Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

Help, unusual access attempts RE: Zone Alarm

Options
  • 19-12-2005 2:38pm
    #1
    Thomas_S_Hunterson
    Closed Accounts Posts: 6,151 ✭✭✭


    I was just wondering if someone can help me with this. When I log into Windows Xp on my computer, for the first few minutes, I can't access my start menu, i can only start programs from my desktop. Nor can I browse the internet, (I have BT broadband)

    After a few minutes, Zone Alarm brings up a dialog saying that access has been blocked to your computer from 192.111.39.1, which is the name server, and after this my computer functions as normal. Should I add the IP of the name server as a trusted IP or should i allow it to be blocked?


Comments

  • Options
    #2
    nobodythere
    Closed Accounts Posts: 2,349 ✭✭✭nobodythere


    Download Analyser and Winpcap here http://analyzer.polito.it/ , fire it up and look for anything suspicious. I've had Zonealarm really **** with my computer - I guess I had the opposite problem than you, the connection would work for the first 5 minutes after I started up and then it would cut out all HTTP connections. This was nothing to do with any configured firewall rules.

    I found out after running the packet sniffer that after 5 minutes for whatever messed up (suspicious!) reason, Zonealarm would send packets to IP addresses registered to Zone Labs. I.e. I'd go http://google.com and the packet analyser would send a packet with a source IP address of google.com and destination address of an IP registered to Zone Labs.

    That's pretty damn suspicious actually now that I think about it...

    Anyway I uninstalled ZoneAlarm and everything was fine.

    Do me a favour and see if your connection still works outside of HTTP. Click Start -> Run and type
    telnet mail1.eircom.net 25

    (sorry if I'm noobifying you here but i don't really know your level of expertise :))


  • Options
    #3
    Thomas_S_Hunterson
    Closed Accounts Posts: 6,151 ✭✭✭Thomas_S_Hunterson


    That connected no probs, I can work on just about any port i think, i haven't come up against any problems so far


  • Options
    #4
    Raiser
    Registered Users Posts: 4,929 ✭✭✭Raiser


    Quit whining - I'll be finished in a few days, I just want to browse your MP3s and to delete that bit about "Swimming and Tennis" from your CV.


  • Options
    #5
    Thomas_S_Hunterson
    Closed Accounts Posts: 6,151 ✭✭✭Thomas_S_Hunterson


    Lol


  • Options
    #6
    Raiser
    Registered Users Posts: 4,929 ✭✭✭Raiser


    Now aside from me being a smart-arse - have you considered ditching third party firewall software alltogether and using XPs own firewall?

    Lots of people find them buggy and awkward, myself included - they seem to enjoy blocking everything and displaying irritating little messages every 5 min.s - perhaps to justify their pricetag.....


  • Advertisement
  • Options
    #7
    Thomas_S_Hunterson
    Closed Accounts Posts: 6,151 ✭✭✭Thomas_S_Hunterson


    Zone Alarm is free...


  • Options
    #8
    nobodythere
    Closed Accounts Posts: 2,349 ✭✭✭nobodythere


    Would it be a big deal to uninstall zonealarm and see if the problem still persists?


  • Options
    #9
    Martyr
    Closed Accounts Posts: 1,567 ✭✭✭Martyr


    The files being sent to zonelabs are logs of programs that try to access the internet.
    i think the authors use them for analysis.


  • Options
    #10
    Capt'n Midnight
    Moderators, Recreation & Hobbies Moderators, Science, Health & Environment Moderators, Technology & Internet Moderators Posts: 90,974 Mod ✭✭✭✭Capt'n Midnight


    sean_keevey wrote:
    After a few minutes, Zone Alarm brings up a dialog saying that access has been blocked to your computer from 192.111.39.1, which is the name server, and after this my computer functions as normal. Should I add the IP of the name server as a trusted IP or should i allow it to be blocked?
    If it's 53 that's normal for domain servers.


  • Options
    #11
    timeout
    Registered Users Posts: 919 ✭✭✭timeout


    Raiser wrote:
    Now aside from me being a smart-arse - have you considered ditching third party firewall software alltogether and using XPs own firewall?

    Has there not been numerious discussions on here about how **** and useless the windows firewall is?:confused:

    Anyhow, i'd uninstall zonealarm, see what happens for the couple of reboots. Make sure any logs and files are gone from its directory in program Files and then reinstall.

    Thats my 2 cents


  • Advertisement
Advertisement