Take a look at our
ThinkPads.com HOME PAGE
For those who might want to contribute to the blog, start here: Editors Alley Topic
Then contact Bill with a Private Message

LFOGRPOW.EXE

T40/T41/T42/T43 Series
Post Reply
Message
Author
CeeBee
Sophomore Member
Posts: 144
Joined: Wed Nov 14, 2007 12:52 pm
Location: New York, NY

LFOGRPOW.EXE

#1 Post by CeeBee » Tue Mar 06, 2012 2:13 am

Can anyone tell me the origin of LFOGRPOW.EXE, how it's loaded and what's doing? It's shown as a process on all my TPs, a T43 included. The file resides in the \system32 folder together with two similarly named .dll files. Thanks, CBA

poshgeordie
ThinkPadder
ThinkPadder
Posts: 1101
Joined: Sat Feb 09, 2008 6:19 pm
Location: Newcastle upon Tyne, UK
Contact:

Re: LFOGRPOW.EXE

#2 Post by poshgeordie » Tue Mar 06, 2012 5:05 am

A quick Google search indicates it may be a rogue antispyware program.

The link includes a specific removal program too. I see from reading other posts that it can reappear after it's been removed, and in this case run the removal program in safe mode (press F8 immediately after the welcome screen disappears). Safe mode runs the OS in minimum mode and such programs won't run in this mode.

Also suggest making a restore point before running the removal program in case it upsets something else when removed.

CeeBee
Sophomore Member
Posts: 144
Joined: Wed Nov 14, 2007 12:52 pm
Location: New York, NY

Re: LFOGRPOW.EXE

#3 Post by CeeBee » Tue Mar 06, 2012 5:45 am

Hi Nick,

I did a search too and came across these links, however, most are not very reliable imo. The link you refer to seems like 'one of those' .. and the removal program you are asked to download (http://www.removespywaretips.com/RegUtility_Setup.exe) appears to be a link to a reg-cleaner or similar. I'm staying away from those...

In addition to NAV 2012 I have several on demand antispyware scanners and none flag this file as bad or similar. And, I did upload the file to VirusTotal for a check and the file came out clean. This link shows an earlier scan, like my scan, also clean: https://www.virustotal.com/file/bf7f0a3 ... /analysis/

I think the file could be an old Thinkpad support program, but, as it's attached to spoolsv.exe (strange) I really don't know. If I knew how, I could upload a print-screen image from Process Explorer showing the LFOGRPOW.EXE file...

Best, CBA

RealBlackStuff
Admin Emeritus
Admin Emeritus
Posts: 23812
Joined: Mon Sep 18, 2006 5:17 am
Location: Loch Garman, Éire

Re: LFOGRPOW.EXE

#4 Post by RealBlackStuff » Tue Mar 06, 2012 6:28 am

Just run AntiMalware from http://www.malwarebytes.org/
Make sure to update the signature file first, before you run it.
If it's a baddie, AMW will get rid of it.
Lovely day for a Guinness! (The Real Black Stuff)
Lenovo: X240, X250, T440p, T480, M900 Tiny.

PS: the old Boardroom website is still available on the Wayback Machine
.

CeeBee
Sophomore Member
Posts: 144
Joined: Wed Nov 14, 2007 12:52 pm
Location: New York, NY

Re: LFOGRPOW.EXE

#5 Post by CeeBee » Tue Mar 06, 2012 10:39 am

Checked the file with MBAM and other AntiMalware progs and no hit. It's clean, and, after prying inside the file, I think I know why. The file belongs to a Ricoh MFP 1100S USB printer driver (Laser Pro LL2), which I installed recently on two of my TPs during a visit to a hotel. They came from the Ricoh OEM CD .. so I'm sure they are fine. Except, I don't like the fact that they load even when my default print driver is not Ricoh. Typically, imho, software sloppily written...

At any rate, issue resolved. Thanks for the input. Best, CBA

Post Reply

Return to “ThinkPad T40/T41/T42/T43 Series”

Who is online

Users browsing this forum: Bing [Bot] and 52 guests