\\ssv.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\\\\PROGRA~1\\\\FlashGet\\\\fgiebar.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\\\\Program Files\\\\Orbitdownloader\\\\GrabPro.dll
O4 - HKLM\\\\..\\\\Run: [ATIPTA] C:\\\\Program Files\\\\ATI Technologies\\\\ATI Control Panel\\\\atiptaxx.exe
O4 - HKLM\\\\..\\\\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\\\\..\\\\Run: [UpdReg] C:\\\\WINDOWS\\\\UpdReg.EXE
O4 - HKLM\\\\..\\\\Run: [Jet Detection] C:\\\\Program Files\\\\Creative\\\\SBAudigy\\\\PROGRAM\\\\ADGJDet.exe
O4 - HKLM\\\\..\\\\Run: [CTStartup] C:\\\\Program Files\\\\Creative\\\\Splash Screen\\\\CTEaxSpl.EXE /run
O4 - HKLM\\\\..\\\\Run: [zBrowser Launcher] C:\\\\Program Files\\\\Logitech\\\\iTouch\\\\iTouch.exe
O4 - HKLM\\\\..\\\\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\\\\..\\\\Run: [WinampAgent] \\\"C:\\\\Program Files\\\\Winamp\\\\Winampa.exe\\\"
O4 - HKLM\\\\..\\\\Run: [ISUSPM Startup] C:\\\\PROGRA~1\\\\COMMON~1\\\\INSTAL~1\\\\UPDATE~1\\\\isuspm.exe -startup
O4 - HKLM\\\\..\\\\Run: [ISUSScheduler] \\\"C:\\\\Program Files\\\\Common Files\\\\InstallShield\\\\UpdateService\\\\issch.exe\\\" -start
O4 - HKLM\\\\..\\\\Run: [DAEMON Tools-1033] \\\"C:\\\\Program Files\\\\D-Tools\\\\daemon.exe\\\" -lang 1033
O4 - HKLM\\\\..\\\\Run: [DAEMON Tools] \\\"C:\\\\Program Files\\\\DAEMON Tools\\\\daemon.exe\\\" -lang 1033
O4 - HKLM\\\\..\\\\Run: [RemoteControl] \\\"C:\\\\Program Files\\\\ASUSTek\\\\ASUSDVD\\\\PDVDServ.exe\\\"
O4 - HKLM\\\\..\\\\Run: [TkBellExe] C:\\\\Program Files\\\\K-Lite Codec Pack\\\\Real\\\\Update_OB\\\\evntsvc.exe -osboot
O4 - HKLM\\\\..\\\\Run: [SunJavaUpdateSched] C:\\\\Program Files\\\\Java\\\\jre1.5.0_06\\\\bin\\\\jusched.exe
O4 - HKLM\\\\..\\\\Run: [NeroFilterCheck] C:\\\\WINDOWS\\\\system32\\\\NeroCheck.exe
O4 - HKLM\\\\..\\\\Run: [avast!] C:\\\\PROGRA~1\\\\ALWILS~1\\\\Avast4\\\\ashDisp.exe
O4 - HKLM\\\\..\\\\Run: [MSConfig] C:\\\\WINDOWS\\\\pchealth\\\\helpctr\\\\Binaries\\\\MSCONFIG.EXE /auto
O4 - HKLM\\\\..\\\\RunOnce: [SpybotDeletingA9362] command /c del \\\"C:\\\\WINDOWS\\\\SchedLgU.Txt\\\"
O4 - HKCU\\\\..\\\\Run: [TaskTray] \\\"C:\\\\Program Files\\\\Creative\\\\SBAudigy\\\\TaskBar\\\\CTLTray.exe\\\"
O4 - HKCU\\\\..\\\\Run: [TaskBar] \\\"C:\\\\Program Files\\\\Creative\\\\SBAudigy\\\\TaskBar\\\\CTLTask.exe\\\"
O4 - HKCU\\\\..\\\\Run: [MSMSGS] \\\"C:\\\\Program Files\\\\Messenger\\\\msmsgs.exe\\\" /background
O4 - HKCU\\\\..\\\\Run: [SpybotSD TeaTimer] C:\\\\Program Files\\\\Spybot - Search & Destroy\\\\TeaTimer.exe
O4 - HKCU\\\\..\\\\Run: [CTFMON.EXE] C:\\\\WINDOWS\\\\system32\\\\ctfmon.exe
O4 - HKCU\\\\..\\\\Run: [Yahoo! Pager] \\\"C:\\\\Program Files\\\\Yahoo!\\\\Messenger\\\\ypager.exe\\\" -quiet
O4 - HKUS\\\\S-1-5-19\\\\..\\\\Run: [CTFMON.EXE] C:\\\\WINDOWS\\\\system32\\\\CTFMON.EXE (User \\\'LOCAL SERVICE\\\')
O4 - HKUS\\\\S-1-5-20\\\\..\\\\Run: [CTFMON.EXE] C:\\\\WINDOWS\\\\system32\\\\CTFMON.EXE (User \\\'NETWORK SERVICE\\\')
O4 - HKUS\\\\S-1-5-18\\\\..\\\\Run: [CTFMON.EXE] C:\\\\WINDOWS\\\\system32\\\\CTFMON.EXE (User \\\'SYSTEM\\\')
O4 - HKUS\\\\.DEFAULT\\\\..\\\\Run: [CTFMON.EXE] C:\\\\WINDOWS\\\\system32\\\\CTFMON.EXE (User \\\'Default user\\\')
O4 - Startup: Registration Heroes of Might & Magic 5.LNK = I:\\\\Games\\\\Ubisoft\\\\Heroes of Might and Magic V\\\\registration\\\\RegistrationReminder.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\\\\Program Files\\\\Adobe\\\\Acrobat 7.0\\\\Reader\\\\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\\\\Program Files\\\\Microsoft Office\\\\Office10\\\\OSA.EXE
O4 - Global Startup: Orbit.lnk = C:\\\\Program Files\\\\Orbitdownloader\\\\orbitdm.exe
O4 - Global Startup: Vypress Chat StartUp.lnk = C:\\\\Program Files\\\\Vypress Chat\\\\VyChat.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\\\\Program Files\\\\Orbitdownloader\\\\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\\\\Program Files\\\\Orbitdownloader\\\\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\\\\Program Files\\\\Orbitdownloader\\\\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\\\\Program Files\\\\Orbitdownloader\\\\orbitmxt.dll/202
O8 - Extra context menu item: Download All by FlashGet - C:\\\\Program Files\\\\FlashGet\\\\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\\\\Program Files\\\\FlashGet\\\\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\\\\PROGRA~1\\\\MICROS~2\\\\OFFICE11\\\\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\\\Program Files\\\\Java\\\\jre1.5.0_06\\\\bin\\\\ssv.dll
O9 - Extra \\\'Tools\\\' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\\\Program Files\\\\Java\\\\jre1.5.0_06\\\\bin\\\\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\\\\PROGRA~1\\\\MICROS~2\\\\OFFICE11\\\\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\\\\PROGRA~1\\\\FlashGet\\\\flashget.exe
O9 - Extra \\\'Tools\\\' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\\\\PROGRA~1\\\\FlashGet\\\\flashget.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\\\\WINDOWS\\\\system32\\\\shdocvw.dll
O9 - Extra \\\'Tools\\\' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\\\\WINDOWS\\\\system32\\\\shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\\\\PROGRA~1\\\\Yahoo!\\\\MESSEN~1\\\\YPager.exe
O9 - Extra \\\'Tools\\\' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\\\\PROGRA~1\\\\Yahoo!\\\\MESSEN~1\\\\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\\\Program Files\\\\Messenger\\\\msmsgs.exe
O9 - Extra \\\'Tools\\\' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\\\Program Files\\\\Messenger\\\\msmsgs.exe
O17 - HKLM\\\\System\\\\CCS\\\\Services\\\\Tcpip\\\\..\\\\{AFB38CF0-A963-45B3-A3C2-27A872BAD3B0}: NameServer = 192.168.13.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\\\\Program Files\\\\Alwil Software\\\\Avast4\\\\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\\\\WINDOWS\\\\system32\\\\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\\\\WINDOWS\\\\system32\\\\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\\\\Program Files\\\\Alwil Software\\\\Avast4\\\\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\\\\Program Files\\\\Alwil Software\\\\Avast4\\\\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\\\\Program Files\\\\Alwil Software\\\\Avast4\\\\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\\\\WINDOWS\\\\system32\\\\CTsvcCDA.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\\\\WINDOWS\\\\SYSTEM32\\\\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\\\\Program Files\\\\Common Files\\\\InstallShield\\\\Driver\\\\11\\\\Intel 32\\\\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\\\\Program Files\\\\Common Files\\\\Macromedia Shared\\\\Service\\\\Macromedia Licensing.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\\\\Program Files\\\\Spyware Terminator\\\\sp_rsser.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\\\\WINDOWS\\\\system32\\\\UAService7.exe

–
End of file - 8811 bytes




Thanks for your helping :thumbup:

PS : SORRY, another QUESTION too, is opening a rootkit repeal NEED A VERY LONG TIME to process it ???. its just showing some loading but I never see even the REPORT TAB yet despite I had wait for more than 30 minutes

News :
Its been confirmed now that ROOTREPEAL HAD FAILED TO WORKD PROPERLY in my PC… its disable & make my Task Manager ERROR plus its take more than 3 hours now to just LOAD the program… sorry Root Repeal = completely failed now in Windows mode
Post #2
Hello and :welcome:

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

Log research takes time, so please be patient and I'd be grateful if you would note the following:
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Do not install/uninstall anything on your computer unless advised.
  • Do not run any other scanning tools other than those instructed for you to use.
  • Follow the instructions on the order they are given.
  • Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
  • If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
  • And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.

Let's start with the following:

Please download ERUNT from one of the following links:
  • ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
  • Double click erunt-setup.
  • Choose a language then press Enter or click OK to continue.
  • Click Next on the Welcome window.
  • Install it using the default settings and choose No when asked to add ERUNT to the start up folder.
  • Make sure a check mark is placed beside Launch ERUNT and uncheck Show documentation.
  • Click Finish.
  • Once installed, open ERUNT.exe if it hasn't opened yet then create a registry back up.

How to create ERUNT back up:
  • Open ERUNT.exe, if it hasn't opened yet.
  • Click OK on the welcome screen.
  • Choose the default settings for the back up.
  • Make sure a check mark is placed beside System registry and Current user registry.
  • Click OK.
  • If the destination folder does not exist, ERUNT will prompt you and just click on Yes.
  • A confirmation window will popup when complete.
  • Click OK to close.

Note: To restore your registry, go to %WINDIR%\ERDNT (ex. C:\WINDOWS\ERDNT) and choose the folder which you want to restore and open ERDNT.exe

–Next–

We Need to check for Rootkits with RootRepeal
Please download RootRepeal one of these locations and save it to your desktop
Here
Here
Here
  • Open [external image: Posted Image] on your desktop.
  • Click the [external image: Posted Image] tab.
  • Click the [external image: Posted Image] button.
  • Check just these boxes:
  • [external image: Posted Image]
  • Push Ok
  • Check the box for your main system drive (Usually C:, and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your post.
–Next–

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

—————————————————

Please include the contents of the following in your next reply:

DDS.txt

Please attach the second file; Attach.txt. To attach a file, do the following:
  • Under the reply panel is the Attachments Panel.
  • Browse for the attachment file you want to upload, then click the green Upload button.
  • Once it has uploaded, click the Manage Current Attachments drop down box.
  • Click on to insert the attachment into your post

Please post both DDS logs in your next reply.

To post in your next reply:
1. RootReal log.
2. DDS logs.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI