Home » Headline » Lsas.Blaster.Keyloger

Lsas.Blaster.Keyloger

23 December 2008

Lsas.Blaster.Keyloger is part of the rogue program System Security which display it as a threat detected. It will then prompt users to download and install the said application. Though the said threat does not really exists on the computer, this scare tactics is currently employed by rogue program for deceptive purposes. A pop-up window with message appears.

Internet Explorer is infected with worm Lsas.Blaster.Keyloger. This worm is trying to send your credit card details using Internet Explorer to connect to remote host.

Update: October 14, 2009
New harmful rogue program Security Tool is also using this Lsas.Blaster.Keyloger as a threat to scare computer users and prompts them that only a registered program can remove it from a computer.

Risk Level: Low

File Size: Varies

Affected System: Windows

Screen Shot Images:
Lsas.Blaster.Keyloger is a widely used fake threat. Here are some samples of different bogus security warnings that displays Lsas.Blaster.Keyloger detection.

How to Remove Lsas.Blaster.Keyloger

Use MBAM as Lsas.Blaster.Keyloger Removal Tool:
1. Download Malwarebytes’ Anti-Malware (mbam-setup.exe) and save it on your Desktop.
2. After downloading, double-click on mbam-setup.exe to install the application.
3. Follow the prompts and install as “default” only
4. Before the installation completes, check on the following prompts:
- Update Malwarebytes’ Anti-Malware
- Launch Malwarebytes’ Anti-Malware
5. Click “Finish.” Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
6. Scan your computer thoroughly.
7. When scanning is finished click on the “Show Results”
8. Make sure that all detected threats are marked, click on Remove Selected.
9. Restart your computer.

Note: Lsas.Blaster.Keyloger may prevent mbam-setup.exe from downloading and running. You can download and rename this program from a different computer before running it on infected system.

Related posts:

  1. Blaster/Sasser.variant

    Blaster/Sasser.variant is a threat detected and being displayed by Ultimate Antivirus 2008 as a threat found while scanning the computer. Origin:...

  2. Adware-TryMedia

    Adware-TryMedia is a Potentially Unwanted Programs that redirects homepage or search results to predefined websites. Adware-TryMedia also display excessive pop-up advertisements...

  3. Spyware.IEMonster.b

    Spyware.IEMonster.b is a threat being detected by a rogue security application. On the latest report it is being issued by System...

49 Comments »

  • 1 }
    robert radke said:

    i am unable to remove this thing coming up all of the time …it is exactly what is in the diagram box above please help me get it out of my computer immediately.

    29 December 2008 at 3:42 am
  • 2 }
    juha said:

    hi,
    would be nice to have this potentially ugly virus of my face.would anyone have the time to guide me through the procedure.
    yours
    juha

    29 December 2008 at 5:18 am
  • 3 }
    webmaster (author) said:

    1. Download Malwarebytes’ Anti-Malware (mbam-setup.exe) and save it on your Desktop.
    2. After downloading, double-click on mbam-setup.exe to install the application.
    3. Follow the prompts and install as “default” only
    4. Before the installation completes, check on the following prompts:
    – Update Malwarebytes’ Anti-Malware
    – Launch Malwarebytes’ Anti-Malware
    5. Click “Finish.” Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
    6. Scan your computer thoroughly.
    7. When scanning is finished click on the “Show Results”
    8. Make sure that all detected threats are marked, click on Remove Selected.
    9. Restart your computer.

    Note: Some malware may prevent mbam-setup.exe from downloading and running. You can download and rename this program from a different computer before running it on infected system.

    29 December 2008 at 9:47 am
  • 4 }
    Heather said:

    I have this on my laptop- and am trying to run the suggestion above but nothing is happening?? It will download the Malware, but wont run it on my system. What do I do?

    19 January 2009 at 9:28 pm
  • 5 }
    chris said:

    how do i remove System Security Firewall Alert that keep poping up in my system?

    20 January 2009 at 2:16 pm
  • 6 }
    ew said:

    Go to Programs from Start button, click on Accessories, click on System Tools and choose System Restore. Pick a date to reset your system to that is prior to the date that you got this annoying spyware. It works.

    22 January 2009 at 11:23 pm
  • 7 }
    Linda said:

    Having emailed Sytem Security nothing back ,how did they get on my PC????I will try to restore .Hope it works
    will get back

    27 January 2009 at 5:41 pm
  • 8 }
    Glen said:

    I’ve downloaded suggested anti-virus programs which includes pc tools however it still hasn’t removed this virus.
    Please advise as this is literally taking control over my machine

    23 February 2009 at 2:41 pm
  • 9 }
    Gary said:

    I downloaded the program and it removed the virus completely. My system is now back to normal.

    1 March 2009 at 8:32 pm
  • 10 }
    MB said:

    USE the details from WEBMASTER listed on this site………..it works………100% and is safe! Got rid of the terrible ‘worm’. Thanks!

    23 March 2009 at 3:04 pm
  • 11 }
    bdevine said:

    I can not get rid of this Lsas.Blaster.Keyloger please help. I tried webmasters advice but it won’t run.

    14 May 2009 at 2:00 am
  • 12 }
    joanne said:

    I have tried everything under the sun to get of this stoopid thing. When I go to download anything I am being told everything is infected, it will not open anything. I have been playing with this ALL DAY, I am about ready to throw this computer out the window HELP !!!!!!!!!!!!!!!!!!!

    17 May 2009 at 8:02 pm
  • 13 }
    mary said:

    Joanne,
    Has anything worked for you? I have the same problem, everything is infected and won’t open but internet explorer. Please let know if you have tried anything that worked

    21 May 2009 at 3:37 am
  • 14 }
    anne francoise said:

    i’ve use the system of ew with the restore system and it ‘s ok
    thank you

    23 June 2009 at 10:03 pm
  • 15 }
    Andy said:

    I tried the steps for webmaster and it didn’t work… I cannot download it on another computer because I do not have another computer…

    For ew’s steps, I cannot get anything to start except IE because everything else is “infected”

    I do not have any money to buy a new computer or buy some software….

    26 June 2009 at 2:50 am
  • 16 }
    webmaster (author) said:

    If you cant run it, try rebooting your computer and run in “SafeMode.” Hit F8 on keyboard before Windows starts. Then select SafeMode. Run Mbam from there.

    Andy. Dont you have friends, office, schools where you can download MBAM? You cannot solve anything without an effort.

    26 June 2009 at 4:48 am
  • 17 }
    Andy said:

    thanks… I did the last thing and it worked

    26 June 2009 at 3:08 pm
  • 18 }
    annoyed said:

    I just caught this virus today and I cant even get on the internet let alone access any programs (system restore) what do I do? It took over my whole computer!!

    3 July 2009 at 5:58 pm
  • 19 }
    tera mcdaniel said:

    I have like 182 viruses including the lsas blaster, a bunch of rootkers, porn adders or whatever, i cannot open or run anything now but facebook basically. I have tried downloading the blaster worm remover, at first it downloaded and wouldn’t run. I re downloaded it and renamed it, wouldn’t work, and now when i click to download it, it say internet explorer cannot open the site, it is unrecognized. I have like 1082 errors showin up on one scan. Please Please help!!!!

    19 August 2009 at 4:39 am
  • 20 }
    Braden Myers said:

    could someone please e-mail me the steps to remove this Lsas blaster virus,the virus will not let me download a spyware removal download..thanks

    20 August 2009 at 4:25 pm
  • 21 }
    ceri said:

    I went to the microsoft site sorted it straight away

    12 October 2009 at 1:02 pm
  • 22 }
    brandon said:

    i did post six still waiting to see if it worked ;)

    19 October 2009 at 1:26 pm
  • 23 }
    brandon said:

    yyyyaaaay everyone do post six it works and takes under 3 minutes. go under safe mode to do yayayayayay tytyty

    19 October 2009 at 1:28 pm
  • 24 }
    Aaron said:

    OR
    None of these worked for me, even option 6. Try a slightly different way though:

    I tried to go into safe mode, but it wouldn’t let me, so I selected to start up in normal windows.

    As it was starting up, I pushed F10, and then maneuvered from back there. Click the tab that has the date, and change the date per option 6. Click save and continue to restart in normal mode. Everything was fixed.

    22 October 2009 at 6:51 pm
  • 25 }
    Simon said:

    Ok all you guys,

    I couldn’t access anything on my computer as it closed automatically (including Task manager, all programs and stuff) except the internet. So I downloaded the software Malwarebytes’ Anti-Malware (mbam-setup.exe) and restarted my computer in Safe MODE. Then I searched (while in safe mode) using start – search: “mbam-setup.exe” and installed the software.

    6 November 2009 at 12:54 am
  • 26 }
    Cathy said:

    Hi- please help.
    Did step 6 in safe mode, but could remove all infected items. I’m no further forward. Any ideas?

    8 November 2009 at 3:20 pm
  • 27 }
    Cathy said:

    Sorry last post should read could NOT remove all infected items. ???

    8 November 2009 at 3:25 pm
  • 28 }
    Rebecca said:

    I followed the instructions the webmaster gave above follow it… If it’s not working it might be because you might not be on the administrator user thingy of the computer!!!! I tried that and worked for me now my computer works!!!

    9 November 2009 at 10:48 pm
  • 29 }
    KENNY said:

    I was having “fits” trying to get rid of the Lsas.Blaster.keyloger worm virus that kept popping up and preventing me from accessing anything that would assist, or, give me a clue as to what was going on. Finally after two and a half hours of several failed repeated attempts to download and run various softwware and clean up tools and devices. I shut off my computer and restarted it. While it was re-booting I pushed the F8 key before the “Windows” started. The computer entered the “safe mode”. I pushed the “enter” key, this allowed me the option to “click-on” as “the administrator”. Once I did this I was given the window option “to,or, not to” enter the safe mode. Choosing “not to” allowed me finally… the option to restore my computer. I clicked “not to” and was then given the option to restore my computer to a previous setting. Since I had been going at the failed attempts to get rid of the Lsas.Blaster.Keyloger worm virus for several hours, I just restored my computer to the previous day. Everything restored perfectly! It worked. This is a slight variation of the suggestion that I recieved in this comment section, except that I didn’t try to run the embam-setup.exe from the “safe mode”. Basically, I made the right decisions by following the instruction options that I was presented with. And as each suceeding window opened during this navigation process I took a breath of reliefe because I could see as I was going in the right direction. Try it! WHATEVER WORKS, RIGHT!!! THANKS

    29 December 2009 at 4:37 pm
  • 30 }
    KENNY said:

    By the way… once my computer was restored, I installed the “Malwarebytes Anti-Malware” software via the Malwarebytes Anti-Malware Instillation Wizard generated from the mbam-setup link on betanews.com/malwarebytes/mbam-setup.exe

    29 December 2009 at 4:57 pm
  • 31 }
    How to remove Lsas.Blaster.Keyloger | Jon Murphy Dot Net said:

    [...] Tags: how to remove Lsas.Blaster.Keyloger, Lsas Blaster Keyloger, Lsas.Blaster.Keyloger, Lsas.Blaster.Keyloger removal tool, Lsas.Blaster.Keyloger virus via precisesecurity.com [...]

    5 January 2010 at 12:55 pm
  • 32 }
    chuck said:

    I had the same problem re lsas virus. I shut the system down, reopened in “safe” mode, then did a “systems restore” dated 2 weeks ago. This is in Windows XP. Took me about 2 minutes and so far it is working.

    16 January 2010 at 8:31 pm
  • 33 }
    D Mulyana said:

    i have tried the save mode way n run the mbam-setup exe (i renamed it first). Yup the mwalbytes can fixed the lsas blaster. Thanx to you all, especially webmaster, now my laptop run normally again

    28 January 2010 at 3:52 pm
  • 34 }
    pat said:

    do system restore it works even if restor says not completed

    14 February 2010 at 1:45 pm
  • 35 }
    Herbert said:

    Thanks! The information on this blog helped me recover from the LSAS virus…..

    16 February 2010 at 12:09 am
  • 36 }
    gazza said:

    i have this virus….its terrible. i first up did a system recovery….big mistake, i wiped everything thinkin it would rid me of this thing…it didnt! Now i can’t do a system restore point (which i should have done first up) because as far as the computers concerned, it had this virus from the start! ahhhhhh its drivin me nuts.

    21 February 2010 at 11:18 am
  • 37 }
    JoeAdmin said:

    A VERY important note is included at the end of this article:
    1) Download mabm-setup.exe from a non-affected computer. Save the file to the desktop.

    2) Re-Name mbam-setup.exe to something else with the .exe extension (like JoeAdmin.exe)

    3) Copy the re-named .exe file to a memory stick, or write it to a CD/DVD

    4) Restore it to the desktop of your infected PC
    and execute it (Scan entire disk).

    5) If you have any problems doin this with your current login (which should be a administrator) try creating a new login with administrator privs, loging in as that new login and follow the same instructions.

    23 February 2010 at 3:25 pm
  • 38 }
    Steve said:

    I was browsing online and then was suddenly hit with the worm…. First time with a virus. on a new laptop to.
    I have no virus block at the moment Ill try to Download Malwarebytes’ Anti-Malware.. (any suggestions) … Thanks….
    It said it is eating it’s way through my computer trying to send credit card info. lookin for passwords
    pop ups kept on appearing with security tool. tried to deleate security tool but just came back so I turned off the computer.

    would someone please find the person
    that started this worm and kick him in the balls.
    greatly appreaciated.

    1 March 2010 at 12:31 am
  • 39 }
    gump said:

    thanks alot peaple you helped me out a shitload…
    i could do shit even lost my background tryed to use avg but it wouldn’t let me. after comeing here i realized i had to start in safe mode do a sys. restore from there then use my avg but it’s done and up in running agen so thanks

    hey dude you find him i’ll hold him down while you kick him in the balls a few times as long as i in black both his eyes. and may break a finger or 2 lol

    13 March 2010 at 4:31 pm
  • 40 }
    Sandra said:

    I have Windows 7 and don’t know how to start it in Safe Mode. It is infested with this virus and I have had no success in downloading malaware either from the internet or from a CD. I would like to try to restore to an earlier date, but it won’t let me change the date either. Help please!

    21 March 2010 at 2:52 am
  • 41 }
    Tammy said:

    im having the same problem as everyoe else. except i cant go on safe mode. when i hit enter to enter safe mode a whole bunch of writing like file names comes up & its there forever unless i turn it off. i need help so bad!! ive tried everything!!!!! what should i do?

    22 March 2010 at 12:08 am
  • 42 }
    Drewski said:

    Well, I did instructions on step 6 and it worked for me. I spent 3 hours trying to find online instructions and after doing step 6 it was back to nornal in 5 mins. Computer place wanted to charge me $130.00 to fix. Thank you.

    31 March 2010 at 5:59 pm
  • 43 }
    martyn said:

    i’ve got this on my laptop it sneaked in through facebook. i have tried everything suggested here and on other sites to no avail. i can’t restore as it’s removed that option. i can’t run any new files as it’s says it got a virus and refuses to play. can anyone help? and reading thought others coments if we find the one responsible i’ll cut his balls off

    1 April 2010 at 1:32 pm
  • 44 }
    martyn said:

    i should also have said i got no option to run in safe mode either

    1 April 2010 at 1:33 pm
  • 45 }
    bradley said:

    m8 just rang me he had this was driving him mad just told him to do system restore took it back to march 8th worked a treat thanks for the info

    6 April 2010 at 6:31 pm
  • 46 }
    Jennifer said:

    I have had all the same problems that everyone has spoken about here! I am currently in safe mode and waiting for the malware to finish as I chose to do all users rather than just mine. I unfortunately am waiting a bit longer than 5 min but that’s okay if it gets rid of the stupid virus! :( In addition I got the worm while being on facebook!!!

    10 April 2010 at 10:46 pm
  • 47 }
    debb said:

    I can not do step 6. I’ve tried numerous times and nothing happens. I’ve tried downloading different virus removers, (spybot, Malware etc) it says it’s downloaded buy it’s not showing up on my computer. I’ve ran a search and nothing is there. I restarted in Safe Mode and ran a Rogers virus scan and it’s still not going away… I’m so frustrated. Please help!

    12 April 2010 at 1:49 pm
  • 48 }
    Bob said:

    12/15/10 – I too was infected. Thanks for all of your comments,but especially to Kenny (#29 & 30). Starting in Safe Mode in Windows 7 worked for me. I did not get the option to be ‘Administrator’, but I was able to access System Restore. I picked a point a couple of days prior to the incident and that solved the problem.

    16 December 2010 at 12:02 pm
  • 49 }
    stephen said:

    read number 6,…it really does work,but put your pc in safe mode first….and im runnin windows xp….

    11 April 2011 at 6:59 pm

Leave your response!

Add your comment below or subscribe to these comments via RSS.
Be nice. Keep it clean. Stay on topic. No spam.