Results 1 to 5 of 5

Thread: why are there seemingly unrelated pgm in the list of COMPONENTS ?

  1. #1
    breaker Guest

    Default why are there seemingly unrelated pgm in the list of COMPONENTS ?

    I'm trying out the pro version of Zonealarm. I've searched the forum for my question... but too many hits. Please show me a link if my question has already been answered.
    So far, after installing the Zonealarm Pro, I've executed nothing but IE 6.
    While trying to go to a webpage (not the first during my IE session), I got the popup about IE trying to use components. When I clicked on 'details' the new window showed a lot of microsoft modules, but also other seemingly unrelated modules - like: navshell.dll (Norton Antivirus Shell), pgpmn.dll (PGPshell Menu Extensions), RARext.dll (I haven't used RAR unzipper in
    months...), SYNCUI.DLL (Windows Briefcase), WFSHELEX.DLL (Norton Wipeinfo Shell Extension), WZSHLEX1.DLL (Winzip Shell extension dll).
    I wasn't "using" any of the products I named above (except for IE). I've NEVER used Norton Wipeinfo, though it's installed.
    Question 1: What's going on? I
    continue to get
    the "components" warning popup
    as I continue to use
    IE, but, so far, those unrelated components have not shown up again. But, why did they? Is it a problem with Zonealarm?
    Are those products trying to phone home? Are they queued up somewhere, waiting to phone home again? Where, the registry? I used MSInfo to see loaded modules. They're not there - atleast, not now.
    When I got the above popup with the seemingly unrelated components, I denied access. IE then, of course, couldn't show the webpage I wanted to see. In fact, IE became unusable from then on, until I restarted it.
    The Program Control/Components panel shows the above unrelated components with the "?" (ASK) mark in the ACCESS column.
    Question 2: What is the effect of the "?" (ASK) mark in the ACCESS column for those unrelated components? If they ever try to access the net again, will zonealarm ASK for their access? Zonealarm has not so far asked for their access during my 2 days of using IE. How do I test to make sure that these unrelated modules do not get access?
    Addendum:I get the 'IE and components are trying to access the internet' popup not only while loading a webpage, sometimes I get it at any time after a webpage has been loaded - e.g. while I'm reading text on a webpage. The last "component" was WFXSEH32.DLL
    (Shell extension for ACT phonebook integration DLL).This makes it seem like these modules are trying to phone home at any chance they get. I wonder if they'll try to do the same thing when I using an FTP client?Very annoying.
    About 10 mins after i got the above popup about the component WFXSEH32.DLL I had restarted IE and browsed another webpage. I then got the "IE and components trying to access internet" popup again, and, again, the component was WFXSEH32.DLL. Previously, I had denied access. In the component list panel, WFXSEH32.DLL had the "?" mark. This time I allowed access. Now, WFXSEH32.DLL has the check mark (allow).Question 3: Does this mean that ZA will now never warn about
    WFXSEH32.DLL component trying to access the internet?
    This behavior is Unlike the behavior ZA takes for main programs!
    For IE, for instance, if I don't check
    "remember" , ZA will always ASK.

    Operating System:
    Windows 98-SE (Second Edition)
    Product Name:
    ZoneAlarm Pro
    Software Version:

    Message Edited by breaker on 02-27-200607:23 AM

    Message Edited by breaker on 02-27-200608:09 AM

  2. #2

    Default Re: why are there seemingly unrelated pgm in the list of COMPONENTS ?

    Hi Breaker,

    Zonealarm has both an internet firewall and an operating firewall. The former controls access to the internet the latter controls a programs ability to run on your machine. If you have your
    Zonealarm running with the default settings the operating system firewall will automatically scan your hard drive and locate all executable files (program components) make a list of them and decide if they are obviously benign and hence allowwed an access granted status. Those that are obviously bad are given a denied status. When ZA can't decide
    you get a program alert and are asked to decide yourself. All the components that are labeled with a question mark in the access column are components that will generate a program alert once they try to run. When you think about a program remember that all of it's functions are not all running at that same time which is why you get to see so many pgm components you have never seen before. All those access questions are about programs running. (many are probably running in the back ground) not programs accessing the internet.

    Message Edited by ledoc on 02-27-200609:36 PM

  3. #3
    jarvis Guest

    Default Re: why are there seemingly unrelated pgm in the list of COMPONENTS ?

    I will add the following:

    You should really leave Program Control level at Medium for a few weeks whilst ZoneAlarm learns the components that your programs use. Then you can put it up to High if you wish.

    The way component control works (Program control on High) is any program given rights to access the internet in program control is allowed to have access, so long as it only loads components that have been previously seen. Those are assumed to be good. If it loads a component that ZA has not previously seen, you get a component alert. If you deny, you are denying the whole program until it is restarted. That's because Zonealarm cannot probe right into the program and see whether it's the newly loaded component that is actually requiring access or just the program doing it's regular activity.

    Some of the seemingly un-related program components you saw when IE loaded can be explained by the fact that Internet Explorer and Windows Explorer are more or less the same program. Things like that WipeInfo program that add an item to the right-click menu of Windows Explorer will also be loaded by Internet Explorer.

  4. #4
    breaker Guest

    Default Re: why are there seemingly unrelated pgm in the list of COMPONENTS ?

    I DO have those "unrelated" components as windows explorer context menu items. Thanks for enlightening me.
    Question: If one of those "components" that are loaded by IE (or windows explorer) tries to access the internet, will ZA warn me (about the component trying to access the internet)? Will ZA then place the component in the Programs list and not the Components list?

  5. #5
    jarvis Guest

    Default Re: why are there seemingly unrelated pgm in the list of COMPONENTS ?

    Well, you or ZoneAlarm has no way of knowing if the recently loaded "Component" is what is responsible for the access. So really it's asking you "This program has loaded a new component, do you STILL trust the program to have the access you previously gave it?"

    If Program Control is on Medium and component control enabled, all components loaded are added to the list with a green tick (component control is in learning mode).

    Once Program Control is on High and component control is enabled, all components loaded are added to the list with a blue question mark. Then, if a program accesses the net after loading one of these components (with a ?) you get the "component loading" alert.

    Make sense?

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts