rkill keeps finging these two processes

rkill keeps finding and terminating these two processes. I run TDSSkiller and MBAM. In a day or two rkill finds and terminates the same two. Any ideas what it is and how to deal with it? Sorry, but I am not a computer geek. Took a fortran class in college c.1976 with a computer the size of my kitchen with a punch card reader and line printer. If anyone will help me, thank you.

Rkill 2.0.3 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 08/17/2012 08:32:04 PM in x64 mode.
Windows Version: Windows Vista

Checking for Windows services to stop.

* No malware services found to stop.

Checking for processes to terminate.

* C:\Windows\System32\WLTRYSVC.EXE (PID: 1484) [WD-HEUR]
* C:\Windows\System32\bcmwltry.exe (PID: 1508) [WD-HEUR]

2 proccesses terminated!

Checking Registry for malware related settings.

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks.

* SMTMP folder detected. Your machine is or has been infected with the Fake.HDD rogue anti-spyware program. Please see this link for more information about this type of rogue: http://www.bleepingcomputer.com/forums/topic405109.html

Restarting Explorer.exe in order to apply changes.

Program finished at: 08/17/2012 08:32:18 PM
Execution time: 0 hours(s), 0 minute(s), and 14 seconds(s)

Hello,I moved this from Vista to the Am I Infected forum.

if you have not.... After running RKill

Next run MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Important!! When you save the mbam-setup file, rename it to something random (such as 123abc.exe) before beginning the download.

Malwarebytes may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet and double-click on the renamed file to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• Malwarebytes will automatically start and you will be asked to update the program before performing a scan.
• If an update is found, the program will automatically update itself. Press the OK button and continue.
• If you cannot update Malwarebytes or use the Internet to download any files to the infected computer, manually update the database by following the instructions in FAQ Section A: 4. Issues.

• Under the Scanner tab, make sure the "Perform Quick Scan" option is selected.
• Click on the Scan button.
• When finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box, then click the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked and then click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab.
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows the database version and your operating system.
• Exit Malwarebytes when done.

Note: If Malwarebytes encounters a file that is difficult to remove, you will be asked to reboot your computer so it can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally will prevent Malwarebytes from removing all the malware.

-- Some types of malware will target Malwarebytes and other security tools to keep them from running properly. If that's the case, go to Start > All Programs > Malwarebytes Anti-Malware folder > Tools > click on Malwarebytes Chameleon and follow the onscreen instructions. The Chameleon folder can be accessed by opening the program folder for Malwarebytes Anti-Malware (normally C:\Program Files\Malwarebytes' Anti-Malware or C:\Program Files (x86)\Malwarebytes' Anti-Malware).

Those are legit programs and can be ignored. Next time you reboot those processes will start again.

Thanks for the help. Here is the log you requested.

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.18.06

Windows Vista Service Pack 2 x64 NTFS
Internet Explorer 9.0.8112.16421
Kinghorn :: KINGHORN-PC [administrator]

8/18/2012 6:47:58 PM
mbam-log-2012-08-18 (18-47-58).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 197891
Time elapsed: 4 minute(s), 56 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


Also, thanks for the info that I can ignore those two items rkill keeps picking up.

As Grinler stated thet are safe.
They are a process file from company Broadcom Corporation belonging to product Broadcom 802.11 Wireless Network Service.
The file is digitally signed from Broadcom Corporation - VeriSign Time Stamping Services Signer - G2


Thanks for pointing it out as it will no longer be flagged.

If there are no other isssues we can consider this complete.

Boopme, how do you know that the file is signed? Is there a sample of this file submitted somewhere? Curious about something.

Also it appears that your computer was once infected with the FakeHDD rogue family. Has that since been resolved?

Runescanner
http://www.runscanner.net/lib/wltrysvc.exe.html

hurlburttheunruly,

Can you submit these files to http://www.bleepingcomputer.com/submit-malware.php?channel=3

C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe

Thanks

I have submitted the files as requested

As to the Fake HDD, a few weeks ago I ran rkill, tdss killer, mbam, unhide. All problems and symptoms went away. Don't know how I got infected.

OK thanks for the files. Those files do not have digital signatures. Not sure why the manufacturers don't do this, but they are not malicious.

OK. Thanks Grinler, boopme.