Unable to ID what's running in background periodically...

[Atreyu]

I am still running Win98 with all the updates and patches available before
MS stopped supporting it. I am running Zone Alarm, Grisoft's AVG,
SpywareBlaster, AdAware (free vers.), and SpyBotS&D.

My question: I have noticed internet activity (sending & receiving) via
ZA's icon in the SysTray and when I look to see if it's giving me any info
about it, I see nothing. Also have installed a small monitor program that
shows the activity to be "low level," i.e, in the maximum range of about
12-15 Kb/sec. When I catch the activity which seems to occur randomly, I
use the "STOP Internet Activity" function on Zone Alarm, or I disconnect
from the Internet. Oh yeah, I still have dial-up. ( This is something I
have not noticed until recently, and I'm a fairly vigilant user; so I think
this activity began only recently.

Last night I ran both AdAware and Spybot in safe mode; neither found
anything. Also, late this past week, an AVG scan identified and quarantined
a file it called Trojan Horse Java/ClassLoader. The actual file name was
cnt1_sttcgtd.jar-4c4993ac-4e751fee.zip. I looked in the folder where AVG
discovered this file and found another file by the same name but with an
..idx file extenstion. So this may be a clue.

Further, I use Yahoo Messenger from time to time and it's not the most
current version. Hence when I open Y!Messenger, I get a nag notice to
upgrade...something I'm resisting at the moment since that program has
become more and more bloated with features I don't have any use for. So I
close that nag notice choosing NOT to download the "new & improved" version.

My question after all this exposition is: How can I find out what is
causing the internet activity? I have left it alone for up to a
minute-and-a-half to see if it will stop, but it hasn't within that
duration. Of course I fear that whatever the activity is, it is untoward.
It's not anything I am initiating since I notice it whenever I'm not doing
anything in particular with any of the programs I may have open at the time
of the activity. I'm wondering if Yahoo is trying to install it's latest
Messenger version surrepticiously despite my closing the nag notice, or what
else it may be.

Does anyone have any ideas how to identify the origin of this internet
activity? I apologize for my wordiness.

Many thanks in advance to any and all who share their thoughts.


========================
"You have more freedom than you're using." - Gleaned from the Internet
------------------------------------------------
"Sufficiently advanced incompetence is indistinguishable from malice."
------------------------------------------------
"Those who would give up essential liberty to purchase a little temporary
safety, deserve neither liberty nor safety."
------------------------------------------------
Thesis > Antithesis > Synthesis

[Anubis Konstanty]

On Sun, 19 Aug 2007 1819 -0400, Atreyu wrote

> <snip> what is causing the internet activity?

Does TCPView
<http://www.microsoft.com/technet/sysinternals/utilities/tcpview.mspx>
show anything?

-- Anubis Konstanty

[Anubis Konstanty]

On Sun, 19 Aug 2007 1819 -0400, Atreyu wrote

> <snip> called Trojan Horse Java/ClassLoader.

Visiting a malicious web page that contains the trojan would
do it. The applet gains the same access as any other executable by
exploiting a vulnerability in the Java runtime. Usually to download
additional malware.

-- Anubis Konstanty

[Atreyu]

Thanks, AK! I'll download and run this promisingly sweet little utility.
Truly appreciate your input. )

--
========================
"You have more freedom than you're using." - Gleaned from the Internet
------------------------------------------------
"Sufficiently advanced incompetence is indistinguishable from malice."
------------------------------------------------
"Those who would give up essential liberty to purchase a little temporary
safety, deserve neither liberty nor safety."
------------------------------------------------
Thesis > Antithesis > Synthesis
"Anubis Konstanty" <anubiskonstanty@fion.invalid> wrote in message
news:46c90fc6.258524615@news.sf.sbcglobal.net...
> On Sun, 19 Aug 2007 1819 -0400, Atreyu wrote
>
> > <snip> what is causing the internet activity?
>
> Does TCPView
> <http://www.microsoft.com/technet/sysinternals/utilities/tcpview.mspx>
> show anything?
>
> -- Anubis Konstanty

[Atreyu]

Thanks for succintly explaining this. I had a vague idea of how this works,
but you clearly stated the situation for me. ) I appreciate your time
and thoughts.

--
========================
"You have more freedom than you're using." - Gleaned from the Internet
------------------------------------------------
"Sufficiently advanced incompetence is indistinguishable from malice."
------------------------------------------------
"Those who would give up essential liberty to purchase a little temporary
safety, deserve neither liberty nor safety."
------------------------------------------------
Thesis > Antithesis > Synthesis
"Anubis Konstanty" <anubiskonstanty@fion.invalid> wrote in message
news:46ca17b2.260552827@news.sf.sbcglobal.net...
> On Sun, 19 Aug 2007 1819 -0400, Atreyu wrote
>
> > <snip> called Trojan Horse Java/ClassLoader.
>
> Visiting a malicious web page that contains the trojan would
> do it. The applet gains the same access as any other executable by
> exploiting a vulnerability in the Java runtime. Usually to download
> additional malware.
>
> -- Anubis Konstanty