Results 1 to 8 of 8

Thread: ZASS ZALog file question, and URL question

  1. #1
    mistress Guest

    Default ZASS ZALog file question, and URL question

    I am trying to understand something in my ZALog.txt and ZALog2006.12.19.txt type files.

    Almost all of the AV/treatment/s have these 2 endings:
    Scan Failed,Manual
    Scan Failed,Auto
    What does it mean and is it correctable? I tried looking through the help files to no avail!
    ================
    I have tried to post a few URL/s only to have them changed by the forum. Is there someplace in my profile control panel that needs an 'allow', to have URL/s post correctly? This gets very frustrating sometimes!
    TY!


    Operating System:
    Windows XP Home Edition
    Product Name:
    ZoneAlarm Internet Security Suite
    Software Version:
    6.5

    Message Edited by Mistress on 12-23-200612:27 PM

  2. #2
    Join Date
    Dec 2002
    Location
    Mikado Michigan
    Posts
    2,596

    Default Re: ZASS ZALog file question, and URL question

    Basically what it says. The scan failed, and it was either a manual scan or an automatic scan. Is it the same file? What is the name?As for the links, what kind of links were you trying to post?
    My homes are SpywareHammer.com and DonHoover.net and BleepingComputer.com


    Consumer Security - 2011 & 2012

    Tilting at windmills hurts you more than the windmills.
    -From the Notebooks of Lazarus Long
    Senior of the Howard Families

  3. #3
    mistress Guest

    Default Re: ZASS ZALog file question, and URL question

    re's Hoov, Happy Holidays!
    Ok in the logs, 1st. I'm looking at the file/s and it seems it is almost everything that gets scanned is getting the failed. Having the HUGE amount of HDD/s that I have, I have been VERY specific as telling ZASS what to scan. Staying away from things like .jpg or .wav. Obvious things. I have instructed ZASS to scan all of c:/windows/, all of what is downloaded onto my machine, all boot drives, basically anything that accesses the net.. ftp, browsers...
    Here are some examples of what the ZaLog.txt looks like. I've pulled a few lines in assorted areas: ZoneAlarm Logging Client v6.5.737.000
    Windows XP-5.1.2600-Service Pack 2-SMP
    type,date,time,source,destination,transport (Security)
    type,date,time,virus name,file name,mode,e-mail id (Anti-Virus)
    type,date,time,source,destination,action,service (IM Security)
    type,date,time,source,destination,program,action (Malicious Code Protection)
    type,date,time,action,product,file,event,subevent, class,data,data,... (OSFirewall)
    type,date,time,name,type,mode (Anti-Spyware)
    ZLUpdate,2006/12/25,08:37:30 -5:00 GMT,,,Auto
    ZLUpdate,2006/12/25,08:37:34 -5:00 GMT,,,Auto
    AV/treatment,2006/12/25,11:00:04 -5:00 GMT,,C:\Documents and Settings\MISTRESS\NTUSER.DAT,Scan Failed,Auto
    AV/treatment,2006/12/25,11:00:04 -5:00 GMT,,C:\Documents and Settings\MISTRESS\ntuser.dat.LOG,Scan Failed,Auto
    AV/treatment,2006/12/25,11:00:04 -5:00 GMT,,C:\Documents and Settings\MISTRESS\Local Settings\Temporary Internet Files\Content.IE5\index.dat,Scan Failed,Auto
    AV/treatment,2006/12/25,11:01:06 -5:00 GMT,,C:\Documents and Settings\MISTRESS\Cookies\index.dat,Scan Failed,Auto
    AV/treatment,2006/12/25,11:01:06 -5:00 GMT,,C:\Documents and Settings\MISTRESS\Application Data\Webroot\Spy Sweeper\Logs\061225100002.ses,Scan Failed,Auto
    AV/treatment,2006/12/25,11:01:10 -5:00 GMT,,C:\Documents and Settings\MISTRESS\Application Data\The Bat!\PB\Attach\00000005.MSG>unknown,Scan Failed,Auto
    AV/treatment,2006/12/25,11:01:42 -5:00 GMT,,C:\Documents and Settings\MISTRESS\Application Data\Mozilla\Firefox\Profiles\tvypl7ay.default\ext ensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\chrome\fireftp.jar>content/blank.html,Scan Failed,Auto
    AV/treatment,2006/12/25,11:02:06 -5:00 GMT,,C:\Downloads\New Downloads\EvID4226Patch223d-en.zip>changelog-en.txt,Scan Failed,Auto
    AV/treatment,2006/12/25,11:04:22 -5:00 GMT,,C:\WINDOWS\WindowsUpdate.log,Scan Failed,Auto


    THEN... after all of those fail, it continues with:

    AV/scan,2006/12/25,11:11:32 -5:00 GMT,Multiple Files,Scan Completed,Auto
    PE,2006/12/25,11:45:20 -5:00 GMT,EAX Console Application,C:\Program Files\Creative\SBAudigy2ZS\EAX\EAX.exe,0.0.0.0:0,N/A
    PE,2006/12/25,11:58:20 -5:00 GMT,Windows Media Player,C:\Program Files\Windows Media Player\wmplayer.exe,207.46.210.106:53,N/A
    PE,2006/12/25,11:58:24 -5:00 GMT,Microsoft Windows Media Configuration Utility,C:\Program Files\Windows Media Player\setup_wm.exe,207.46.210.106:53,N/A
    PE,2006/12/25,11:59:08 -5:00 GMT,Creative AudioHQ,C:\Program Files\Creative\SBAudigy2ZS\AudioHQ\AudioHQU.exe,0. 0.0.0:0,N/A

    AND it finishes doing the PE, and that's that...
    Is this normal? It surely looks strange to me!
    ===============
    ok, now for the links. I notice in some posts in the forum type lists there are little .gif/s that say "URL"
    and inside of those posts there are real URL/s. Every time that I have tried to post a URL it is not clickable.
    It is like posting a text, rather than a link.
    Here is an example, I hope this shows up:
    http://forum.zonelabs.org/zonelabs/b...d=15640#M15640
    then go to my post: "Re: ATTENTION Forum-Moderator - Your Help Is Needed ASAP Please" on page
    http://forum.zonelabs.org/zonelabs/b...ssage.id=15640
    The URL there, https://www.zonelabs.com/store/conte...ch_support.jsp as well as the ones in this post should be clickable.

    Thank you soooo much!!

  4. #4
    mistress Guest

    Default Follow-up - More error log info

    I looked in ZASS alerts and logs. I clicked on anti-virus. I have it set to treat. I have it set to show
    200 items.
    This is the actual error. On every file, the error is identical.

    Decription Anti-virus attempted but failed to scan a file and/or system for viruses
    Date / Time 2006/12/25 11:11:20-5:00 GMT
    Type Treat
    Virus name
    Filename C:\WINDOWS\$NtServicePackUninstall$\wmplayer.chm&g t;/htm/customizingtheplayer.htm
    Action Error: E004000Bh
    Mode Auto
    E-mail

    This error "Error: E004000Bh" is on every item scanned.

  5. #5
    Join Date
    Dec 2002
    Location
    Mikado Michigan
    Posts
    2,596

    Default Re: Follow-up - More error log info

    OK, PE is where a program asks for connection permissions. Those show up whenever a program needs access and has to ask.About the fails, It appears from what I see, that the files its failing to scan are open at the time, and can't be scanned. I will check on that though.
    My homes are SpywareHammer.com and DonHoover.net and BleepingComputer.com


    Consumer Security - 2011 & 2012

    Tilting at windmills hurts you more than the windmills.
    -From the Notebooks of Lazarus Long
    Senior of the Howard Families

  6. #6
    mistress Guest

    Default Re: Follow-up - More error log info

    Yes, thank you for that. I am very curious as to why almost everything that is suppose to be scanned is getting an error.

    I notice, when I ask about the correct way to post URL/s you refer to the site donhoover.net. I have looked at the site before and maybe I missed it, but I didn't see the references to creating URL/s. Is that your site, BTW?

  7. #7
    Join Date
    Dec 2002
    Location
    Mikado Michigan
    Posts
    2,596

    Default Re: Follow-up - More error log info

    Yep. Its just part of my signature that is automatically added to each post I make.
    My homes are SpywareHammer.com and DonHoover.net and BleepingComputer.com


    Consumer Security - 2011 & 2012

    Tilting at windmills hurts you more than the windmills.
    -From the Notebooks of Lazarus Long
    Senior of the Howard Families

  8. #8
    mistress Guest

    Default Re: Follow-up - More error log info

    Awesome! and God bless you for serving!

    I think I am going to send a copy of that weird log to tech support. I have looked, even on your site and I don't think logs are suppose to have more can't than cans... if you know what I mean.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •