Zone Alarm help. Please!!

[CharleyO]

***

Bill,

You should see the below when you open up the ZA user interface. Notice at the bottom in the "Entry Detail" box that zlclient.exe is listed.

[bob3160]

all used there Own Updater including  Ewido

Of course they do but, they are still monitored by ZA or what ever other Firewall you're using.
ZA controls wether or not the programs update server is allowed to connect to the net.

[DavidR]

   I hate to ruin the Party but I think You have Malware. All of My Programs Update using there Own Updater. ZLclient has not been on My Program List for Months. I hit Manual Update to put it on Program List . I Ran 4 Security Updates. all used there Own Updater including  Ewido.

ZLclient isn't doing the updates, it is getting the DNS IP address information. The only reason emy80 is seeing this activity is because she has created a rule to have all activity reported.

I set the rules for the programs i have. I let all the Avast .exe files to access the net but as for the Zone Alarm client zlclient.exe I set a rule where it should ask me for every action.

A google search as has also be said returns many hit and a quick look shows this to be a part of zone alarm.

emy80 also comes to this thread having done an extensive malware search in the recent past.

[emy80]

ZLclient isn't doing the updates, it is getting the DNS IP address information. The only reason emy80 is seeing this activity is because she has created a rule to have all activity reported.

Did I created a rule? I didn't know. i just left the default setting of ZA. the only thing i touched is not to notify me of every attempt of access (it would be difficoult to work with a pop out asking me for an action every five seconds) and putting on hight the setting in the Firewall --> Trusted Zone Security.
Do I need to be worried? I did a Symantec security check and it says all my port are Stealthed so I don't think there is something bad accessing the net using my firewall. On the contrary, it seems like ZA is working.
As for the ewido.net DNS this doesn't concern me. but Is it normal to have other DNS that are not linked to the programs I have on the pc? For example pic.greatestjournal.com? I don't even know when I visited it. must be an image linked in a page I was visiting.
I still have Ewido in is trial version, meaning I still have the real time protection enabled. So if it was a malware i think it would have detected it.
As for the scans, yes, I used all the softwares I have to scan my pc. i did an on-line scan yesterday morning with Trend Micro too. it's the only on-line scanner that works with firefox. All it got where some adw_se.123482 or other numbers. After cleaning those I redid the scan and it didn't detect anything.
Thanks for the help.

[emy80]

I have another question. I swear that I'll stop after this.
After reading the word "malware" I did a new scan, in normal mode. And with the on-line Trend Micro scan. This time I disabled the Standard Sheld while doing the scan. nothing detected. Then, after an hour or so I tried to use Trillian. As expected ZA asked me the permission to access the net and I said yes and checked Remember this action. Then I checked the Programs log and Trillian connected to a DNS of a site I have linked in my blog but I still have to visit since having the pc back from the reformatting last friday. Why?  :'(
I understand that the firewall will check the DNS so if i see the zlclient connecting to a DNS I'll feel secure because it means it's working. but why other DNS will appear in the string of other programs? For Example, another one is the Apple iTune software I have installed. when i launched it it asked to connect and I blocked it. But looking to the DNS I see that it was blocked 5 time to connect to a DNS called livejournal.com. That's the site where my blog is hosted. but why iTunes would want to conncte to that DNS? Sorry I'm asking so many questions. But I'd like to understand this. if it's normal that random softwares will connect to random DNS I will  fell ok with it. if on the contrary it's strange then I don't know what can it be. Thanks.  :'(

[BILL G]

    Sorry for the Delay in Replying. emt80 is using ZA Free VER. 6, I am using VER. 5.5.094.000 . It has worked very well for Me for the past year. I have a 3Meg Cable Conn. and I use FireFox to Download  Programs Inc. ZA  from ZA  Website . zlclient.exe is not needed and does not show on ZA Program Control unless I Click on Man. Updates. I do not find zicomdb.dll on My ZA Uninstall List.  Is this a Legit dll?  I reread this Thread and I see Abnormal Actions. If the Problems Persist I would be looking for a Bad Guy in the Bushes .  I also use a Program called  AppDefend from Ghost Security. This Program Compliments ZA Free very well. It helps to Control what Starts up ,Runs , & Internet Access.  Good Luck

[emy80]

if there is somethign bad on my pc i'm unable to dtect it. both with all the programs I have, both with the trend micro on-line scan. At this point I don't know what to do anymore.  :'(

[BILL G]

      emy80  Normally the scans You ran will find a Problem but not 100% of the time. I checked My ZA & AppDefend Logs for the last 2 days  0 entries for zlclient.exe trying to access the NET . I ran a Google Search for zicomdb.dll . I got 2 hits both on this Thread. Can You look at this File & Scan it again ?

[mauserme]

Hi emy80,

If you highlight one of the lines in your firewall log and click on that More Info button you will get this on the Zone Alarm web site:

>>Zone Labs Client is trying to connect to the Internet or your local network

ZoneAlarm is asking you whether to allow the connection. No breach in your security has occurred. Your computer is safe. 
 What should I do? 
    
Give Zone Labs Client permission to connect. See the Details tab to learn how to do this.
 
 Why? 
 
 Zone Labs Client is a core component of the Zone Labs Internet Security range of products, including Zone Alarm Pro, which acts as a firewall, to protect your computer from unauthorized access. Zone Labs Client is normally located in the C:\Program Files\Zone Labs\ZoneAlarm\ directory. If the program is located in a different directory, than you should probably be suspicious of the program. It is normal for this program to request access permission, and it is safe to grant permission. <<
 
Or you can just click this link http://pralerts.zonelabs.com/pranalyze.jsp?record=ZLN37162680836295-1026/5bfbd8010a7beb01e600697e&tab=overview
 
I too have zlclient.exe logging outbound connections.  Since its in the proper directory I'm not terribly concerned about it.

[emy80]

      emy80  Normally the scans You ran will find a Problem but not 100% of the time. I checked My ZA & AppDefend Logs for the last 2 days  0 entries for zlclient.exe trying to access the NET . I ran a Google Search for zicomdb.dll . I got 2 hits both on this Thread. Can You look at this File & Scan it again ?

Hi! Sorry I'm writing now. Since I uninstalled ZA version 6.0....and installed the version 6.1.737.000 I don't have that file anymore. I guess it was a file in the previous version ov ZA. Sorry I can't help anymore.

[emy80]

Hi emy80,

If you highlight one of the lines in your firewall log and click on that More Info button you will get this on the Zone Alarm web site:

>>Zone Labs Client is trying to connect to the Internet or your local network

ZoneAlarm is asking you whether to allow the connection. No breach in your security has occurred. Your computer is safe. 
 What should I do? 
   
Give Zone Labs Client permission to connect. See the Details tab to learn how to do this.
 
 Why? 
 
 Zone Labs Client is a core component of the Zone Labs Internet Security range of products, including Zone Alarm Pro, which acts as a firewall, to protect your computer from unauthorized access. Zone Labs Client is normally located in the C:\Program Files\Zone Labs\ZoneAlarm\ directory. If the program is located in a different directory, than you should probably be suspicious of the program. It is normal for this program to request access permission, and it is safe to grant permission. <<
 
Or you can just click this link http://pralerts.zonelabs.com/pranalyze.jsp?record=ZLN37162680836295-1026/5bfbd8010a7beb01e600697e&tab=overview
 
I too have zlclient.exe logging outbound connections.  Since its in the proper directory I'm not terribly concerned about it.

I am not particulary concernd anymore about the zlclient.exe. But i noticed that if another application like a chat program like Trillian or MSN try to access the net the DNS is at random. And usually it's linked to the firefox page I was visiting. For example some days ago I launched iTunes and as expected it tried to connect to the net to access the iTunes music store. Few seconds before, I was checking the livejournal.com site and sure enought iTunes tried to access a DNS with that URL. Same problem with Trillian. If I visit a page and then launch it, as the rule I set, it asks for access to the net. Last i tried I was checking this forum and sure enought the DNS was something with avast.com in it. I guess it's just a glitch of ZA.

[mauserme]

If you launch a program that should access the internet, and it then does access the internet I wouldn't take this as suspicious activity.  Particularly so if the sites are known to you or at least not questionable.

I don't have an explanation for the particular connections Trillian and iTunes are making but I do have a guess.  Since Trillian functions with multiple chat services it probably looks at your connections to see if you're connecting to one of the supported servers.  Similar for iTunes and internet radio, etc.  As I said, this is a guess and others may have better insight on this.

On the other hand, if you see programs seeking internet access when you haven't run the program (other than background processes like Windows Updates), programs you don't recognize, or access to sites in China, Russia, etc you should probably investigate further.

[emy80]

I have another problem. Lately I'm getting tons of UDP attemps of access blocked from the ZA. It seems all of those are directed to the port 3924.
Ando some time I get some ICMP(type:8/subtype:0). 
I would like to download the software Polonus suggested but I have Windows XP and in that site there is just win 200 and NT listed. Which one should I download? Will it work ok with XP?

[bob3160]

Instead of worrying about every attempt of some rogue computer trying to access your computer,
why not just shut off the notifications and let ZA do it's job of protecting you from these attacks.
Stop worrying about things that you can't change and don't affect you and enjoy your computer and the net.

[emy80]

Instead of worrying about every attempt of some rogue computer trying to access your computer,
why not just shut off the notifications and let ZA do it's job of protecting you from these attacks.
Stop worrying about things that you can't change and don't affect you and enjoy your computer and the net.

ok. Thansk! Sorry. It's just that I'm afraid I'll lose my datas right now. Thanks.