I noticed some programs are blocked by ZoneAlarm from making DNS (Port 53) hits to IP addresses other programs have used on the computer. For example, if I went to a web site using Explorer, WinVNC.exe would try hitting the DNS port at that site. Other programs also exhibit this behavior whenever they use any kind of network access. For example, if I used Excel to open a worksheet on another computer on my LAN, Excel.exe would attempt to hit port 53 on that computer AND the website I used earlier with Explorer. WinVNC.exe server seems to be the most network active, so it makes the most hits to sites accessed by the computer (sometimes hundreds or thousands over time). They are all blocked but I'm wondering if it is a virus or something.
Has anyone seen problems like this? I ran Virus/Spyware scans on each machine and came up with nothing. Also I looked all over the web but couldn't find anything about this problem. The problem is the same whether it is on the ZoneLabs suite or just ZoneAlarm, or on Win2k Pro or Win2k Server. Stopping WinVNC.exe seems to reduce the traffic (attempts) considerably. I tried a fresh download/install of that product but it makes no difference.
I've got a few machines like this:
- Win2k / Win2k Server
- Zone Suite or ZoneAlarm+Symantec
- Standard LAN DSL router
- TightVNC for LAN/VPN remote access
Operating System:Windows 2000 Server/Adv Server
Product Name:ZoneAlarm Internet Security Suite