Results 1 to 6 of 6

Thread: Vsmon.exe does not protect my computer when zlclient.exe crashes?

Hybrid View

  1. #1
    chamath Guest

    Default Vsmon.exe does not protect my computer when zlclient.exe crashes?

    Hello everyone,

    Recently, I was working on my computer, there were lots of processes running, and I was signing into MSN. Suddenly, a messege box displayed in the center of the screen, it's title is "Microsoft C++ Runtime library".
    Message is, "Program, e/program files/zonelarm/zlclient.exe was having an unususal way of terminating itself, this will now be terminated..." WHAT THE HECK??!!???!!

    I immediately pressed "Print screen" button in the keyboard to get a screen shot of the error messege. Then I looked at the processes list in the task manager. zlclient.exe was missing. But the "Boss" of zonealarm, vsmon.exe was running.

    I opened firefox and internet still worked. Then I launched an unknown safe executable file, it opened successfully. Oops, I was wrong. I thought vsmon.exe would halt down all network services and would also block running files when ZoneAlarm crashes. Was I wrong? This would have been extremely dangerous if someone else had been working on my computer.

    Oh and, did you forget about the screenshot? Oh well, I opened the "Paint" in Windows and pasted there. Unfortunately, The computer was halted. I had to turn the power off

    Operating System:Windows XP Pro
    Software Version:7.0
    Product Name:ZoneAlarm Internet Security Suite

  2. #2
    Join Date
    Nov 2004
    Location
    localhost
    Posts
    17,290

    Default Re: Vsmon.exe does not protect my computer when zlclient.exe crashes?

    Hi!not sure I understand the problem.Did the unknown software connected out? The firewall is supposed not to block a program per se but should block the software to connect out (always if it is unknown to smartdefense central database)In case the executable per se will not notify you of a successfull connection, you will need to put a sniffer to check if that program will connect out (since if zlclient.exe is not running, ZA will not log blocked connection in the log files)To test the block of a program you need to run either a malware file (that will be detected by the AV engine)or an executable that will perform suspicious activity.Cheers,Fax

    Message Edited by fax on 03-01-2008 04:24 PM

    Click here for ZA Support
    Monday-Saturday 6am to 10pm Central time
    Closed Sundays and Holidays

  3. #3
    chamath Guest

    Default Re: Vsmon.exe does not protect my computer when zlclient.exe crashes?

    Hi Guru fax, thanks for the reply.

    Yeah, firefox is allowed to connect to the internet according to the smart defense database. That's why it may have connected to the internet. And the executable file that I launched isn't a software. It's just a file created by me with Visual Basic 6. It does nothing when launched.

    I'll create a program using Visual Basic 6 which connects to the internet and perform suspicious behaviour (How about a keylogger? And I'll test it when ZA crashes again.. Is there a safe, manual way to attack and crash zlclient.exe?

  4. #4
    Join Date
    Nov 2004
    Location
    localhost
    Posts
    17,290

    Default Re: Vsmon.exe does not protect my computer when zlclient.exe crashes?

    Hi!ehm, no I don't know how to crash safely only the zlclient.exeCheers,Fax

    Click here for ZA Support
    Monday-Saturday 6am to 10pm Central time
    Closed Sundays and Holidays

  5. #5
    chamath Guest

    Default Why did ZoneAlarm crash?

    Ok thanks!

    I tried an advanced procedure with "Kernel32" to terminate zlclient.exe using VB6, but it was failed. At least I can be happy that ZoneAlarm is very strong, so it's not easy to be terminated

    But, does anyone has an idea why did ZoneAlarm crash in an unusual way as in the 1st post? It was the first time ever happened to me...

  6. #6
    Join Date
    Nov 2004
    Location
    localhost
    Posts
    17,290

    Default Re: Why did ZoneAlarm crash? No, no idea...

    NO, sorry no idea... Cheers,Fax

    Message Edited by fax on 03-01-2008 10:08 PM

    Click here for ZA Support
    Monday-Saturday 6am to 10pm Central time
    Closed Sundays and Holidays

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •