Hi, I can not copy or move files from my Window XP disk to USB external disk. I suspect that is due to a corrupted LSA registry field for the following reasons. Does anyone know how to fix this: 1/ I got Error messages from my Norton Anti Virus software that my machine is infected with the "mllmm.dll" virus and it can not delete nor quarantine that file. This message kept appearing whenever IE was loaded and it slowed the system down by generating notification every 2-3 seconds. 2/ I downloaded the VundoFix software and ran it. The software ran fine, found a few malware, and completed the steps to deleted the found malware. HOwever, Norton Antivirus still complained about that particular virus even though I already ran the VudoFix, and then also another online Symatex software to kill that particular Vundo malware. 3/ I did a search and found that the "mllmm.dll" is in the "C://Documents and Setting/ha/Local Setting/Temp" directory. "ha" is one of the user account on my machine. I went into that directory to manually delete that file. I got the error message that I can not delete that file because another process is using it. 4/ I then run "regedit" and did a search on mllmm.dll with the path name above. I found that it was used in 2 locations: the "authentication packages" field of the "LSA" registry in the HKEY_LOCAL_MACHINE/SYSTEM/ControlSet001/Control and that of the ControlSet 002/Control. I delete those entries from those fields and reboot my machine. After logging in, I found that I did not have the bottom bar with "start" logo anymore. I can see all of my files in the system but I can not copy or move them. When I drag file from one window to another, the file was not selected. When I tried "copy and paste", the "past" option was grayed out. It seems like I don't have the right permission to operate on those files anymore even though my user account has the Administrator priviledge. Does anybody know how to fix the problem? I made a big mistake of not backing up the registry when I started editing it. So, I'm stuck with this mess now. Thanks, Lam

I am not expert, but if you get no further help try looking at http://www.spywaredata.com/spyware/... There is a scan for this on this website. Mcafee site adviser says the site is ok. Google also came up with some other ideas. If you can get rid of the virus. You could try system file checker Run sfc /scannow http://www.updatexp.com/scannow-sfc... Before posting try google. Backup. Use anti virus software.

Thanks Clive. The site that you mentioned were among the ones that I looked at the other day to find out what mllmm.dll is. If I can not find a way to get rid of the malware, I plan to copy a few files that I have not backed up before in order to reinstall the OS. The bad thing is that I can not copy or move any file now. Thanks for the inputs. Lam

Moveonboot, can move or delete files. See if its any use. http://www.snapfiles.com/get/moveon... Before posting try google. Backup. Use anti virus software.

Clive, I'll try that one. Thanks. Happy holidays to you. Lam

lacda97 Try this Website. http://www.kellys-korner-xp.com/tas... When Norton won't delete go into Safe Mode and delete it manually using the Norton address to find it. You can try Unlocker http://ccollomb.free.fr/unlocker/ When you find the file you want to get rid of right click it and look for the unlocker sembol.

Hi Cboy & Clive, Thank you both for the tips. I found the correct value for the LSA registry and was able to get my computer back to normal. The "authentication packages" field of the "LSA" registry should be set to "msv1_0". The virus replaced that field with its own command and caused the problem. Thanks again and Happy New Year, Lam