Lsas.Blaster.Keylogger is a fake threat that appears in a phony security alert from rogue antispyware Virus Fighter. This Lsas.Blaster.Keylogger popup reads:
“Attention! Keyloger virus infection
Lsas.Blaster.Keylogger is suspected to have infected your PC. This type of virus intercepts the entered data and transmits it to remote server.
Attention! Privacy information can be transmitted
- Credt card details | Transfered detected
- Personal logins and passwords | Transfered detected
- Browsing habits
- Email accounts
Data interceptions was detected while visiting site:
www.bigtits.com
Ignore (Not Recommended) [or] Protect (Recommended)”
Click “Ignore” until your mouse breaks. But that won’t make this Lsas.Blaster.Keylogger popup disappear.
Let me show you how to get rid of Lsas.Blaster.Keylogger — and Virus Doctor — , for free.
GET RID of Lsas.Blaster.Keylogger
- Manually remove Lsas.Blaster.Keylogger with step-by-step instructions
- Download Spyware Doctor to automatically remove Lsas.Blaster.Keylogger
- You can download award-winning, anti-badware software SpywareDoctor to easily remove Lsas.Blaster.Keylogger. Want to know why I dig SpywareDoctor? Read my review.
Do You Have Lsas.Blaster.Keylogger?
When you’re infected with badware — whether it’s Lsas.Blaster.Keylogger, spyware, adware, a Trojan, or a virus — there are a few key symptoms. Have you noticed…
- Slow computer performance: It just takes one parasite like Lsas.Blaster.Keylogger to slow your computer dramatically. If your PC takes longer than usual to reboot, or if your Internet connection is unusually slow, you may be infected with Lsas.Blaster.Keylogger.
- New desktop shortcuts or switched homepage: Badware like Lsas.Blaster.Keylogger may change your Internet settings to redirect your homepage to another site. Badware can even add desktop shortcuts to your PC.
- Annoying popups: Badware can bombard your computer with popup ads, even when you’re not online. Through these popups, you may be tricked into downloading more spyware.
How to Remove Lsas.Blaster.Keylogger Manually
Before we get started, you should backup your system and your registry, so it’ll be easy to restore your computer if anything goes wrong.
To remove Lsas.Blaster.Keylogger manually, you need to delete Lsas.Blaster.Keylogger files. Not sure how to delete Lsas.Blaster.Keylogger files? Click here, and I’ll show you. Otherwise, go ahead and…
Block Lsas.Blaster.Keylogger sites:
http://www.virusdoctor-online.com
Stop Lsas.Blaster.Keylogger processes:
c:\Documents and Settings\All Users\Application Data\927e\VDoca582.exe
Delete Lsas.Blaster.Keylogger DLLs:
c:\Documents and Settings\All Users\Application Data\927e\sqlite3.dll
Remove Lsas.Blaster.Keylogger files:
c:\Documents and Settings\All Users\Application Data\927e\unins000.dat
c:\Documents and Settings\All Users\Application Data\927e\Languages
c:\Documents and Settings\All Users\Application Data\System Data Configuration\config.cfg
c:\Documents and Settings\All Users\Application Data\System Data Configuration\DB.ini
c:\Documents and Settings\All Users\Application Data\System Data Configuration\fsvd6398.db
%UserProfile%\Application Data\Virus Doctor
%UserProfile%\Application Data\Virus Doctor\settings.ini
%UserProfile%\Application Data\Virus Doctor\uill.ini
%UserProfile%\Desktop\Virus Doctor.lnk
%UserProfile%\Start Menu\Virus Doctor.lnk
%UserProfile%\Start Menu\Programs\Virus Doctor.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Virus Doctor.lnk
c:\Documents and Settings\All Users\Application Data\927e\Languages\VDDe.lng
c:\Documents and Settings\All Users\Application Data\927e\Languages\VDFr.lng
c:\Documents and Settings\All Users\Application Data\927e\Languages\VDIt.lng
c:\Documents and Settings\All Users\Application Data\927e\System Data Configuration
c:\Documents and Settings\All Users\Application Data\927e\System Data Configuration\DBInfo.ver
c:\Documents and Settings\All Users\Application Data\927e\System Data Configuration\vd952342.bd
c:\Documents and Settings\All Users\Application Data\System Data Configuration
Get rid of Lsas.Blaster.Keylogger registry keys:
%UserProfile%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Doctor_is1
%UserProfile%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “URVDoc[]”
Get rid of Lsas.Blaster.Keylogger folders:
Note: In any Lsas.Blaster.Keylogger files I mention above, “%UserProfile%” is a variable referring to your current user’s profile folder. If you’re using Windows NT/2000/XP, by default this is “C:\Documents and Settings\[CURRENT USER]” (e.g., “C:\Documents and Settings\JoeSmith”). If you have any questions about manual Lsas.Blaster.Keylogger removal, go ahead and leave a comment.
How Do You Remove Lsas.Blaster.Keylogger Files?
Need help figuring out how to delete Lsas.Blaster.Keylogger files? While there’s some risk involved, and you should only manually remove Lsas.Blaster.Keylogger files if you’re comfortable editing your system, you’ll find it’s fairly easy to delete Lsas.Blaster.Keylogger files in Windows.
How to delete Lsas.Blaster.Keylogger files in Windows XP and Vista:
- Click your Windows Start menu, and then click “Search.”
- A speech bubble will pop up asking you, “What do you want to search for?” Click “All files and folders.”
- Type a Lsas.Blaster.Keylogger file in the search box, and select “Local Hard Drives.”
- Click “Search.” Once the file is found, delete it.
How to stop Lsas.Blaster.Keylogger processes:
- Click the Start menu, select Run.
- Type taskmgr.exe into the the Run command box, and click “OK.” You can also launch the Task Manager by pressing keys CTRL + Shift + ESC.
- Click Processes tab, and find Lsas.Blaster.Keylogger processes.
- Once you’ve found the Lsas.Blaster.Keylogger processes, right-click them and select “End Process” to kill Lsas.Blaster.Keylogger.
How to remove Lsas.Blaster.Keylogger registry keys:
Because your registry is such a key piece of your Windows system, you should always backup your registry before you edit it. Editing your registry can be intimidating if you’re not a computer expert, and when you change or a delete a critical registry key or value, there’s a chance you may need to reinstall your entire system. Make sure your backup your registry before editing it.
- Select your Windows menu “Start,” and click “Run.” An “Open” field will appear. Type “regedit” and click “OK” to open up your Registry Editor.
- Registry Editor will open as a window with two panes. The left side Registry Editor’s window lets you select various registry keys, and the right side displays the registry values of the registry key you select.
- To find a registry key, such as any Lsas.Blaster.Keylogger registry keys, select “Edit,” then select “Find,” and in the search bar type any of Lsas.Blaster.Keylogger’s registry keys.
- As soon as Lsas.Blaster.Keylogger registry key appears, you can delete the Lsas.Blaster.Keylogger registry key by right-clicking it and selecting “Modify,” then clicking “Delete.”
How to delete Lsas.Blaster.Keylogger DLL files:
- First locate Lsas.Blaster.Keylogger DLL files you want to delete. Open your Windows Start menu, then click “Run.” Type “cmd” in Run, and click “OK.”
- To change your current directory, type “cd” in the command box, press your “Space” key, and enter the full directory where the Lsas.Blaster.Keylogger DLL file is located. If you’re not sure if the Lsas.Blaster.Keylogger DLL file is located in a particular directory, enter “dir” in the command box to display a directory’s contents. To go one directory back, enter “cd ..” in the command box and press “Enter.”
- When you’ve located the Lsas.Blaster.Keylogger DLL file you want to remove, type “regsvr32 /u SampleDLLName.dll” (e.g., “regsvr32 /u jl27script.dll”) and press your “Enter” key.
That’s it. If you want to restore any Lsas.Blaster.Keylogger DLL file you removed, type “regsvr32 DLLJustDeleted.dll” (e.g., “regsvr32 jl27script.dll”) into your command box, and press your “Enter” key.
Did Lsas.Blaster.Keylogger change your homepage?
- Click Windows Start menu > Control Panel > Internet Options.
- Under Home Page, select the General > Use Default.
- Type in the URL you want as your home page (e.g., “http://www.homepage.com”).
- Select Apply > OK.
- You’ll want to open a fresh web page and make sure that your new default home page pops up.
Lsas.Blaster.Keylogger Removal Tip
Is your computer acting funny after deleting any Lsas.Blaster.Keylogger files? I recommend using a program like File Recover from PC Tools. File Recover saves deleted files that otherwise can’t be recovered by Windows operating sytem.
Want to save time finding Lsas.Blaster.Keylogger files? Download Spyware Doctor, let it find the Lsas.Blaster.Keylogger files for you, and then manually delete Lsas.Blaster.Keylogger files.
How Did You Get Lsas.Blaster.Keylogger?
Wondering how Lsas.Blaster.Keylogger ended up on your PC? If you’re infected with Lsas.Blaster.Keylogger or other badware, perhaps you were using…
- Freeware or shareware: Did you download and install shareware or freeware? These low-cost or free software applications may come bundled with spyware, adware, or programs like Lsas.Blaster.Keylogger. Sometimes adware is attached to the free software to “pay” developers for the cost of creating the software, and more often spyware is secretly attached to free software to harm your computer and steal your personal and financial information.
- Peer-to-peer software: Do you use a peer-to-peer (P2P) program or other application with a shared network? When you use these applications, you put your system at risk for unknowingly downloading an infected file, including applications like Lsas.Blaster.Keylogger.
- Questionable websites: Did you visit a website that’s of questionable nature? When you visit malicious sites that are fishy and phishy, badware may be automatically downloaded and installed onto your computer, sometimes including applications like Lsas.Blaster.Keylogger. I recommend you use Firefox web browser, if you don’t already.
Understanding Lsas.Blaster.Keylogger
If you’re infected with Lsas.Blaster.Keylogger, you should know what you’re fighting. I’ll explain some definitions related to Lsas.Blaster.Keylogger.
Lsas.Blaster.Keylogger May Be Rogue Anti-Spyware
Rogue anti-spyware refers to anti-spyware/antivirus software of questionable value. Rogue anti-spyware may not be proven to protect your computer from spyware, may popup fake alerts or create many false positives about your PC being infected, or may use scare tactics to try to get you to purchase the application. Rogue anti-spyware software may be installed by a Trojan, come bundled with other software, or install itself through web browser security holes. While it is fairly rare, some rogue anti-spyware is created and distributed by known spyware or adware companies, and the rogue anti-spyware may install spyware or adware itself.
Often when you’re infected with rogue anti-spyware like Lsas.Blaster.Keylogger, you’ll see a false popup security alert like this:

Rogue Anti-Spyware Tactics
Typically, rogue anti-spyware such as Lsas.Blaster.Keylogger has one or more of the qualities listed below, which is why rogue anti-spyware is considered anti-spyware software of questionable value.
- False positives/fake alerts: Rogue anti-spyware may produce a large number of false positives or use fake alerts, noting that your computer is infected with spyware parasites or other threats that do not really exist.
- Copycat looks: Rogue anti-spyware may copy the look and feel of other legitimate or rogue anti-spyware applications. Often, rogue anti-spyware applications may appear as close clones of other rogue anti-spyware software.
- High pressure marketing: Rogue anti-spyware may use scare tactics or other aggressive advertising and marketing tactics to try to trick you into buying the rogue anti-spyware application. Often, rogue anti-spyware may produce false positives and fake alerts about your computer being infected.
- Poor detection/scan reporting: Rogue anti-spyware may produce poor reports when it scans your PC. For example, rogue anti-spyware may say your computer is infected 11 parasites, but not specify which spyware parasites or what type of parasites. Rogue anti-spyware may also report that your PC is infected with SafeAndClean, but not tell you which related files, DLLS, etc. were found on your computer.
- Weak scanning/detection: Rogue anti-spyware may not only poorly report on computer infection, but rogue antispyware may also poorly scan your PC. Rogue anti-spyware may skip over important folders and files of your computer that should be scanned to detect spyware.
Did Lsas.Blaster.Keylogger use these tactics to trick you into buying Lsas.Blaster.Keylogger?
Lsas.Blaster.Keylogger May Be a Trojan
Trojans install themselves secretly onto your computer, most often through your downloading a simple email attachment (often Trojans pose as harmless pictures). Most Trojans are able to gain complete control over your PC after installation. With this control, the Trojan and the hacker behind it may change your system settings, delete important files, steal your passwords, and watch your computer acitivity.
Infection Methods of Lsas.Blaster.Keylogger and Other Trojans
Most Trojans infect your computer by tricking you into launching an infected file. This poisoned file could disguised as a small file, such as a jpeg or other email attachment, or it might be downloaded via a website or FTP.
- Email: Your PC may be infected with a Trojan when you download infected email attachments, or sometimes even when you simply open an email. Many Trojans exploit security holes in Microsoft Outlook. You may be able to reduce your chances of getting infected by a Trojan by using a spam-blocking software.
- Websites: Your PC may be infected with a Trojan when you visit a rogue site. Many Trojans exploit security holes in Internet Explorer web browser so that by simply visiting a website you may unknowingly download a Trojan.
- Open ports: If your computer runs programs that provide file-sharing functions – such as AOL Instant Messenger (AIM), MSN Messenger, and more – you may open your computer up to vulnerabilities. Using file sharing through these applications may create a network that gives attackers the opportunity to remotely access your computer.

Traduzca al Español
Übersetzen Sie zum Deutsch
Traduisez au Français
Traduca ad Italiano
Vertaal aan het Nederlands
Μεταφράστε στα ελληνικά
Översätta till Svensk
ترجمة الى العربية
中文翻译
한국어에게 번역하십시오
日本語に翻訳しなさい
Traduza ao Português
Переведите к русскому
please help me i cant removed this virus . Lsas . i try many thinks but i cant do please help me step by step .
My computer has started with Lsas.Blaster.Keylogger messages today. I’ve tried finding the files manually using the Search method with no joy. I’ve tried downloading software and as soon as I hit run, I get the error message. I’ve also tried the F8 method when the computer is booting up and I can’t get there. Any other suggestions?
I had the same problem as everyone else with this keylogger virus or worm or trojan or whatever it is. Couldn’t remove it till I found the 411 site which suggested going into safe mode and doing a restore. Since the problem just started today, I restored to a point a couple of days ago, and then I installed the free Microsoft Security Essentials. Once installed, it scanned the drive. Everything is now working fine, and I hope it stays that way. But I really appreciate the help provided on the 411-spyware site. Thanks
I too had the same problem with my laptop. Lsas trojan will prevent any attempts to clear it from the system registry, dll, taskmanager. Any attempts to install or run other antivirus/malware was prevented. I followed Anne’s steps by rebooting in Safe Mode and using System Restore and used a good know last restore point. It worked great, no popups no blocking. My laptop rebooted in normal mode, althought Anne said she did a reboot in Normal mode. I installed Microsoft Essential Security(free no trial) and ran full scan. It immediately located all viruses and eliminated them. Thanks Anne for input and 411 for this site…Anthony
I was unable to open any programs or move around at all. I kept getting warnings that the worm had infected whatever file I tried to open. I was able to boot up in safe mode (Win XP). Once I was there I went to system restore and set the computer back to the last restore point. When I rebooted and went back to normal mode, the pop ups were gone. I then downloaded Adaware and it removed the program that was holding my computer hostage. It no longer showed up in my list of programs and I haven’t seen it since.
I am at work I have experience removing viruses and this one will not go away..I followed all steps and methods including the ones I know…It will not open taskmgr or registry…I can’t start in safe mode or use dos….
I switched over to Safe Mode – networking and ran Spybot as well as the free AVG the Spybot got rid off all the trojans and worm but when i switched back to normal mode the Security Tool still pops up and it’s even on my task bar and i can’t get rid of it. I can’t get into Run mode or use Ctrl + Shift + Esc as it’s been infected with worm and i did a search on lsas.blaster.keylogger on my local drive and nothing came up.
Can you please help me get rid of this i’m trying to do this manually but i can’t get in to ‘run’ to delete the register
Thank you
Liz
When ever I try to install this “Download Spyware Doctor to automatically remove Lsas.Blaster.Keylogger” it says it’s been infected by a worm. How can I get this worm off my computer?
I couldn’t access my task mgr either. It kept disappearing. I downloaded Spy Doctor on a USB and installed it in Safe Mode under an account that wasn’t infected. Like you, it only infected one account. Spy Doctor found the threat and eliminated it. None of the other sugestions worked for me but this did the trick!
I got the “Security Tool” today. It was saying that 48 threats/viruses were found and all this other mumba jumba. Does hitting F8 before the computer fully loads (making it go into safe mode) and then hitting enter to get into your desktop, then running Norton Antivirus & Spyware detector or whatever it is, actually fix it? Because all my desktop icons have completely disappeared & it’s only under my name (Windows XP Vista seperate accounts thing). My brother’s & dad’s accounts are fine. PLEASE HELP!!
Rebooted to Safe Mode with networking. downloaded AVG free, installed full trial version (can revert to free at the end of the 30 day trial) , ran. Problem solved.
This thing is driving me round the twist!!! It’s popping up every five minutes, putting me on dodgey websites and won’t let me install any anti-virus software!
I read over your instructions of how to manually remove this P.O.S. and tried but when I try to open up task manager it will flash on the screen for a milli-second and disappear. This infection seems to be preventing me from gaining access to it – - same goes with System restore and when I try to download anything that might help to eliminate it. Do you have any ideas of how I can proceed?
Hi,
My laptop runs Win XP and has got infected with Lsas.Blaster.Keylogger. I got the same pop ups and it also changed my desktop into a message saying my computer is infected with virus, worms, spyware softwares etc. I started manual scan using Norton antivirus and also used trial version of Spyware Doctor that caught a few adwares and cleaned them. But the annoying pop-ups kept appearing. Later when I restarted my laptop, my antivirus, Spyware Doctor, and other programs donot run. THe message I get is that the particular exe file was deleted and could not be found.
I am afraid of losing my data.
Will the manual steps mentioned by you will help me get rid of this infection? Also, do I need to re-install all the programs like anti-virus that it claims to have deleted now?
Kindly, suggest.
I tried a lot of different ideas, but the only one that worked for me was restarting the computer and hitting F8 before it fully loaded. This took me into Safe Mode. I then hit Enter and that brought me to my Desktop. I had prevously saved Adaware, but Spy Doctor is also very good. I ran Adaware, a free spyware program, and it caught the spyware and deleted it. This allowed my antivirus program to work again and I then ran that. I updated both programs first before I ran them.
This solved my terrible problem.
I followed the instructions to remove the lsas keyblocker, when I got to the point of ending the procesdsafter typing taskmgr and finding lsas, clicking on it to remove it, it would not let me, it said it was a critical programand could not end. Now what?
Thank you