SpyBot S&D cannot delete LSA

  Awestruck 22:10 04 Oct 05
Locked

Spybot S&D found 3 LSA problems but was only able to fix one of them. After several restarts it tried to fix them without success. Running in safe mode did not help.

Using regedit I located

LSA: Settings (Registry key, fixing failed)
HKEY_USERS\S-1-5-18\SYSTEM\CurrentControlSet\Control\Lsa

LSA: Settings (Registry key, fixing failed)
HKEY_USERS\.DEFAULT\SYSTEM\CurrentControlSet\Control\Lsa

I looked in the registry addresses above and in each Lsa folder there was a file called dynjngo.exe

Do I delete the Lsa folder or just the dynjngo.exe file?

Also is Tclick here safe? It is in System32 folder and recently Norton quarantined several TFTP... files

Kind regards

awestruck

  Taff36 22:52 04 Oct 05

Have you run it in safe mode?

  johnnyrocker 00:13 05 Oct 05

Lsa is not a spy bot issue more an av run full set of scans with if xp sys restore disabled.


johnny.

  Awestruck 18:16 05 Oct 05

Thank you both for your very prompt replies.
Before posting my problem, I had already carried out the processes you both recommend.
With system restore disabled, Norton removed W32.IRCBOT.Gen and the following files were quarantined. TFTP180, TFTP3132 and TFTP636.

Spybot S&D found three copies of Lsa but was able to remove only one copy (even in safe mode). I located the two remaining copies in the registry. In the two registry folders called Lsa there was an exe file called dynjngo. I then I posted my message asking for advice about deleting them from the registry. I therefore repeat my question:

Do I delete the Lsa folder or just the file?

My second question was: As Norton deleted several TFTP files, should I be concerned about an exe file called tftp which is in the Windows System32 folder?
Kind regards

awestruck

  Awestruck 20:56 12 Oct 05

I have located spyware Lsa in the registry. Please would someone be able to answer my question.

In the registry, do I delete the Lsa folder or just the file?

Awestruck

  iambeavis 21:09 12 Oct 05

As regards tclick here - trivial file transfer protocol, it's a Microsoft file so it belongs where it is.

  iambeavis 21:10 12 Oct 05

Bit of a mess there! That "click here" should read tftp - sorry about that.

This thread is now locked and can not be replied to.

Surface Pro (2017) vs Surface Pro 4

20 groundbreaking 3D animation techniques

How to mine Bitcoin on Mac