 An unexpected clearing of the log would likely be a red flag to system administrators that an intrusion had occurred.Winzapper would allow a hacker to hide the intrusion by deleting only those log events relevant to the attack.Winzapper, as publicly released, lacked the ability to be run remotely without the use of a tool such as Terminal Services.