Three days ago, I had an issue that may be a security breach, but I am not sure, so I would like to ask for your help to find out.
When I was shutting down my computer and closing programs from the task bar, all of a sudden numerous windows popped up (at least 30 or so). Most of them seemed to be all kinds of instances of communication programs that I have in the task bar tray (although I did not click anything there), but some had unfamiliar names. Zone Alarm brought up one of those red alert messages stating that a VPN connection was now ready for use. The message apparently gave me two options to choose from and a button to press, but the message itself was blank, so I could not see what the options were and therefore didn't press anything. To my knowledge, I do not use VPN (this is my home computer). Also at the same time, my CPU was running at 100% and the process accounting for that CPU usage was "hpqtra08.exe", which should be just a process for my printer. My first instinct was to disconnect the router to kill my internet connection and having done that, I shut down all running processes by rebooting.
In my Zone Alarm log, for Alert Type OS Firewall I found several messages that said "Windows Explorer was prevented from changing the behavior of ZoneAlarm Security Suite by modifying the file: ZLDIR*". Also, the next day I again had numerous windows pop up when I was just clicking something on the task bar (just a normal left click on a legitimate open program), but this time no mention of a VPN connection.
Now, I'm confused about whether somebody compromised my system and if so, whether he's still on there. What can I do to find out? I could post the hijackthis log, but I was concerned the post would get too long.
Operating System:Windows XP Pro
Product Name:ZoneAlarm Internet Security Suite