Suzuko
June 20th, 2004, 11:22 AM
Last night my computer started behaving strangely, everything froze up and when I tried to close some windows about two dozen small gray windows opened, one after the other in a cascade, all saying the same thing, something about Visual Basic C++ runtime errors.
I could not shut anything down the normal way so I tried to use the Task Manager, but after hitting Ctrl+Alt+Del an error message came up saying Task Manager has created errors and will be closed by Windows. After clicking OK on the Task Manager error message, ALL the open windows closed, AND Zone Alarm Pro vanished from the tray.
At this point I disconnected from the internet and reopened ZA to look at the Alerts log. Lo and behold, it showed there were hundreds upon hundreds of attempts by "explorer.exe" to make an outgoing connection to a certain IP address and "gawab.com" which is a web-based free email service.
Fortunately I had just updated all my security apps - NAV, Spybot S&D, AdAware, PestPatrol and SpySweeper - and ran full system scans with each of them in sequence. Nothing very bad came up until I ran SpySweeper, which found "Acid Shivers" trojan horse and "Sc-keylog". I thought it was odd that PestPatrol or Spybot didn't find these.
Before allowing SpySweeper to make any changes, I looked up how to remove those two pests. None of the files or registry entries they are supposed to add were present on the computer. And SpySweeper said it's going to remove these registry entries which were not present in the registry when I searched for them. I let SS do its thing anyway.
Now, the really strange thing is that according to what I read about "Acid Shivers" it first of all doesn't run under Windows2000 (well, maybe there's a "new and improved" version?) and secondly, even though I could find no evidence of the program anywhere in my computer, the behavior reported in the ZA Alerts seemes to indicate that this pest was indeed present.
So now I have no idea WTF is going on. Can anyone tell me?
I could not shut anything down the normal way so I tried to use the Task Manager, but after hitting Ctrl+Alt+Del an error message came up saying Task Manager has created errors and will be closed by Windows. After clicking OK on the Task Manager error message, ALL the open windows closed, AND Zone Alarm Pro vanished from the tray.
At this point I disconnected from the internet and reopened ZA to look at the Alerts log. Lo and behold, it showed there were hundreds upon hundreds of attempts by "explorer.exe" to make an outgoing connection to a certain IP address and "gawab.com" which is a web-based free email service.
Fortunately I had just updated all my security apps - NAV, Spybot S&D, AdAware, PestPatrol and SpySweeper - and ran full system scans with each of them in sequence. Nothing very bad came up until I ran SpySweeper, which found "Acid Shivers" trojan horse and "Sc-keylog". I thought it was odd that PestPatrol or Spybot didn't find these.
Before allowing SpySweeper to make any changes, I looked up how to remove those two pests. None of the files or registry entries they are supposed to add were present on the computer. And SpySweeper said it's going to remove these registry entries which were not present in the registry when I searched for them. I let SS do its thing anyway.
Now, the really strange thing is that according to what I read about "Acid Shivers" it first of all doesn't run under Windows2000 (well, maybe there's a "new and improved" version?) and secondly, even though I could find no evidence of the program anywhere in my computer, the behavior reported in the ZA Alerts seemes to indicate that this pest was indeed present.
So now I have no idea WTF is going on. Can anyone tell me?