SpyBot finds it but can't delete it

[David Emerling]

Everytime I run SpyBot it finds:

ShopAtHome: Library
c:\windows\system32\lsp.dll

But it doesn't deleting, instead, asking if it can run SpyBot upon the next
boot up.

When I reboot and SpyBot runs, it finds the same file and *still* can't
delete it.

When I try to delete it manually through Windows Explorer, it says "access
denied."

The file is 40KB and is dated 5/6/2003

How do I get rid of this thing? What the heck is it? And what is it doing
to my system?

--
David Emerling - Memphis, TN
demerlin(REMOVE_THIS)@midsouth.rr.com
If you want to email me - edit the above email address appropriately.

[Vanguard]

It would help a lot if you mentioned which version of Windows that you
are running. My guess is that you are running a 95-based version of
Windows since the %windir% path you mention is C:\Windows. So, just
boot to a DOS prompt (i.e., do NOT boot into Windows GUI) and delete or
rename the file manually. You might also want to wander through the
registry looking for any instance of "lsp.dll" to see if anything lists
it as a server process. HOWEVER, this may be a critical file as noted
below.

Have you tried any Google searches on "lsp.dll"? Bet not. One article
has a link to http://www.cexx.org/lspfix.htm which claims LSP.dll is
part of Winsock. In 95-based Windows, you can uninstall the TCP
protocol so maybe uninstalling and reinstalling might provide the same
fix without having to rely on an unknown author telling you to do some
critical surgery in your OS. However,
http://www.doxdesk.com/parasite/ShopAtHomeSelect.html also mentions this
other site.

I'm wondering if SpyBot's Immunize BHO (browser helper object) that
installs into IE might not help protect you later when you go hunting
around unknown web sites, especially when shopping or downloading "free"
software (which, as you found out, actually does have a price tag).

--
__________________________________________________ __________
** Share with others. Post replies in the newsgroup.
** If present, remove all "-NIX" from my email address.
__________________________________________________ __________


"David Emerling" <demerlin(REMOVE_THIS)@midsouth.rr.com> wrote in
message news:JLHeb.1162$oC5.427@clmboh1-nws5.columbus.rr.com...
> Everytime I run SpyBot it finds:
>
> ShopAtHome: Library
> c:\windows\system32\lsp.dll
>
> But it doesn't deleting, instead, asking if it can run SpyBot upon the
next
> boot up.
>
> When I reboot and SpyBot runs, it finds the same file and *still*
can't
> delete it.
>
> When I try to delete it manually through Windows Explorer, it says
"access
> denied."
>
> The file is 40KB and is dated 5/6/2003
>
> How do I get rid of this thing? What the heck is it? And what is it
doing
> to my system?
>
> --
> David Emerling - Memphis, TN
> demerlin(REMOVE_THIS)@midsouth.rr.com
> If you want to email me - edit the above email address appropriately.
>
>
>

[David Emerling]

"Vanguard" <rztqf6v02-NIX@sneakemail-NIX.com> wrote in message
news:i_Heb.655897$uu5.107453@sccrnsc04...
> It would help a lot if you mentioned which version of Windows that you
> are running. My guess is that you are running a 95-based version of
> Windows since the %windir% path you mention is C:\Windows. So, just
> boot to a DOS prompt (i.e., do NOT boot into Windows GUI) and delete or
> rename the file manually. You might also want to wander through the
> registry looking for any instance of "lsp.dll" to see if anything lists
> it as a server process. HOWEVER, this may be a critical file as noted
> below.
>
> Have you tried any Google searches on "lsp.dll"? Bet not. One article
> has a link to http://www.cexx.org/lspfix.htm which claims LSP.dll is
> part of Winsock. In 95-based Windows, you can uninstall the TCP
> protocol so maybe uninstalling and reinstalling might provide the same
> fix without having to rely on an unknown author telling you to do some
> critical surgery in your OS. However,
> http://www.doxdesk.com/parasite/ShopAtHomeSelect.html also mentions this
> other site.
>
> I'm wondering if SpyBot's Immunize BHO (browser helper object) that
> installs into IE might not help protect you later when you go hunting
> around unknown web sites, especially when shopping or downloading "free"
> software (which, as you found out, actually does have a price tag).

I actually I *did* do a Google search for "lsp.dll" and it wasn't clear to
me whether this was some critical system file or not. It was inconclusive.

I do know this, however; I have been running SpyBot for over a year and it
has never found this file before. Or, at least, it has never "complained"
about it before.

I'm running Windows XP Home Edition.

--
David Emerling - Memphis, TN
demerlin(REMOVE_THIS)@midsouth.rr.com
If you want to email me - edit the above email address appropriately.

[BillW]

I did a google search and only looked at the first two entries and both gave
clear instructions on how to get rid of it. Check this link and follow the
instructions. http://www.computing.net/windowsme/w...rum/36549.html


"David Emerling" <demerlin(REMOVE_THIS)@midsouth.rr.com> wrote in message
news:y3Ieb.1163$oC5.481@clmboh1-nws5.columbus.rr.com...
>
> "Vanguard" <rztqf6v02-NIX@sneakemail-NIX.com> wrote in message
> news:i_Heb.655897$uu5.107453@sccrnsc04...
> > It would help a lot if you mentioned which version of Windows that you
> > are running. My guess is that you are running a 95-based version of
> > Windows since the %windir% path you mention is C:\Windows. So, just
> > boot to a DOS prompt (i.e., do NOT boot into Windows GUI) and delete or
> > rename the file manually. You might also want to wander through the
> > registry looking for any instance of "lsp.dll" to see if anything lists
> > it as a server process. HOWEVER, this may be a critical file as noted
> > below.
> >
> > Have you tried any Google searches on "lsp.dll"? Bet not. One article
> > has a link to http://www.cexx.org/lspfix.htm which claims LSP.dll is
> > part of Winsock. In 95-based Windows, you can uninstall the TCP
> > protocol so maybe uninstalling and reinstalling might provide the same
> > fix without having to rely on an unknown author telling you to do some
> > critical surgery in your OS. However,
> > http://www.doxdesk.com/parasite/ShopAtHomeSelect.html also mentions this
> > other site.
> >
> > I'm wondering if SpyBot's Immunize BHO (browser helper object) that
> > installs into IE might not help protect you later when you go hunting
> > around unknown web sites, especially when shopping or downloading "free"
> > software (which, as you found out, actually does have a price tag).
>
> I actually I *did* do a Google search for "lsp.dll" and it wasn't clear to
> me whether this was some critical system file or not. It was
inconclusive.
>
> I do know this, however; I have been running SpyBot for over a year and it
> has never found this file before. Or, at least, it has never "complained"
> about it before.
>
> I'm running Windows XP Home Edition.
>
> --
> David Emerling - Memphis, TN
> demerlin(REMOVE_THIS)@midsouth.rr.com
> If you want to email me - edit the above email address appropriately.
>
>

[Tim Smith]

In article <JLHeb.1162$oC5.427@clmboh1-nws5.columbus.rr.com>, David Emerling wrote:
> Everytime I run SpyBot it finds:
>
> ShopAtHome: Library
> c:\windows\system32\lsp.dll
....
> How do I get rid of this thing? What the heck is it? And what is it doing
> to my system?

Find whatever installed it, and run its uninstaller, and hope that gets rid
of it. There's a reasonable chance "lsp" means "layered service provider",
which is a way to add extensions to the Windows networking code.

LSPs are tricky. We've got one where I work (one of our products was a web
cache, and I wrote an LSP as the method of hooking in), and it took a lot of
work to write an uninstaller that could uninstall it without breaking the
system. The problem is that LSPs are incredibly useful for a lot of things
in Windows (e.g., besides a web cache, they are also one of the best ways
for a spam blocker, an email virus blocker, and maybe even a firewall, to
hook in), but Microsoft didn't specify how they are to work in the presence
of other LSPs. So, everyone who writes one has to make some assumptions,
and their uninstaller has to make some assumptions. If anything gets messed
up, you can be left with a non-functional network.

In general, here are the things you should do to remove suspicious stuff, in
order of desirability.

1. Find what installed it, and run its uninstaller if it has one.

2. If that fails, or it doesn't have an uninstaller, use something like
GoBack from Roxio to revert back to a snapshot from before the obnoxious
thing got installed. This is pretty safe, because it will revert the
registry, too, and any other things that you've missed. On the other hand,
if you have had the pest installed for a long time, you might have a lot of
stuff that you don't want to just revert, and so getting all the bad stuff
reverted while keeping your stuff would be a hassle.

3. If you have a spyware remover that is willing and able to delete it, let
it try. The danger here is that this can muck up your system. I've seen
all the major spyware removers mess up systems by trying to remove things
that they didn't know how to safely remove.

--
Evidence Eliminator is worthless. See evidence-eliminator-sucks.com
--Tim Smith