Lsa

[vjeko]

Hi,
Till now I've limited my security activities to sw firewall and overwriting infected windows with clean image, so I'm at beginner level.

After running SpybotS&D 1.4, I got following entries which I am not sure about - could someone please point me to where I could find out more about what this is/whether it should be deleted (maybe someone also has some good pointer on what is most important to readup on re security to get a better grip on things):

LSA: Settings (Registry key, nothing done)
HKEY_USERS\.DEFAULT\SYSTEM\CurrentControlSet\Control\Lsa

LSA: Settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1123561945-484763869-1801674531-1004\SYSTEM\CurrentControlSet\Control\Lsa

LSA: Settings (Registry key, nothing done)
HKEY_USERS\S-1-5-18\SYSTEM\CurrentControlSet\Control\Lsa

The following can be seen in registry(via regedit) under each of the above entries :
(Default) (value not set)
(Outlook Express) (cicgr.exe)

BR,Vjeko

[tashi]

Hello.
Please see this topic:
http://forums.spybot.info/showthread.php?t=1118&highlight=LSA%3ASettings

Unfortunately member did not respond as to whether the advice helped.

Security tips here:
So how did I get infected in the first place? By Tony Klein (http://forums.spybot.info/showthread.php?t=279)
Windows Security (http://forums.spybot.info/showthread.php?t=425[url)

Let us know how it goes. :)

[vjeko]

Hi,
Thanks for the good info/advice - I will certainly use it !
My problem was not that I couldn't delete the entries (after your e-mail I deleted them anyway via Spybot) but that I was not sure whether they were something that actually had to be deleted. Anyway, I deleted them and the system works.

BR,Vjeko

[tashi]

Thank you for letting us know. :)