Friends, I have ZoneAlarm installed on several of our test machines and not experiencing these types of problems. Delete all references to ashWebSv.exe from the ZA Application list (Program Control / Programs) and let it recreate the rules. Upon restarting you'll be asked for Server right for ashWebSv.exe and on first access you should be asked for outgoing connection to port 80. But that should be all.
I have reviewed all changes since ver. 4.6.603. I doubt any of these can cause ZoneAlarm not to save it's rules. I even have a strong feeling that none of the changes I can possibly make should cause this unless the firewall is buggy, but that's just my personal opinion.
Also note, that you'll be asked by your FW every time WebShield is updated. Now we are distributing the 4.6.623 update, so you have been asked or should be asked in the near future.
Lukas.