Am I infected? (ZoneAlarm)

[Nils]

Hi,

I was on Direct Connect downloading some files over the night through my
ADSL-connection. In the morning I noticed that my browser was lagging. It's
very unresponsive and slow. For example, when I use the scrollbar to scroll
up or down on a website, the site moves in a stuttering way, not smooth like
it used to. My former startpage www.expressen.se causes my browser (IE6) to
freeze and that's the only site I've found to do so (strange). Also, when
typing this message there's a lag between my keystroke and when the
characther appears on the screen. Not big but noticable. When positioning
the mousepointer over a link, there's a lag until the arrow changes to a
hand etc.
I tried various free virusscanners but they haven't found anything. Then I
installed ZoneAlarm and every minute or so it reports that various
IP-adresses is trying to ping me, mostly adresses within my ISP-s domain.
Has someone managed to place - I don't know the term for it - some software
on my computer that uploads my file's somewhere?
If you think so, how do I get rid of it? I use w98 BTW, so it can't be the
BlasterWorm. I've tried scandisc and defragging to see if that would speed
things up, to no avail.

Best regards,

Nils, Sweden

 

[StarScripter]

==> *Nils* from: (e-mail address removed)
==> scribbled in: [email protected]

Hi,

I was on Direct Connect downloading some files over the night through my
ADSL-connection. In the morning I noticed that my browser was lagging.
It's very unresponsive and slow. For example, when I use the scrollbar to
scroll up or down on a website, the site moves in a stuttering way, not
smooth like it used to. My former startpage www.expressen.se causes my
browser (IE6) to freeze and that's the only site I've found to do so
(strange). Also, when typing this message there's a lag between my
keystroke and when the characther appears on the screen. Not big but
noticable. When positioning the mousepointer over a link, there's a lag
until the arrow changes to a hand etc.
I tried various free virusscanners but they haven't found anything. Then I
installed ZoneAlarm and every minute or so it reports that various
IP-adresses is trying to ping me, mostly adresses within my ISP-s domain.
Has someone managed to place - I don't know the term for it - some
software on my computer that uploads my file's somewhere?
If you think so, how do I get rid of it? I use w98 BTW, so it can't be the
BlasterWorm. I've tried scandisc and defragging to see if that would speed
things up, to no avail.

Best regards,

Nils, Sweden

Hi,
It's the w32.welchia worm looking for the msblaster worm to try and remove
it. So the whole planet is being scanned, it's like the blind leading the
blind.
More info here:
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html
and here:
http://vil.nai.com/vil/content/v_100559.htm
HTH

 

[FromTheRafters]

[snip]

I don't know the term for it - some software
on my computer that uploads my file's somewhere?
If you think so, how do I get rid of it? I use w98 BTW, so it can't be the
BlasterWorm.

Is Win98 somehow incapable of hosting the blaster worm?

After an unattended overnight download on Win98, something
could have happened. A blaster variant may be responsible for
the probes, but the slowdown might be something else.

 

[hop-head]

I'd recommend you start with a good virus scan, a scan with AdAware
and a scan with Hijack This to look for possible causes. They won't
necessarily find all possible causes, but they'll be a good start.