lsass.exe

[whs37]

Does anybody know why spybot places a ton of entries in the lsass.exe?

[Tom.K]

Do you mean that it detects a lot of lsass.exe? That could be a potential infection then. In case you think that computer is infected, please create a thread in Malware Removal Sub-Forum by following the steps from this thread first: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

[whs37]

Do you mean that it detects a lot of lsass.exe? That could be a potential infection then. In case you think that computer is infected, please create a thread in Malware Removal Sub-Forum by following the steps from this thread first: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

I know that entries in the lsass.exe usually point to malware. But in this case they are clearly marked as Spybot entries - and there are many.

[Tom.K]

Can you post a spybot log/report to see what it detects?

[whs37]

Can you post a spybot log/report to see what it detects?

the log is quite long, but here is the beginning of it:

# Start of entries inserted by Spybot - Search & Destroy
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1001namen.com
127.0.0.1 1001namen.com

Let me know if you need more. Thanks for your help. Wolfgang

[spybotsandra]

Hello,

So how do you refer those entries from the restricted zone to lsass.exe?
That is the immunization of Spybot. The immunization adds sites to the restricted zones in order to block them. So the baddies won't get in.

Best regards
Sandra
Team Spybot