I recently installed the latest version of ZoneAlarm Internet Security Suite v8.0.400.020 after cleanly uninstalling the previous version.
I have Program Control set to Maximum and under Custom Program Control Settings I have enabled: Advanced Program Control, Application Interaction Control and the newly added Services Control. I like to know exactly what's happening on my PC and have never had any problem resulting from enabling these advanced options in the past.
After updating the Anti-virus/spyware definitions, I will often receive an alert stating that a program is trying to unload the driver: KLIF. This alert seems to occur after an update has completed and I have opened any program shortly before (ie. Firefox). I have consistently reproduced the alert with several different programs in this manner, but it also seems to happen at random as well. I also have had a alert, randomly just after login, stating that a program (the one I have open at the time) is trying to modify the service or driver: BITS. However, if I disable Services Control and restart, these issues do not seem to occur.
I believe the KLIF driver is part of the Kaspersky Anti-virus engine used by ZoneAlarm itself and BITS is the Background Intelligent Transfer Service, a legitimate Windows Service.
Another minor, probably non-issue I have experienced is: after ZoneAlarm has updated its Anti-virus/spyware definitions it leaves a connection open to the update server which never seems to properly close. Here is the read out from TCPView:
vsmon.exe:1212 TCP my-pc:1038 a150-101-98-86.deploy.akamaitechnologies.com:http CLOSE_WAIT
The remote address is what kav.zonelabs.com resolves to on my machine.
These issues began after upgrading to the new version on both of my PCs. I have scanned my computers thoroughly for malware and everything appears to be clean. Are these problems only minor glitches or should I be more concerned? Can anyone reproduce this behavior?
Operating System:Windows XP Pro
Product Name:ZoneAlarm Internet Security Suite