Can anyone tell me the origin of LFOGRPOW.EXE, how it's loaded and what's doing? It's shown as a process on all my TPs, a T43 included. The file resides in the \system32 folder together with two similarly named .dll files. Thanks, CBA

A quick Google search indicates it may be a rogue antispyware program.

The link includes a specific removal program too. I see from reading other posts that it can reappear after it's been removed, and in this case run the removal program in safe mode (press F8 immediately after the welcome screen disappears). Safe mode runs the OS in minimum mode and such programs won't run in this mode.

Also suggest making a restore point before running the removal program in case it upsets something else when removed.

Hi Nick,

I did a search too and came across these links, however, most are not very reliable imo. The link you refer to seems like 'one of those' .. and the removal program you are asked to download (http://www.removespywaretips.com/RegUtility_Setup.exe) appears to be a link to a reg-cleaner or similar. I'm staying away from those...

In addition to NAV 2012 I have several on demand antispyware scanners and none flag this file as bad or similar. And, I did upload the file to VirusTotal for a check and the file came out clean. This link shows an earlier scan, like my scan, also clean: https://www.virustotal.com/file/bf7f0a3 ... /analysis/

I think the file could be an old Thinkpad support program, but, as it's attached to spoolsv.exe (strange) I really don't know. If I knew how, I could upload a print-screen image from Process Explorer showing the LFOGRPOW.EXE file...

Best, CBA

Just run AntiMalware from http://www.malwarebytes.org/
Make sure to update the signature file first, before you run it.
If it's a baddie, AMW will get rid of it.

Checked the file with MBAM and other AntiMalware progs and no hit. It's clean, and, after prying inside the file, I think I know why. The file belongs to a Ricoh MFP 1100S USB printer driver (Laser Pro LL2), which I installed recently on two of my TPs during a visit to a hotel. They came from the Ricoh OEM CD .. so I'm sure they are fine. Except, I don't like the fact that they load even when my default print driver is not Ricoh. Typically, imho, software sloppily written...

At any rate, issue resolved. Thanks for the input. Best, CBA