Lsas.blaster.keylogerSolved/Closed

Question

i keep receiving a pop out message from Winweb Security saying that my pc is infected with 38 viruses. but i have done a thorough scan of which no infection was detected.

What is wrong here and how do i go about resolving this infection issue?

thank u

St pete Tim · Accepted Answer

I have the same thing with system sercurity and the lsas.blaster.keyloger popup and cant get rid of it i need help please . It says I too have 38 things wrong and my nortons 360 says there is nothing wrong with it.How do i get rid of it.      Thankyou very much.

webdoctor · Answer

You are infected with WinWeb security a bogus antivirus software which produces false reports and attempts to have you purchase WinWeb security. You need to remove it. Instructions can be found here https://www.bleepingcomputer.com/virus-removal/remove-winweb-security

Den · Answer

I have the same problem too I am running spyware doctor and still get the pop up

roxy · Answer

I got the sam one but the only thing I found to remove it was to reinstall windows if you have you software than cool

lassol · Answer

as i understand it  this virus has been renamed system security 4.5.  i tried all of the suggested solutions to no avail, including  pulling up the task  window and deleting. For me it did not work. i tried to down load mc affee and it  kept logging off aol and internet explorer ( i tried downloading on both systems) eventually i found windows live one care through the microsoft site, so that i knew it was genuine and had no problem downloading. it worked ,i was left with  a small square blue and white icon whichi put into the recycle bin. as a bonus i have th windows one care on three months trial and do not have to pay anything until the three months expire. i supposew i could decide not to go ahead  with the purchase  but this system seems to be so good it would be daft not to. note  you do need to  remove any external spyware and the like before you  download. the srcurity settting that come with your system do not need to be removed or settings change. to be sure that all is ok go to control panel and click on security and it will give the status of the three settings firewall antivirus etc. hope this is useful

jellyfish · Answer

I recently had this worm. After attempting all the suggested remadies, to no avail, all I did was click the decline or the X. I did this for about 2 or 3 weeks then it didn't appear anymore. This worm is just a scam for people to purchase useless software in the amount of $45.00. 

Just be patient. Don't fall for this scam.

pat · Answer

I had this problem and finally got rid of it by going into safe mode (restart computer; before it loads hit F8; when safe mode screen appears, hit enter) In Safe Mode,  I then updated my Adaware program and ran it.  Adaware got rid of the spyware and my antivirus program and all other programs functioned again.  I then got out of safe mode and ran my Adaware program three more times and scan with my Trend Micro Antivirus program two more times.  Everything is working fine again.

Carey · Answer

Here's the cheap fix:

Boot into safe mode (Holding down F8).

Look in c:\Documents and Settings\All Users\Application Data

There is a file there that is all numbers such as: 85331323 or 46937130

Delete the sucker.

Reboot and all is well.

boxcar84our · Answer

The correct way to get rid of this pesty pop up and to get ur computer back to the way it was before. shut down computer. Restart, hit f8 before load up. This will take you to safe mode and don`t freak out cause everything will appear large. This will enbale you to get to restore of your computer. Restore computer to earlier date, before this sucker attacked ur computer. This should fix it.

gretchwawa · Answer

I agree, Carey is my new best friend!  I rebooted in Safe Mode, and did the restore thing and all seems well!  Thanks to everyone!

g

pb · Answer

thanks to whoever figured out that booting in SAfe-mode was the way to go.
I couldn't do much else from there, but at least was able to do  a System Restore, got rid of the lsas.keyblogger, then upgraded to the latest Norton and feel safe once again.
That was horrible, and I was really really frustrated, thought I'd have to reinstall the entire OS to get rid of the sucker. thank you  thank you again! - pb

Kramer · Answer

Hey. I cannot start in safemode. I have tried f8, f7, going to run... then typing msconfig and nothing will come up. I am not the best with computers... Any ideas?

Comgeek · Answer

try Restore point or formate windows

good to know · Answer

you cam F disk and remove all partitions and do a reinstall. if you any files that you need try putting them on a disc or external hard drive or memory stick. Than run the F disk( https://support.microsoft.com/en-us/windows/create-and-format-a-hard-disk-partition-bbb8e185-1bda-ecd1-3465-c9728f7d7d2e ) than run a reinstall ... this works for very bad infections. hope this helps =)

TechiG · Answer

Thats the last option to do, good2know

14honesty · Answer

thank you very much for the safe mode and system restore idea..It worked like a champ and you are my hero...

ryguy · Answer

I tried following the instructions at https://www.bleepingcomputer.com/virus-removal/remove-security-tool but Security Tool would not let me run mbam OR rkill. It also prevented me from killing the processes through task manager. Here's how I fixed it:

1. Start in safe mode by holding F8 while starting up
2. Press windows key + r to open a run dialog
3. Type msconfig
4. Click on the startup tab
5. Select the item that is all numbers. Its "Command" should be "C:\ProgramData\##########\#########.exe" where the #s are random numbers
6. Click OK and reboot in normal mode

Security Tool should now be temporarily disabled so you can run mbam as explained in the link above.

Good luck!

sallyt · Answer

My son's laptop got this virus today and I managed to remove it using Carey's instructions, now I'm SuperMum!  Thanks Carey!

dave · Answer

Please help i tried Careys ideaa and when i try to delete it says access denied

Murmurings · Answer

Hi

I used Ambuscias' method and it worked very well indeed. Why do I need to rename the malware tool explorer?

But many thanks

Murmurings

Lsas.blaster.keyloger

33 responses

Subscribe To Our Newsletter!