Tech Support banner

Status
Not open for further replies.
1 - 2 of 2 Posts

·
Registered
Joined
·
10 Posts
Discussion Starter #1 (Edited)
Spybot S&D found 3 LSA problems but was only able to fix one of them. After several restarts it tried to fix them without success.
Running in safe mode did not help.
Spybot reported as follows:

LSA: Settings (Registry key, fixing failed)
HKEY_USERS\S-1-5-18\SYSTEM\CurrentControlSet\Control\Lsa

LSA: Settings (Registry key, fixing failed)
HKEY_USERS\.DEFAULT\SYSTEM\CurrentControlSet\Control\Lsa

I looked in the registry addresses above and in each Lsa folder there was a file called dynjngo.exe

Do I delete the Lsa folder or just the file?


Just before SpyBot discovered the spyware, Norton removed W32.IRCBOT.Gen and the following files were quarantined. TFTP180, TFTP3132 and TFTP636.

I therefore have a second question: As Norton deleted several TFTP files, should I be concerned about an exe file called tftp which is in the Windows System32 folder?
Kind regards

awestruck
 

·
Registered
Joined
·
3,100 Posts
Please download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Create a folder at C:\HJT and move HijackThis.exe there. Run a scan and save the log file. Get HijackThis Analyzer and save it to the same folder as the hijackthis.log file. Run HijackThis Analyzer and type in y if you agree. Open up the result.txt file created. Copy the whole result.txt log and post it back here. Do not fix anything in HijackThis since they may be harmless. Make sure to include the System information at the top of the log as well.

TFTP.exe is a legit Windows file, no need to worry about it. Malware often names itself similarly to legit processes to avoid detection by the untrained eye.
 
1 - 2 of 2 Posts
Status
Not open for further replies.
Top