Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

rkill keeps finging these two processes


  • Please log in to reply
11 replies to this topic

#1 hurlburttheunruly

hurlburttheunruly

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:24 PM

Posted 17 August 2012 - 09:03 PM

rkill keeps finding and terminating these two processes. I run TDSSkiller and MBAM. In a day or two rkill finds and terminates the same two. Any ideas what it is and how to deal with it? Sorry, but I am not a computer geek. Took a fortran class in college c.1976 with a computer the size of my kitchen with a punch card reader and line printer. If anyone will help me, thank you.

Rkill 2.0.3 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 08/17/2012 08:32:04 PM in x64 mode.
Windows Version: Windows Vista

Checking for Windows services to stop.

* No malware services found to stop.

Checking for processes to terminate.

* C:\Windows\System32\WLTRYSVC.EXE (PID: 1484) [WD-HEUR]
* C:\Windows\System32\bcmwltry.exe (PID: 1508) [WD-HEUR]

2 proccesses terminated!

Checking Registry for malware related settings.

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks.

* SMTMP folder detected. Your machine is or has been infected with the Fake.HDD rogue anti-spyware program. Please see this link for more information about this type of rogue: http://www.bleepingcomputer.com/forums/topic405109.html

Restarting Explorer.exe in order to apply changes.

Program finished at: 08/17/2012 08:32:18 PM
Execution time: 0 hours(s), 0 minute(s), and 14 seconds(s)

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 61,605 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:24 PM

Posted 17 August 2012 - 10:02 PM

Hello,I moved this from Vista to the Am I Infected forum.

if you have not.... After running RKill

Next run MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware Posted Image and save it to your desktop.
  • Important!! When you save the mbam-setup file, rename it to something random (such as 123abc.exe) before beginning the download.
Malwarebytes may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

  • Make sure you are connected to the Internet and double-click on the renamed file to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • Malwarebytes will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button and continue.
  • If you cannot update Malwarebytes or use the Internet to download any files to the infected computer, manually update the database by following the instructions in FAQ Section A: 4. Issues.
  • Under the Scanner tab, make sure the "Perform Quick Scan" option is selected.
  • Click on the Scan button.
  • When finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box, then click the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked and then click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows the database version and your operating system.
  • Exit Malwarebytes when done.
Note: If Malwarebytes encounters a file that is difficult to remove, you will be asked to reboot your computer so it can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally will prevent Malwarebytes from removing all the malware.

-- Some types of malware will target Malwarebytes and other security tools to keep them from running properly. If that's the case, go to Start > All Programs > Malwarebytes Anti-Malware folder > Tools > click on Malwarebytes Chameleon and follow the onscreen instructions. The Chameleon folder can be accessed by opening the program folder for Malwarebytes Anti-Malware (normally C:\Program Files\Malwarebytes' Anti-Malware or C:\Program Files (x86)\Malwarebytes' Anti-Malware).

Edited by boopme, 17 August 2012 - 10:03 PM.

How do I get help? Who is helping me?
Staying Updated Calendar of Updates.
For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....
Become a BleepingComputer fan: Facebook Have you seen..Select Real Security

#3 Grinler

Grinler

    Bleep Bleep!


  • Admin
  • 40,048 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:06:24 PM

Posted 18 August 2012 - 11:16 AM

Those are legit programs and can be ignored. Next time you reboot those processes will start again.

#4 hurlburttheunruly

hurlburttheunruly
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:24 PM

Posted 18 August 2012 - 07:09 PM

Thanks for the help. Here is the log you requested.

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.18.06

Windows Vista Service Pack 2 x64 NTFS
Internet Explorer 9.0.8112.16421
Kinghorn :: KINGHORN-PC [administrator]

8/18/2012 6:47:58 PM
mbam-log-2012-08-18 (18-47-58).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 197891
Time elapsed: 4 minute(s), 56 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


Also, thanks for the info that I can ignore those two items rkill keeps picking up.

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 61,605 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:24 PM

Posted 18 August 2012 - 09:00 PM

As Grinler stated thet are safe.
They are a process file from company Broadcom Corporation belonging to product Broadcom 802.11 Wireless Network Service.
The file is digitally signed from Broadcom Corporation - VeriSign Time Stamping Services Signer - G2


Thanks for pointing it out as it will no longer be flagged.

If there are no other isssues we can consider this complete.

Edited by boopme, 18 August 2012 - 09:56 PM.

How do I get help? Who is helping me?
Staying Updated Calendar of Updates.
For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....
Become a BleepingComputer fan: Facebook Have you seen..Select Real Security

#6 Grinler

Grinler

    Bleep Bleep!


  • Admin
  • 40,048 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:06:24 PM

Posted 18 August 2012 - 10:33 PM

Boopme, how do you know that the file is signed? Is there a sample of this file submitted somewhere? Curious about something.

Also it appears that your computer was once infected with the FakeHDD rogue family. Has that since been resolved?

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 61,605 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:24 PM

Posted 18 August 2012 - 10:51 PM

Runescanner
http://www.runscanner.net/lib/wltrysvc.exe.html
How do I get help? Who is helping me?
Staying Updated Calendar of Updates.
For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....
Become a BleepingComputer fan: Facebook Have you seen..Select Real Security

#8 Grinler

Grinler

    Bleep Bleep!


  • Admin
  • 40,048 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:06:24 PM

Posted 19 August 2012 - 09:19 AM

hurlburttheunruly,

Can you submit these files to http://www.bleepingcomputer.com/submit-malware.php?channel=3

C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe

Thanks

#9 hurlburttheunruly

hurlburttheunruly
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:24 PM

Posted 19 August 2012 - 08:37 PM

I have submitted the files as requested

#10 hurlburttheunruly

hurlburttheunruly
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:24 PM

Posted 19 August 2012 - 08:43 PM

As to the Fake HDD, a few weeks ago I ran rkill, tdss killer, mbam, unhide. All problems and symptoms went away. Don't know how I got infected.

#11 Grinler

Grinler

    Bleep Bleep!


  • Admin
  • 40,048 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:06:24 PM

Posted 19 August 2012 - 08:49 PM

OK thanks for the files. Those files do not have digital signatures. Not sure why the manufacturers don't do this, but they are not malicious.

#12 hurlburttheunruly

hurlburttheunruly
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:24 PM

Posted 19 August 2012 - 09:16 PM

OK. Thanks Grinler, boopme.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users