Help, unusual access attempts RE: Zone Alarm

Thomas_S_Hunterson

I was just wondering if someone can help me with this. When I log into Windows Xp on my computer, for the first few minutes, I can't access my start menu, i can only start programs from my desktop. Nor can I browse the internet, (I have BT broadband)

After a few minutes, Zone Alarm brings up a dialog saying that access has been blocked to your computer from 192.111.39.1, which is the name server, and after this my computer functions as normal. Should I add the IP of the name server as a trusted IP or should i allow it to be blocked?

nobodythere

Download Analyser and Winpcap here http://analyzer.polito.it/ , fire it up and look for anything suspicious. I've had Zonealarm really **** with my computer - I guess I had the opposite problem than you, the connection would work for the first 5 minutes after I started up and then it would cut out all HTTP connections. This was nothing to do with any configured firewall rules.

I found out after running the packet sniffer that after 5 minutes for whatever messed up (suspicious!) reason, Zonealarm would send packets to IP addresses registered to Zone Labs. I.e. I'd go http://google.com and the packet analyser would send a packet with a source IP address of google.com and destination address of an IP registered to Zone Labs.

That's pretty damn suspicious actually now that I think about it...

Anyway I uninstalled ZoneAlarm and everything was fine.

Do me a favour and see if your connection still works outside of HTTP. Click Start -> Run and type
telnet mail1.eircom.net 25

(sorry if I'm noobifying you here but i don't really know your level of expertise )

Thomas_S_Hunterson

That connected no probs, I can work on just about any port i think, i haven't come up against any problems so far

Raiser

Quit whining - I'll be finished in a few days, I just want to browse your MP3s and to delete that bit about "Swimming and Tennis" from your CV.

Thomas_S_Hunterson

Lol

Raiser

Now aside from me being a smart-arse - have you considered ditching third party firewall software alltogether and using XPs own firewall?

Lots of people find them buggy and awkward, myself included - they seem to enjoy blocking everything and displaying irritating little messages every 5 min.s - perhaps to justify their pricetag.....

Thomas_S_Hunterson

Zone Alarm is free...

nobodythere

Would it be a big deal to uninstall zonealarm and see if the problem still persists?

Martyr

The files being sent to zonelabs are logs of programs that try to access the internet.
i think the authors use them for analysis.

Capt'n Midnight

sean_keevey wrote:

After a few minutes, Zone Alarm brings up a dialog saying that access has been blocked to your computer from 192.111.39.1, which is the name server, and after this my computer functions as normal. Should I add the IP of the name server as a trusted IP or should i allow it to be blocked?

If it's 53 that's normal for domain servers.

timeout

Raiser wrote:

Now aside from me being a smart-arse - have you considered ditching third party firewall software alltogether and using XPs own firewall?

Has there not been numerious discussions on here about how **** and useless the windows firewall is?

Anyhow, i'd uninstall zonealarm, see what happens for the couple of reboots. Make sure any logs and files are gone from its directory in program Files and then reinstall.

Thats my 2 cents