# Earthlink, internet explorer and threats from my computer!!! **URL:** \ **Category:** Factual Questions\ **Created:** [May 1, 2004, 7:46pm UTC](https://boards.straightdope.com/t/earthlink-internet-explorer-and-threats-from-my-computer/243032 "2004-05-01T19:46:22Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Alias](https://avatars.discourse-cdn.com/v4/letter/a/a88e4f/32.png) [@Alias](https://boards.straightdope.com/u/Alias)\ **Post date:** [May 1, 2004, 7:46pm UTC](https://boards.straightdope.com/t/earthlink-internet-explorer-and-threats-from-my-computer/243032/1 "2004-05-01T19:46:22Z")
Today, while using my mother’s computer, I had a rather curious and extremely enraging experience. My mother’s pc has earthlink on it, which, if you don’t know, is a lot like AOL. Anyway, the Earthlink interface was irritating me, so I closed the program and switched to plain old Internet Explorer using the same connection from Earthlink. Are you still with me??? Anyway, after being on for about a minute, a message pops up that says there was an error etc, and would I like to send an error report. Regardless of whether or not I send the report, a countdown screen pops up, and says I have one minute to close my programs before the computer shuts down!!! There is no way to close that window, and, as promised, the entire computer will restart after one minute. What is causing this, and how can I stop it? I’ve run ever virus, trojan, and spybot program we have, but I guess it’s something else. I don’t have the exact text of the error window that pops up, but it does mention something being disturbed called lsass.exe CAN SOMEBODY HELP ME??? :mad: :mad: :mad: ---
**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\ **Post date:** [May 1, 2004, 7:52pm UTC](https://boards.straightdope.com/t/earthlink-internet-explorer-and-threats-from-my-computer/243032/2 "2004-05-01T19:52:18Z")
Sounds like you got yourself a variant of the [MSBlaster](http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html) worm. Patch your OS and perform the removal as described. And run a firewall, such as the free ZoneAlarm. ---
**Author:** ![Dog80](https://avatars.discourse-cdn.com/v4/letter/d/6bbea6/32.png) [@Dog80](https://boards.straightdope.com/u/Dog80)\ **Post date:** [May 1, 2004, 7:53pm UTC](https://boards.straightdope.com/t/earthlink-internet-explorer-and-threats-from-my-computer/243032/3 "2004-05-01T19:53:00Z")
You have the Blaster virus! I’ll try to find a previous thread on the subject and post it here. ---
**Author:** ![Dog80](https://avatars.discourse-cdn.com/v4/letter/d/6bbea6/32.png) [@Dog80](https://boards.straightdope.com/u/Dog80)\ **Post date:** [May 1, 2004, 7:54pm UTC](https://boards.straightdope.com/t/earthlink-internet-explorer-and-threats-from-my-computer/243032/4 "2004-05-01T19:54:55Z")
Try this: [http://boards.straightdope.com/sdmb/showthread.php?t=250747&highlight=blaster](http://boards.straightdope.com/sdmb/showthread.php?t=250747&highlight=blaster) ---
**Author:** ![JRootabega](https://avatars.discourse-cdn.com/v4/letter/j/8e7dd6/32.png) [@JRootabega](https://boards.straightdope.com/u/JRootabega)\ **Post date:** [May 1, 2004, 8:29pm UTC](https://boards.straightdope.com/t/earthlink-internet-explorer-and-threats-from-my-computer/243032/5 "2004-05-01T20:29:47Z")
I think this does not sound like Blaster. It sounds like a brand new worm called Sasser. Here is some info: [http://www.microsoft.com/security/incident/sasser.asp](http://www.microsoft.com/security/incident/sasser.asp) > **[Symantec Security Center](https://www.broadcom.com/support/security-center)** > > Symantec security research centers around the world provide unparalleled analysis of and protection from IT security threats that include malware, security risks, vulnerabilities, and spam. Some are calling this worm “Blaster-like”. It is blaster-like in that it is a worm that exploits a vulnerability in Windows. But it is a different vulnerability. This is the Sasser vulnerability: [http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx](http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx) This is the Blastr vulnerability: [http://www.microsoft.com/technet/security/bulletin/MS03-026.mspx](http://www.microsoft.com/technet/security/bulletin/MS03-026.mspx) ---
**Author:** ![FatBaldGuy](https://avatars.discourse-cdn.com/v4/letter/f/ecd19e/32.png) [@FatBaldGuy](https://boards.straightdope.com/u/FatBaldGuy)\ **Post date:** [May 1, 2004, 8:36pm UTC](https://boards.straightdope.com/t/earthlink-internet-explorer-and-threats-from-my-computer/243032/6 "2004-05-01T20:36:30Z")
Don’t blame Earthlink. I’m using Earthlink (DSL) and have never used their interface. I always go directly to IE and have never had any problems. Sounds like you have one of the worms people have been describing. ---
**Author:** ![Alias](https://avatars.discourse-cdn.com/v4/letter/a/a88e4f/32.png) [@Alias](https://boards.straightdope.com/u/Alias)\ **Post date:** [May 1, 2004, 10:23pm UTC](https://boards.straightdope.com/t/earthlink-internet-explorer-and-threats-from-my-computer/243032/7 "2004-05-01T22:23:21Z")
I’m sorry. I didn’t mean to blame Earthlink. I just didn’t know what could be causing the problem. After I was kicked off the last time, I tried going online with JUST Earthlink, and the same think happened. I don’t blame Earthlink. I’m going to have to find a way to get the patches onto my mom’s computer without using her internet. The connection is terminated long before any program or patch would have time to download. Any suggestions of how I can put it on a disk or CD rom? By the way, I don’t have a decent CD burn software that isn’t music-related. Recommendations? ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [May 1, 2004, 11:34pm UTC](https://boards.straightdope.com/t/earthlink-internet-explorer-and-threats-from-my-computer/243032/8 "2004-05-01T23:34:40Z")
To prevent shutdown, you must shutdown the malicious processes: [Removal instructions from Symantec:](http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html) > [@](#): > > Press **Ctrl+Alt+Delete** once. > Click **Task Manager**. > Click the **Processes** tab. > Double-click the Image Name column header to alphabetically sort the processes. > Scroll through the list and look for the following processes: > **avserve.exe** > any process with a name consisting of 4 or 5 digits followed by \_up.exe (eg 74354\_up.exe). > If you find any such process, click it, and then click **End Process**. > Exit the Task Manager. Then you must [disable System Restore](http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm) Then download [Network Associates’ Stinger virus removal tool](http://vil.nai.com/vil/stinger/), and scan your C:\ drive to remove the Sasser virus.