Long-idle DSL connection no longer connected. ZoneAlarm plm?

[AllyCat]

What is going on with my 'puter? I loaded the new updated ZoneAlarm Pro a couple of weeks ago. After a few days, I could no longer send email to anyone. Every single piece of mail came back that the "recipient's machine had actively refused it". Since this happened right after I loaded ZA Pro, I unloaded it and downloaded the Basic program. Everything fine for a couple of days.

But now, whenever my computer sits idle for a few hours, when I return, I cannot get onto the internet or my mail without restarting the computer. All the lights are illuminated on the modem, SBC DSL service (not very helpful tech support), use Firefox, and a number of anti-spyware programs. AVG virus protection has not found anything.

What is going on?

[CBGLuthier]

1. OS , please?

Always mention your OS when describing computer problems.

Not sure what is going on but a few things may help to find out.

First, assuming you are using XP or 2000, click on start, click on run, type cmd, hit enter.

This will open up a good old command box.

type the following;

ipconfig

and hit enter
This will show you what your IP address is. Do not post your IP here but let me know what the very first number before the first . is.

You can type ipconfig /release to reset to zero and then ipconfig /renew to get your IP again. This may help you avoid rebooting.

ipconfig may annoy zonealarm, just tell it to allow it.

If you have ME or WIndows 98, then click start, click run, type winipcfg and hit enter.

This will open a program. Select your network adaptor from the dropdown, see what your number is and there are buttons for release and renew.

[AllyCat]

2. Oh Jeez, I know that and forgot...XP Thanks for your response!

I'll try anything at this point.

Okay the first 2 digits before the first . is 70

Now what?

[CBGLuthier]

4. Ok

Well, that sounds like the beginning of a valid number, if it began with 169, that is a generic bad number that a NIC will display.

DId you try releasing and renewing and if so, did that restore connectivity without restarting.

As for the svchost, that could be legit or it could be spyware. Unfortunately, svchost is a generic service that can be use by legitimate software and illegitimate software. In fact, blocking it could, and the keyword is could, be the problem causing you to drop.

Unfortunately, I am not as familiar with using DSL directly as I am other methods of connecting. DSL does usually require a username and password and maybe something is interfering with that. IS there DSL software on your computer or are you letting XP handle the login? You may want to check for updates to your DSL software if you are using that.

You may also want to go to webroot.com and download the trial version of spysweeper. It can find a lot of stuff that the other spyware packages miss.

I would suggest getting antivir (go to download.com and search for antivir and download).

This is very important, since you already have an active antivirus program, when you install antivir, you will get to a page when installing with about 4 different checkboxes, you must uncheck the option to "load the guard at startup" Having more than one active AV program is bad.

Let it check your system, then run it through its update process and get the latest files. Then go into the configuration and set it to scan all files and scan again.

Since you did a fresh clean install of ZA, I don't suspect it, but it could be an issue. Also, make sure you don't have the MS firewall on at the same time as the ZA one. Most likely you don't but that can cause problems.

[AllyCat]

6. I tried release and renew, but I have to leave the CPU idle for hours

to get it to be "not connected". And I've been on it all morning.

I thought of that with Win32 and that's why after a few days of futzing with this, I clicked "allow". But the system still went off-line after I walked away.

What's happening is that I have this at home so I rarely logoff (I'm the only user). I leave it with my desktop open and go to work, or sleep, or something. When I return, I click the icon for FF or Thunderbird and the system will say that it is not connected to the server.

MS firewall is off. That was the first thing I checked when this started happening.

Why do you prefer AntiVir over AVG? I've used both and liked both. Just wondering.

There is DSL software on the computer. For awhile, every time I powered down the CPU, I couldn't connect to the internet again without re-installing the DSL software. SBC was of NO HELP at this point and I just haven't turned off the system in awhile to avoid that problem.

Thanks for your help. This is really frustrating.

[CBGLuthier]

10. The reason I prefer Antivir

I install antivirus software about ten times a week. AVG has a very cumbersome registration process that required me to give them my email and get a key each time.

Antivir has always found stuff that the commercial stuff doesn't and seems to be a good program. Plus it isn't as cumbersome on the system, no auto updating or any of that junk so it is lean and mean which is the way I like software to be.

Sounds like you are on top of the most obvious stuff so lets hope it's some spyware you haven't caught yet because otherwise it may be a challenge. Especially if it comes down to third party software.

One other thing, silly as it sounds, you may be getting disconnected by your ISP on purpose. They do this on dialup all the time.

Next time you leave, go to one of yahoo's news pages. They always auto refresh about every ten minutes or so. See if a process hitting the system every few minutes makes a difference. If so, you can get one of the auto-pinger/keep alive programs and see if that helps.

And you can always right click on "my computer" and select manage and give the event log files a perusal to see if you spot anything odd.

[AllyCat]

3. Another thing that keeps happening:

ZoneAlarm keeps coming up with an alert box saying Win32 svchost.exe is trying to access the internet.

I deny it right now (have to answer 3 separate alerts with each one), but I have tried to allow it with no change in this problem. I never had to give it access to the internet or trusted zone before and never had this alert from ZoneAlarm...but now, it gives me a warning everytime I try to deny it permanently in the program control part of the ZA menu. It is trying to access my provider's IP.

[CBGLuthier]

7. The fact that this is a new problem

is somewhat suspicous. DIi you turn on automatic updating before this started? I believe it may use that process. If you didn't just turn it on and you haven't installed any other new software it could be a problem.

Use the tools from my other post and give your system another checkover. Spyware and virii are constantly changing and the more tools you can bring to the battle the better you will do.

Also, see if when the message comes up if you can get any more info. Often svchost will be executing a program and that may help nail it down.

I have a machine I just started working on and adaware found over 4,000 items. That may be a new record. :-)

[AllyCat]

9. 4,000? Wow!

Adaware has only found one item in the last 6 months. I run SpywareGuard, SpyBot S/D with the VX (?) patch, and SpywareBlaster. I check for updates every 2-3 days. This is the info message I get from ZA on this alert (doesn't say anything about what it's trying to do):

_______________________
Server Program alerts
Server Program alerts enable you to set server permission for a program on your computer.

Why these alerts occur
Server Program alerts occur when a program on your computer wants server permission for either the Internet Zone or Trusted Zone, and that program has not already received server permission from you.

Relatively few programs on your computer will require server permission. Some common types of programs that do are:

Chat
Internet Call Waiting
Music file sharing (such as Napster)
Streaming Media (such as RealPlayer)
Voice-over-Internet
Web meeting
If you are using the types of programs described above that require server permission to operate properly, grant permission before you start using the program. See Granting a program permission to act as a server.


If your browser does not have permission to access the Internet, you will be re- routed to the online help. To access SmartDefense Advisor, give your browser permission to access the Internet. See Granting a program permission to access the Internet.


What you should do
Before responding to the Server Program alert, consider the following:

Did you just launch a program or process that would reasonably require permission? If so, it's probably safe to click Allow. If not, continue.
Do you recognize the name of the program in the alert pop-up, and if so, does it make sense for the program to need permission? If so, it's probably safe to click Allow.
Click the More Info button in the alert box. This submits your alert information (for example, the name of the program and the address it was trying to reach) to SmartDefense Advisor, which then displays a Web page with information about the alert and the program. Use the SmartDefense Advisor information to help you decide if it's safe to answer Allow. For more information, see Using SmartDefense Advisor and Hacker ID .
If you are still not certain that the program is legitimate and needs server permission, it is safest to click Deny. If it becomes necessary, you can give the program server permission later by using the Programs tab. See Granting a program permission to act as a server .
How to see fewer of these alerts
If you are using the types of programs described above that require server permission to operate properly, use the Programs tab in Zone Labs security software to grant permission before you start using the program. If you're seeing many server program alerts, you may want to download and run an anti-virus or anti-spyware tool as an added precaution.

____________

I don't use any of those features that would need access.


--------------------------------------------------------------------------------

[jayfish]

5. I Don't Use ZA Any More...

but I think either eWeek Or Information Week does not recommend updating to the latest version. I'll check into it for ya.

Jay

[AllyCat]

8. Yeah, I had a lot of trouble with ZA Pro.

And maybe that's the trouble this time. There was no problem at all until I downloaded basic again.

[CBGLuthier]

11. Did a little checking into ZA

Seems that major version upgrades always go badly. There is supposed to be a FAQ on ZA's website that explains how to completely clean ZA Pro from your system. You may want to look for that and follow its directions closely. Could be there are some lingering registry entries that are screwing things up.

[AllyCat]

12. What do I use for a firewall then?

Or can I reinstall an older version?

[CBGLuthier]

13. Zone alarm

The point of at least a few articles is to do a thorough clean uninstall before upgrading.

The main thing is, get all of it cleaned up and then install the older version and hopefully that will solve the problem.

I don't use ZA as I rely on hardware firewalls at home and work. Some risks there but I never have had a problem. Yet. :-)

[AllyCat]

14. And now I can't even reinstall the NEW version, much less the old one

I get the program downloaded, install, accept the license agreement, click to install...and nothing. Nothing will install!!! I think I need to run through the MajorGeeks system cleanup tutorial as SOMETHING is very, very wrong.

[AllyCat]

16. Finally fixed my problem.

Uninstall of ZA worked. Installed Sygate since I don't seem to be able to reinstall ZA. That's okay. I'll get used to Sygate, but it is very different.

[AllyCat]

15. I finally uninstalled and then tried to reinstall ZA basic

It would download, but not install. It didn't matter which version I tried...there was nothing installed after I accepted the license agreement and clicked "install".

Finally gave up and installed Sygate. We'll see what that does.