Lsas.blaster.keyloger Solved/Closed

Question

i keep receiving a pop out message from Winweb Security saying that my pc is infected with 38 viruses. but i have done a thorough scan of which no infection was detected.

What is wrong here and how do i go about resolving this infection issue?

thank u

St pete Tim · Accepted Answer

I have the same thing with system sercurity and the lsas.blaster.keyloger popup and cant get rid of it i need help please . It says I too have 38 things wrong and my nortons 360 says there is nothing wrong with it.How do i get rid of it.      Thankyou very much.

webdoctor · Answer

You are infected with WinWeb security a bogus antivirus software which produces false reports and attempts to have you purchase WinWeb security. You need to remove it. Instructions can be found here https://www.bleepingcomputer.com/virus-removal/remove-winweb-security

Den · Answer

I have the same problem too I am running spyware doctor and still get the pop up

roxy · Answer

I got the sam one but the only thing I found to remove it was to reinstall windows if you have you software than cool

lassol · Answer

as i understand it  this virus has been renamed system security 4.5.  i tried all of the suggested solutions to no avail, including  pulling up the task  window and deleting. For me it did not work. i tried to down load mc affee and it  kept logging off aol and internet explorer ( i tried downloading on both systems) eventually i found windows live one care through the microsoft site, so that i knew it was genuine and had no problem downloading. it worked ,i was left with  a small square blue and white icon whichi put into the recycle bin. as a bonus i have th windows one care on three months trial and do not have to pay anything until the three months expire. i supposew i could decide not to go ahead  with the purchase  but this system seems to be so good it would be daft not to. note  you do need to  remove any external spyware and the like before you  download. the srcurity settting that come with your system do not need to be removed or settings change. to be sure that all is ok go to control panel and click on security and it will give the status of the three settings firewall antivirus etc. hope this is useful

jellyfish · Answer

I recently had this worm. After attempting all the suggested remadies, to no avail, all I did was click the decline or the X. I did this for about 2 or 3 weeks then it didn't appear anymore. This worm is just a scam for people to purchase useless software in the amount of $45.00. 

Just be patient. Don't fall for this scam.

pat · Answer

I had this problem and finally got rid of it by going into safe mode (restart computer; before it loads hit F8; when safe mode screen appears, hit enter) In Safe Mode,  I then updated my Adaware program and ran it.  Adaware got rid of the spyware and my antivirus program and all other programs functioned again.  I then got out of safe mode and ran my Adaware program three more times and scan with my Trend Micro Antivirus program two more times.  Everything is working fine again.

Carey · Answer

Here's the cheap fix:

Boot into safe mode (Holding down F8).

Look in c:\Documents and Settings\All Users\Application Data

There is a file there that is all numbers such as: 85331323 or 46937130

Delete the sucker.

Reboot and all is well.

boxcar84our · Answer

The correct way to get rid of this pesty pop up and to get ur computer back to the way it was before. shut down computer. Restart, hit f8 before load up. This will take you to safe mode and don`t freak out cause everything will appear large. This will enbale you to get to restore of your computer. Restore computer to earlier date, before this sucker attacked ur computer. This should fix it.

gretchwawa · Answer

I agree, Carey is my new best friend!  I rebooted in Safe Mode, and did the restore thing and all seems well!  Thanks to everyone!

g

pb · Answer

thanks to whoever figured out that booting in SAfe-mode was the way to go.
I couldn't do much else from there, but at least was able to do  a System Restore, got rid of the lsas.keyblogger, then upgraded to the latest Norton and feel safe once again.
That was horrible, and I was really really frustrated, thought I'd have to reinstall the entire OS to get rid of the sucker. thank you  thank you again! - pb

Kramer · Answer

Hey. I cannot start in safemode. I have tried f8, f7, going to run... then typing msconfig and nothing will come up. I am not the best with computers... Any ideas?

Comgeek · Answer

try Restore point or formate windows

good to know · Answer

you cam F disk and remove all partitions and do a reinstall. if you any files that you need try putting them on a disc or external hard drive or memory stick. Than run the F disk( https://support.microsoft.com/en-us/windows/create-and-format-a-hard-disk-partition-bbb8e185-1bda-ecd1-3465-c9728f7d7d2e ) than run a reinstall ... this works for very bad infections. hope this helps =)

TechiG · Answer

Thats the last option to do, good2know

14honesty · Answer

thank you very much for the safe mode and system restore idea..It worked like a champ and you are my hero...

ryguy · Answer

I tried following the instructions at https://www.bleepingcomputer.com/virus-removal/remove-security-tool but Security Tool would not let me run mbam OR rkill. It also prevented me from killing the processes through task manager. Here's how I fixed it:

1. Start in safe mode by holding F8 while starting up
2. Press windows key + r to open a run dialog
3. Type msconfig
4. Click on the startup tab
5. Select the item that is all numbers. Its "Command" should be "C:\ProgramData\##########\#########.exe" where the #s are random numbers
6. Click OK and reboot in normal mode

Security Tool should now be temporarily disabled so you can run mbam as explained in the link above.

Good luck!

sallyt · Answer

My son's laptop got this virus today and I managed to remove it using Carey's instructions, now I'm SuperMum!  Thanks Carey!

dave · Answer

Please help i tried Careys ideaa and when i try to delete it says access denied

Murmurings · Answer

Hi

I used Ambuscias' method and it worked very well indeed. Why do I need to rename the malware tool explorer?

But many thanks

Murmurings

Anonymous User · Answer

if you have windows 98 vista or windows 7 you can roll back to a early time before you got  the lsas. blaster worm

keke · Answer

is it possible to stop this virus

Ambucias · Answer

Keke

Yes Carey gave the answer!  All you had to do is read:

Boot into safe mode (Holding down F8). 

Look in c:\Documents and Settings\All Users\Application Data 

There is a file there that is all numbers such as: 85331323 or 46937130 

Delete the sucker. 

Reboot and all is well.

VB · Answer

when I try to delete in normal or safe mode, I get the following error message

cannot delete 16366426.  Access Denied.

Make sure the disk is not full or write-protected and that the file is not currenlty in use.

How can I delete this thing?

Ambucias · Answer

VB
When in safe mode rename the file to 16366426.old

Do a search for the file in your registry and delete the registry entry

Return to the file you renamed and delete it.

Regards

tigerade · Answer

brillant and followed all instructions as per above, was hard at first but managed to clear it. thank you again

Ambucias · Answer

Tigerade

Well sound the trumpets, let the bells ring and the banners fly.

Thank you for your feedback and I happy it worked... it had to

Good luck

Iphonefreak · Answer

Start ur computer and hold down f8. go to safe mode and start. Then go to control panel and find system and security and click back up computer. Then hit recover system settings and Make sure u pick atleast 2 weeks behind and reboot. Hope this helps:)

margaret · Answer

Thank you so much for this solution!!!!

Mal worknet · Answer

Its a load of crap! there is nothing wrong with your system its just some scammers trying to fleece you of money ignore it im in the same situation an have sourced some forums which tell me i can solve it only at the moment im just trying to work out an answer if you get there first please let me know

IdiotDawie · Answer

Thank you!

Ambucias · Answer

Thank you for your feedback and I happy it worked

Sambhavam · Answer

I first logged in in safe mode. 
I searched for all *.exes in my application data folder and i found  one folder named 45667767 inside there was one exe. I deleted that and restarted the system.
Solved.... :)

Lsas.blaster.keyloger

33 responses

Subscribe To Our Newsletter!