LSA Shell outgoing connection from Zone Alarm Pro

[Daniel-Man]

Hi,
I just checked my logs and am wondering what an LSA shell (export version) is?? It was an outgoing connection to 210.80.58.34:53??

[mjc]

Ummm.......

Please post Hijack This (http://www.spywareinfo.com/~merijn/) log, tutorial (http://www.tomcoyote.org/hjt).

You may be own3d....

Whatever it is is seeking DNS at that address.

[Daniel-Man]

here is the Hijack this startup log attached

[mjc]

Please post the Hijack log too....

One item, probably not related to your current problems but totally unneeded in XP.....

C:\WINDOWS2\System32\CTsvcCDA.exe

[Daniel-Man]

ok heres the hijack this log

[mjc]

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present


Those are the two locking you from some changes.....possibly from SSD, disable the SSD helper before you make changes.

Then try to make the cahnges, if that doesn't do it, use Hijack to fix them.

You may also want to look at http://www.spywareinfo.com/newsletter/archives/april-2003/2.php regarding this.......R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://news.ninemsn.com.au/

[Daniel-Man]

yeah I made my homepage that myself: http://www.news.ninemsn.com.au , also I was aware of the Internet options being locked, thats only if I try and change them whilst in the window. I can still change them by right clicking the IE icon on desktop.