Author Topic: New Mozilla Beta. (Read 5461 times)

mistybear · « **Reply #15 on:** July 19, 2006, 12:07 »

I tried that Simon and still it doesn't work.

:?

But in looking at what ZA is doing, which is very difficult to understand, I found this being blocked, sychost.exe. From what I've read it's a virus, but my scans have been clean?
Under Program Alert it is being blocked as Incoming.
Under Firewall Alert it is being blocked as outgoing.

The incoming doesn't worry me, but the fact that there is an outgoing, doesn't that mean it is already on my computer. I did a search for it, full computer, and it doesn't show anywhere.

Rodders · « **Reply #16 on:** July 19, 2006, 12:45 »

Are you sure that doesn't read svchost - with a 'v' rather than a 'y'?

mistybear · « **Reply #17 on:** July 19, 2006, 12:47 »

Oops

Time for new glasses I think, or maybe I should just clean these ones.

mistybear · « **Reply #18 on:** July 19, 2006, 13:21 »

Am I allowed to post a link to another forum, as I found a whole thread on svchost.exe and what it does. I'll post it and you can always remove it.
:?

http://impend.computing.net/security/wwwboard/forum/272.html

I think I've found the problem, it actually came up as I was researching it. Didn't ask permission to block it, it just did.
So is it safe to unblock it. :?

Simon · « **Reply #19 on:** July 19, 2006, 14:18 »

Don't unblock it - remove it, Kate, then it should ask for permission again, and should give you some details as to which program it is relating to. If it's Generic Host Processes, that should be OK.

Is this also the solution you have found for Email Notifier? Unfortunately, ZA has been known to cause inexplicable problems such as this.

mistybear · « **Reply #20 on:** July 19, 2006, 14:55 »

Simon I think I probably have changed too many things on it now, and I'm tired and can't remember what exactly I did change, so I think it would be easier if I simply uninstall ZA and start from scratch.
At least now I now a little more about it and what is needed, so a clean install might be the way to go.

I'll do that tommorrow.

One thing I don't understand, well one of many really

, is what a server is, and what programs should be given permission as a server.
Messenger is one, are there any others that should be given that access?

I guess if I knew what programs require what type of access it would be easier.
With Firefox having an email notifier, does this mean it needs the same access as messenger. And what if IE has a email notifier, is it the same for it.

Simon · « **Reply #21 on:** July 19, 2006, 19:51 »

Well, I suppose that's an option. Basically, a server is a computer that handles requests for data, email, file transfers, and other network services from other computers, i.e., it's what transfers data from one computer to another. Most programs which require online access, use a server, but there are obviously good and bad programs, which is why you need a firewall, so that the data traffic going in and out of your computer can be monitored, and, if necessary, blocked. You could think of an email server as a 'sorting office', where all the mail is sent to, from where it is collected by the 'postman' (your email client), then put through your letterbox (your Inbox).

Unfortunately, most firewalls speak in fairly advanced terminology, but if you have just installed a new firewall, most of the programs it will ask if you want to allow network access, will be familiar programs that you have installed, such as your email client, web browser, etc. If something suspicious pops up, you can usually gather some information by Googling the .exe, then you can decide whether to allow or block it. Sorry, but there's not really an easier way, and once the firewall is 'trained', it shouldn't bother you too much, unless there is reason to do so.

Just a suggestion, but if you're going to uninstall ZA, why not try a different one, such as Outpost Free, and see if it's any easier to understand. I don't, however, think you'll get anything much more user friendly than ZA.

mistybear · « **Reply #22 on:** July 20, 2006, 12:23 »

Thanks for the explanation Simon.

I ended up uninstalling it and with just the XP firewall I tried the Email notifier again, still comes back failed? So I suppose I can safely assume it wasn't the ZA firewall then. So I reinstalled it, I thought about your suggestion of the Outpost one but I think it would be too confusing to try to learn a new one.

Under Program Control, it has a list of programs and then two headings. And then the two columns of trusted and internet. In those columns you can have either a green tick for allowed a question mark for ask and a red cross for denied. For the Generic Host Process svchost.exe, it is the only one with three green ticks, two in Access, one trusted under Server and that is the only program that has a green tick for that. But in the next column where all the rest are question marks it has a red cross. I don't understand why is it set up like this for this one program?

Access Server
Trusted Internet Trusted Internet

While I was typing this a ZA Security Alert popped up, same as last night, sayng that it has blocked Internet Access to 203.12.160.** [DNS] from your computer. Wouldn't happen to know what this means.

Simon · « **Reply #23 on:** July 20, 2006, 18:08 »

This pop up warning, is it definitely saying it's blocked OUTGOING data? That's usually a sign that something is trying to 'phone home', or trying to access an external server. Now, without seeing it, I'm only guessing, but it could be Email Notifier that is trying to check your mails, and is being blocked, thus not working. Is Email Notifier in the Program Control list? If so, it should have all green ticks.

What you should be aware of is that if it isn't email notifier, or any other program, or windows application that you know about, it could be a trojan trying to transmit data, which is bad, but not that bad, as ZA has blocked it. The chances are, it's just something you have installed trying to update itself. Firefox checks for updates, so it could even be that, but I would have thought it would have given the program name. Are there no details other than the IP address?

Another thing I thought of today is that when I was trying out all the different security suites, before settling on F-Secure, I found that Zone Alarm Internet Security caused problems with my Mail Washer, which is a similar program to Email Notifier, in that it checks for emails for multiple email accounts, before you actually download them. Email Notifier also checks multiple accounts, and I am wondering if ZA has some sort of general objection to this type of program. I know you said you uninstalled it, and Email Notifier (EMN) still didn't work, but did you reboot after uninstalling ZA? If not, it may have still been blocking access. Can you remember, did EMN work properly before you installed ZA?

Later, when I have more time, I will have a look on the ZA forums, and see if anyone else has posted a similar problem.
Unfortunately, I do suspect a conflict, and you may have to choose another firewall if you want to continue using EMN.

Simon · « **Reply #24 on:** July 20, 2006, 20:32 »

OK, I have looked on the ZA support forums, and there does indeed seem to be an issue with Mailwasher, when checking multiple mail accounts simultaneously. Their suggested remedy is to enable Mailwasher to check each account sequentially, i.e. one at a time, rather than all at once, however, in the thread I was reading, this didn't seem to solve the problem for that user. I realise EMN isn't Mailwasher, but it is a similar type of program, so I am speculating that ZA might indeed have a problem with simultaneous mail server checking. When I installed EMN, there seemed to be limited options, and sequential account checking wasn't one of them, as I recall. Sorry Kate, but in my opinion, ZA is your problem.

mistybear · « **Reply #25 on:** July 21, 2006, 09:26 »

Thankyou for all your work on this Simon.

I uninstalled EMN, not much point having it if it wasn't working.
I did find another program called E Prompter http://www.eprompter.com/
just to see what would happen, if it has the same problem. It works fine, it asked for permission to update and unlike EMN, it appears in the program list as a seperate program. Maybe that is why it is difficult to workout what EMN is doing as it's a toolbar attached to FF, not a sperate program.
And yes EMN worked fine before the ZA firewall.
I would rather have the EMN back so I might look at another Firewall.

And as far as the program trying to phone home, is it possible that it's WGA notifier. When I had to reinstall Windows, the updates wouldn't just automatically run, but it asked that I install the WGA notifier and then the rest just flowed.
That pop up warning happened again when I turn on the computer this afternoon, again no other details other than the IP Address. But according to the log 3 attempts were made in the space of 50 seconds to three IP Addresses 203.26.24.211 203.26.24.212 203.26.24.213
Last night it was svchost.exe trying to contact dns1.tpgi.com.au which is our service provider?
All of these have been blocked without me having any control over it.

OK I know what the first three are for and I have now given permission for AVG, ZA and EPrompter.
The last one seems to be Blue Soleil.exe and no other information other than it's data.

Simon · « **Reply #26 on:** July 21, 2006, 10:37 »

It seems that you may have the security settings in ZA set too high, Kate. It appears that almost everything is being blocked, until you allow it, and that's not really the easiest way for it to operate. If you look in the options for Security Level (or similar, as you know, I don't have it installed on mine, so I am partly using guesswork), and if it's set at HIGH, reduce it to MEDIUM, which I think should be the default settings. It should then allow most Windows programs automatically, and at this point, it might even be worth trying EMN again.

I think Blue Soleil is bluetooth software, as I had it on mine once. Do you have a bluetooth cordless keyboard or mouse, or do you have mobile phone software installed?

mistybear · « **Reply #27 on:** July 21, 2006, 14:58 »

Internet Zone Security was set to High so I reduced it to Medium.

I uninstalled the E Prompter and reinstalled EMN and rebooted. It is on Failed, but I'll leave it for a day and see if it changes. I remember when I had the Hotfix Toolbar, which is the same EMN (Effective Brand) it would occasionally say failed but it would later indicate new emails, and seem to function ok.

This computer does have Bluetooth, I honestly don't know what it does. :?

And yes I have cordless keyboard and mouse, it's part of the Medion 8383XL package.

Simon · « **Reply #28 on:** July 21, 2006, 19:07 »

That High setting may have been a big contributor to the problems. Is EMN listed in the Program Control list? You may have to remove it from the list, and allow it again to unblock it. At least your Windows programs should work OK now, and you should receive less alerts.