Don't bother helping if you don't understand what this is.

Btw look closely to the timestamp, clearly shows all the consecutive 8's. ( All revolve around this "WSMAN" )

But I cannot find the location.

RootkitRevealer creates a large number of false positives, especially when running on a MS SQL Server.
This means that Windows must be as inactive as it can be, when running RootkitRevealer.
Shut down all services, possible Windows Remote Management software, MS SQL services, Windows Media Player and any other user application. Then re-run RootkitRevealer.

By the way hklm\software\microsoft\windows\currentversion\wsman\ is also a service creating false reports, don't bother about this.

This post was edited by iDGames on Jul 3 2011 04:14am