Zone Alarm Fire wall new questions.

I should have asked these questions first before I made my changes.  Learning and flying off the cuff.

I just deleted my Norton suite and have exchanged all my protections using free ware's.  My firewall of choice is Zone Alarm.

I just downloaded and installed it but I don't know how to find it.  How do I know it is turned on and protecting?  I should only be operating one firewall to avoid PC confusion.

During registration, it asked me to submit my address so I would get new information and I think updates via email.  Is Zone Alarm a completely stand alone (visually passive) program that I cannot make changes to or view its status.  I don't know when to turn off Window's default firewall that I still have "on".  Any ideas and your experience please.

Thanks, Tom

What Windows version? I can't give you instruction for Windows firewall without this info.
Windows firewall has to be disabled first, before installing ZoneAlarm.
Zone Alarm, if active, should show up as an icon in your taskbar.
Check C:\Program Files.....look for Zonelabs folder

[Malware Removal Specialist]

You should see ZA in your Task Bar. It should have installed to C:Program Files so you may look there for it.

Disable windows firewall http://support.microsoft.com/kb/283673

[Malware Removal Specialist]

Got scooped by Broni, sorry for double info....

Thanks Broni for your reply, at least we have a dialogue started.  My O/S is Window's 5.1.  Maybe you can readvise me again after I discuss my issue and assumptions.

First, I know how to use windows control panel and either the "firewall or security center" icons to disable the Window's firewall.  It is currently set to "on".  I've since removed the download; it completely locked up my internet capability.

While I had the download installed, I tried turning off the Win f/w and my internet capability was still disrupted.  I know it is a compromise to have two f/w's operating at the same time.

What I don't understand is, how do I access the internet to download the z/a f/w without the protection of of at least the window's f/w still in operation while I am working?

Am I missing a step?

Since I am new, it would help if the instructions come slow at my speed of understanding especially when it comes to learning how to access the program files discussion that was brought up earlier.

Incidently, the icon on my taskbar (as previously mentioned) never appeared.   I used the install / uninstall function to remove the download.
 

   

Firstly...

My O/S is Window's 5.1

I assume, we're talking Windows XP, then.

Secondly, turn your Windows firewall ON, for now.

Now, when you uninstalled Norton, it's very possible, it didn't remove everything, especially registry entries.
Go Start>Run, type in:
regedit
Hit Enter.
Registry Editor will open.
Go File>Export, and save your registry file to known location.
Go Edit>Find
In "Find" field type in:
Norton
Click OK.
When entry is found, right click on it, click Delete
Hit F3 to find next Norton related entry. Right click, Delete.
Continue, until no more Norton entries are found.

Repeat same action, looking for:
Symantec

Now, you need a firewall. I'm not a big fan of ZoneAlarm, so I'll recommend Comodo: http://www.personalfirewall.comodo.com/
Download it.
Turn your Windows firewall OFF.
Install Comodo.
Restart computer to see, if everything checks out.

Broni,

I am still trying to clean up the PC with your instructions.  I think everything is working so far as I am editing the registry like you said to do. 

I've removed my spyware , rootkit and (from some time ago) past A/V trial programs.  I just got done deleting the Norton files the registry identified.  I have a new question now. 

After Norton; I asked the registry to "find" Symantec.  The left side of the screen seems to look like it located a point somewhere in the middle of the drop down tree.  I'm lookin at a mile listing of binary type files.  The point is, I don't know where Symantec starts and where it ends so I know I have completely deleted all the Symantec files. 

Any ideas how I should approach this?

Since you advised a free firewall, do you use and recommend a free anti virus?

Thanks for all your help. 

T   

The left side of the screen seems to look like it located a point somewhere in the middle of the drop down tree.  I'm lookin at a mile listing of binary type files.  The point is, I don't know where Symantec starts and where it ends

I'm not quiet sure, if I understand. When "Find" finds something, that entry is usually highlighted.

As for free antivirus, yes I'm using AVG free, and happy with it: http://free.grisoft.com/

[Malware Removal Specialist]

Have you tried the Norton Removal Tool?

Not yet.

First I felt is was more important for me to understand how to learn and use the "run" commands and functions of editing the registry.  I'm new so I am cautious and take my time learning; stop everytime I see something wrong or just don't understand it.  You guy's out there are a great help and I really appreciate your time.  By that; I can one day maybe help someone.

So I went back to work in the registry and think I have solved many of my problems.  The other reason I didn't run the tool yet was; if I'm going to remove Norton Symantec, installing the tool would be downloading more software and that might just compromise my initial objective which is to remove any identity of old Norton ware. 

Now that I cleaned it up, AVG A/V free edition is now working properly where it wasn't before when I started this project. 

Now back to the beginning of what started this whole dialogue; a firewall.  I've decided to stop my attempt working with Zone Alarm and go with the other recommendation "comodo".  What are your opinions, what has worked for you?

Tom

EvilF,

I just read your entry at the beginning of this catagory "read first".  Very informative; I will study it.

Thanks, T

[Malware Removal Specialist]

EvilF,

I just read your entry at the beginning of this catagory "read first".  Very informative; I will study it.

Thanks, T

Thanks 

The Norton Removal Tool runs from the desktop, it doesn't actually install. Just delete the exe when done and it is gone. I would still suggest running it. Symantec/Norton entries are everywhere and finding them all manually might be impossible.

Comodo and I/my computer don't get along very well. My preferrence is PC Tools Firewall Plus Free But everyone has their preference.

The registry is really not the place to start learning in. It is a dangerous place to make changes even for a skilled user. It is best to use tools to clean it up. The space gained by deleting dead entries is so minimal you will most likely never notice the difference.

Auslogics Registry Defrag is what I use "if" I am bored. It isn't something that needs to be done often.

Then the Registry cleaner in CCleaner is probably the safest to use.

Let us know how everything goes. EF

Comodo is the best, you can get (including paid firewalls).

I would still suggest running it.

I'd be curious myself, if it's gonna find more stuff.

I will give it all a try especially the removal tool; except the Ccleaner right now. 

I read an article that it could cause some interference with Window's Media Player 10. 

I had to roll back to WMP10 when my daughters b/d gift; mp3 player specifically required that version in order to download music to her player.   

I've collected and saved all of yall's notes.  Once again, I appreciate your help.  It has saved me allot of grief.  I'll post my new success's.

If you folk's live in America, please enjoy a Happy Thanks Giving.

[Malware Removal Specialist]

If you folk's live in America, please enjoy a Happy Thanks Giving.

Thanks 

Open CCleaner and select the Applications tab. Look down the list under Multimedia and uncheck Windows Media Player. CCleaner "should" leave it alone when you run it.

I plan to reinstall (any recommendations); Spybot S&D, LavaSoft AdAware, AVG's Spyware and Rootkit. 

Should they be installed first or after I install Ccleaner?

[Malware Removal Specialist]

Any order should be fine.

I would suggest using the free Panda Antirootkit instead of AVG AntiRootkit.

Here is the zip file for it if you want it. Panda Rootkit.zip

Unzip it and run the PAVARK.exe file.

Tick the box that says In depth scan and follow the on screen instructions.

Also check out WinPatrol 2007 which is a security monitor. Has a lot of other useful tools in it as well. Don't download the WinPatrol Plus, it is a paid version but the 2007 is free.

Thank you. We'll

Everything is cleaned up, F/W is installed and running well, and the AVG/ A/V began working as advertised getting its updates.  I did an update on the a/v yesterday and it came up with this item:
C:\Windows\sys32\drivers\etc\hosts

Error: 0
Results = Change
Status  = Changed

Next scan had no activity at all.

Next and every subsequent scan the same item returns.

How do I go about determining what it is so I can correct it?

Thanks again,  Tom

C:\Windows\sys32\drivers\etc\hosts

Error: 0
Results = Change
Status  = Changed

Did it give you any option to proceed?

Next scan had no activity at all.

What do you mean by "no activity"?

No.  It didn't offer me any options what so ever.  I looked at it in "test results" and it just indicated that the "Status" has changed.

Activity: 

I subsequently ran another scan and it didn't identify again (no activity as a result of running a second scan). 

I performed update again upon start up today, collected todays update and the same item identified itself twice having run the scan twice.

   

If I understand correctly, when you run second scan with same version of AVG (not updated), it doesn't complain about "hosts" file, but if you update AVG, it complains again, right?

Can you post your "hosts" file? C:\Windows\sys32\drivers\etc\
Open it with Notepad.

[Malware Removal Specialist]

C:\Windows\sys32\drivers\etc\hosts

AVG is just reporting a change occurred. This will happen with some updates.

Nothing to worry about.

Go slow. 

First; I don't know how to find (or what they are) 'host' files to post.  I presume you mean copy and paste.

Second; the same items shows up every subsequent scan no matter how many I run, whether there was any update or not to download.

T

Navigate to: C:\Windows\sys32\drivers\etc\
You'll see "hosts" file there. Right click on it, click "Open with". Choose Notepad. Select All>Copy, and Paste it back here.
I assume, evilfantasy is right, but I want to make sure, there is nothing malicious in your "hosts" file.

[Malware Removal Specialist]

I'm not saying don't check the hosts files, but this question has been asked on the AVG Free Forums many times and their answer is basically the same as mine.

You see, I don't know how to navigate to C:\WIndows\sys......
Sounds like old DOS work.

Maybe in windows explorer?  I tried viewing regedit and I truly don't know what I'm looking at.

Maybe in windows explorer?

Yes.

Well I think I finally found it.  For some reason C & P isn't going my way so I typed the files in \etc as follows:

Hosts
lmhosts.sam
protocol
hosts.20071122-094424.backup
Networks
Services

I hope this helps clear up my concerns with why AVG continues to identify that file.

in "etc" folder, you need to right click on "hosts" file, click "Open With", and open it with Notepad.
We need to see what you have INSIDE "hosts" file.

I have to read the help section again in Spy-Bot S&D 1.5 under 'immunization'.  It's a little over my head but so far I am understanding the 7.5K entries in the hosts file is a list of reported browsing sites that spybot has identified as known to have malicious content.  When I understand this more to be true, I will C&P the 7,500 lines of sites.  As for the hosts.backup file in \etc\hosts it is the same as my brothers two computers as follows: 

Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost
 

Maybe you know someone who has the current v of spybot installed and can view what is in there host file after they have run immunization.

As I said; there are 7.5k lines of web sites in 127.0.0.1

What do you think?

You can safely delete everything from your "hosts" file, except for this:

Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost

Everything else can be deleted.