ZA shuts down when log onto internet?

[macx]

Well, it's been about the typical 6 months or so since I had my last round of problems with Windows. True to form, here I go again.

XP SP2, Zone Alarm suite (the one with the Kaspersky anti virus), latest Firefox (just updated to FF3, yahoo version, no change with the problem)

For awhile, when I start the computer I get a ZA windows saying
"Generic Host process for Win32 Services is trying to act as a server"
lists the application in the ZA window as svchost.exe

doesn't make any diff if I accept or deny

Then when I try to log onto the net, I get serveral of the same window, also no diff if i accept or deny

But since that started, I have to usually do at least 2 tries to get logged on, first I get a Firefox screen but nothing on it and it says "Done" in the bottom left. If I shut that off and try again, then eventually it hooks up to my Yahoo home page.

After the first time loggin on after starting up, then everything seems to work fine.

Except - Zone Alarm shuts off. Says "system error, reboot". Then it just goes into a continuous cycle doing the same thing over and over.

On occasion I would also get a ZA window saying
"Windows Genuine Advantage Notifications is trying to read and modify physical memory" I never allowed that. ZA listed that app as WgaTray.exe

Well, tried to do something about it. (ZA shutting off)

So started scanning with all the various security apps.

AVG Anti Root Kit Beta - nothing found

Spyware Guard (runs all the time) - when I opened it and tried to get updates, ZA came up with a window saying "SpywareGuard Browsere Hijacking Protection is trying to change the browser home page" and it wasn't real clear if it was trying to change it from Yahoo to IE, also looked like it might have changed it to "about.blank"

Then after that, SG's "Realtime Scanning Engine" is shutdown and i can't get it restarted. ???

Then scanned with cwshredder, nothing

Then scanned with Look2MeDestroyer and for the first time a window came up
giving me the selection "Remove L2M" which I accepted, then in a bit it said
"L2M Removed"

NOW I can't even log onto the internet. When I try to log onto the net it's supposed to go to my Yahoo home page, but a window comes up that says
"Windows cannot access the specified path or file. You may not have permission - - "

(Obviously I'm doing this on another computer.)

What's going on now?

Where do I even start?

I checked in Internet Options in the Control Panel and www.yahoo.com is still listed as my default home page. Why can't FF find it?

Thanks for any help getting my current Windows mess straightened out!!

 

[mflynn]

Hi Macx

ZA is famous for this will likely have to be uninstalled the reinstalled. Problem is it is kind of like Norton as it has a P-Poor uninstaller and is hard to uninstall.

I know how to do it and...

I will help you with that

If you will go here and do:

The 8 steps: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

If you already have these programs then update run and post the logs.

Mike

 

[macx]

Now MORE problems!

I just tried to open a couple files on the computer C drive - one Word and one Excel - and it won't open them. Then when I tried to open the Control Panel
it also tells me the computer can't access the specified path!

NOW what?

thanks!

 

[macx]

Hi Macx

ZA is famous for this will likely have to be uninstalled the reinstalled. Problem is it is kind of like Norton as it has a P-Poor uninstaller and is hard to uninstall.

I know how to do it and...

I will help you with that

If you will go here and do:

The 8 steps: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

If you already have these programs then update run and post the logs.

Mike

That would be nice, but as I said above, I can't even access the internet.
Also can't even open Windows. So can't hardly go in and download anything.

First problem, how do I open Windows and then Yahoo?

 

[mflynn]

NOW what?

Reboot! Do my last post!

But I may not be up much longer. Tired time for bed.

I will let you know when I sign off.

Mike

 

[mflynn]

OK that was not real clear I thought you finally could get on.

OK Boot to Safe Mode with Networking and try!

This may be more than ZA!

If you can do the 8 steps carefully no skimping,

I will add this any program finds Malware then rerun that program until it comes up clean or with an item it can not clean!

Mike

 

[macx]

I was able to reboot into Last Known Good Config, so now stuff on the machine works but it still an't find the net. When I boot, a window keeps coming up about finding a new network (I'm hooked into the Internet Only system at work, not work's intranet) and I OK it but it still can't find anything on the internet.

I'll try that SM with Networking.

Thx!

 

[mflynn]

Ok I will check back in the morn signing off for the night!

Good luck

Good night,
Mike

 

[macx]

Thanks Mike.

I'm working nites, 4:30 to 4:00, and won't get back to this computer
till work tomorrow / Sun late afternoon.

In the meantime I'll try to uninstall ZA and reinstall (had to do it once before, but before never had these alert windows like that either).

 

[macx]

Got ZA uninstalled and reinstalled.

Down to this: with ZA on, won't hook to anything on net.
When I turn ZA off, everything hooks up, and quickly.

What's in ZA that's preventing me from hooking to net?
Thx

 

[macx]

Couple hours later.

I have Spyware Blaster running, scanned with AVG AntiRootKit, cwshredder, no hits there either. Apparently came up with something on L2Me Destroyer, which was zapped, but that was before I scanned with everything else that came up clean.

Then, downloaded the latest version of CCleaner and ran it, downloaded Malwarebytes and ran it, downloaded SuperAntiSpyware and ran it, and updated the Java. No hits on any of those either.

Uninstalled and reinstalled Zonelabs Security Suite (incl the firewall and anti virus).

With ZoneAlarm running, still can't hook to the internet. If I disable ZA, then evereything loads up pronto.

What do I have to do in ZA to hook to the net?

Thx!!

 

[rf6647]

If computer sits behind a router, put the router into safe zone for ZA.

start menu > run > cmd > ipconfig /all

Your network will be of the form 192.168.x.y

ZA has the ability to re-use the configurations from previous installation. On the re-install, you should have been offered the choice to a fresh beginning.

The 'network' forum @TS has some simple steps to examine your network,

 

[macx]

It's a company router, although internet-only. Not part of their intranet.
So I don't have access to do anything with it.

I would have thought ZA would have configured the same as it did the first
time I installed it on this computer on this system - with no problems at all.

 

[rf6647]

Right Click "ZA" icon appearing in the notification area of the taskbar.

Select "Restore ZoneAlarm Security Suite Control Center"

Select "Firewall"

Select tab "zones"

Please describe your "trusted" zone(s) and reveal the IP for your computer.

Your local network should be in the trusted zone.

Since my local network already exists, I could only "add" a subnet. I could not add a network as was hinted in the descriptive text on the left pane. I chose not to break anything.

You may get a different reaction if no network is listed in the trusted zone.

Examine "Logs & Alerts" > firewall and then >programs. Something could have glitched the privileges for IE and/or FF or your IP.

 

[macx]

Now that brings back some recollections but it seems to feel like it's pointing int he right direction.

Will give it a try when I get back to work Sun nite 5:00pm.

Thanks!!

 

[mflynn]

Morning Mac

Perhaps you remember this Post #2.

Hi Macx

ZA is famous for this will likely have to be uninstalled the reinstalled. Problem is it is kind of like Norton as it has a P-Poor uninstaller and is hard to uninstall.

I know how to do it and...

I will help you with that

If you will go here and do:

The 8 steps: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

If you already have these programs then update run and post the logs.

Mike

Specifically this: The 8 steps: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
I assure you ZA uninstalled enough to not obviously show up but it was not completely gone, basically not allowing a clean install, even tho it did install it picked up some of your old config and ini and registry settings from the original installation!

Additionally if you have the "Right" Malware you opened the door all the way allowing full access for it to do what it wanted unhindered ,by uninstalling ZA (likely the system was fully connected while you did this).

There is reason to my maddness that is to ascertain that you did not have Malware before you uninstalled ZA.

And not a log insight!

OK beginning with my next post I will begin again with you, if you want this fixed then follow instructions!

Mike

 

[mflynn]

New beginning!

Reboot clean run no Apps!

Turn off ZA and all Malware and Virus Protections!

Download SDFix to Desktop among other things it runs GMER and Catchme to look for RootKits.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

On Desktop run SDdFix It will run (install) then close.

Then reboot into regular Safe Mode (not with networking)

At Desktop
My Computer C: drive. Double-click to open.

Look for a folder called SDFix. Double-click to enter SDFix.

Double-click to execute RunThis.bat. Type Y to begin.

SDFix does its job.

When prompted hit the enter key to restart the computer

Your computer will reboot.

On normal restart the Fixtool will run again and complete the removal process then say Finished, hit the Enter key to end the script and load your desktop icons.

Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.

Attach the Report.txt file to your next post.

=========================================
Immediately without executing other Apps do the following

Download OTScanIt: http://download.bleepingcomputer.com/oldtimer/OTScanIt.exe
Close all Apps and Browsers

Download and save to Desktop and Dbl Click to extract the files to an OTScanIt Folder.

If Firewall or other Security or Malware protections pop you should allow them to let OTScanit to run.

Enter the OTScanit folder and run OTScanit.exe.

In Additional Scans select BotCheck, Disabled MS Config Items and Eventviewer Errors/Warnings

Top Left click Run Scan.

The scan can take some time so allow it time.

Then finished a log will open, save log, post back as an Attachment.

=========================================

When I get the logs and process them and fix any issues then we will properly completely and cleanly uninstall ZA. So that it will reinstall pristine!

Mike

 

[macx]

Holy Moly Michael! That's a whole nite's work, and that's right where I am (again) - at work till 4:00am.

Will work on it, don't know if I'll be able to finish it or not.

Makes one wonder if ZA is even worth all this kind of trouble over and over.

Any "new" high rated Security Suite's out there that are as secure but maybe less troublesome than ZA?

I don't mind spending some $ to get a good secure setup (over the years I've physically lost 2 hard drives and had all my info wiped out a couple times, so I do value security) but one thing I do not have is this much time - or patience - every few months to fight with it.

In the meantime I keep looking at the Mac duo's. My family has had over 20 years combined pretty intensive Mac use (3 machines most of the time) and yet are to have problem # 1 with security over the internet. AND they're easier to learn and to use. There's nothing they can't open over the internet and they can read any Windows Office document I send them. Just a few apps I have that Mac doesn't cover and that could be done on the Windows side without ever exposing that side to the internet. Hmmmmm. They spend their time using their machines and browsing the internet. I spend a lot of my time on security.

Well, will try to dive into that mess. Might be a couple nites before I have time at work to get thru it all.

Thanks again so much for the expert assistance!

 

[mflynn]

This only looks complex will take less than probably 30 minutes?

You can finish it.

Up to you then!

If ZA is uninstalled (completely) and you indicate you have had issues with it before then I think the Comodo firewall is one of the best.

Your ball!

Mike

 

[macx]

Mr Flynn

I'll trust your judgement that even I can do this in a reasonable amount of time! ; -) so I'll give it a whirl.

I go thru all this just seldom enuf that I am not sufficiently aware of all the little steps and so often struggle more with it than folks like yourself who are more familiar

I'll see how it goes

Thanks for the encouragement

 

[mflynn]

Mr Flynn was my dad.

Me, I'm just Mike!:grinthumb

 

[macx]

Well, just an hour & 1/2, not as bad as I figured while I watched the first scan.

Attached are the 3 logs.

I eagerly await your opinion.

 

[macx]

Well, I'm back at it working on the next installment - ZDFix etc etc. (10:20pm) Should finish tonite some time between things to do at work. Will post logs/report when I finish.

 

[mflynn]

OK those last logs all look good.

Get me the SDFix and OTScanit.

Refresh me on what issues actually remain.

And do you want to in the end uninstall ZA for a clean ZA install.

Or clean and chose another Firewall?

Don't work to hard tonight!
Mike

 

[macx]

Hey, Mike - we must have "crossed" posts - those last 2 are now on there.

I was wondering if the HiJack log mite not have something not very nice on it, but apparently not. well, that's good.

The only symptom I seem to have remaining is that with any one (or all) segments of ZA Security Suite activated I can't access anything on the internet, even if I get on the net and THEN turn on ZA, then I can't open anything else. With it all turned off, everything comes right up fine.

I've got the entire ZA Security Suite - everything from the firewall thru anti virus thru anti malware etc etc, and it's been fine for nearly a year - a little slow to get onto the net the first time, but after all the stuff I've lost and the frustration and time wasted, I like secure. I've got the original download of that ZA app that I first downloaded and installed when I bought it and which I've been using for some time, so can do a clean install if I can totally get rid of the existing install.