Page 1 of 2 12 LastLast
Results 1 to 10 of 15

Thread: New ZAES installation hangs on expert rules

  1. #1
    Zac Schroff Guest

    Default New ZAES installation hangs on expert rules

    I have just set up a new, completely clean installation (onto a recently zeroed hard disc) of Windows XP Pro SP3. Outside of the required drivers (ATI video and ThinkPad power), the only thing program I added so far was WinRAR (so no office suite, no utilities, no antivirus, no firewall, or at least none of that other than what I am forced to have by Uncle Bill and his All Knowing Installer).

    I installed ZoneAlarm Extreme Security 9.1.008.000 (TrueVector and driver also have this version number), with antivirus engine 8.0.2.42, antispam engine 6.0.0.2383, and forcefield 1.5.53.4. I allowed it to update itself to antivirus DAT file 997624986. I am using the trial version to see if I like it (have been using an older ZA Pro for years and been really happy with it).

    I want to restrict what ports and protocols *each* program can use (my experience with certain programs has been extremely unnerving, and I have seen ZA confused into believing a program was something else). So, I enabled 'advanced program control', 'timing attack prevention', 'application interaction control', 'component control', and 'services control'. I also disabled 'microsoft catalog utilization'.

    My system still works fine at this point, and I can do sundry things like ping my router, telnet to it, touch a few select outside sites (but not with IE yet, since I don't trust it at all). Now, I want to set it up so that, for example, the MS telnet client is only allowed TCP connections on port 23. I launch the MS telnet client once so it appears in ZA's list, then kill it. Now, I go to the expert settings in ZA's program list and add a single rule: ALLOW TCP port 23. Now, telnet again to another machine and my Windows box is hung hard (need to power cycle to get it back). Reboot, go back to the programs list, pick telnet again, and change the rule so it's ALLOW TCP port 1234. Telnet to another machine and all is well (since apparently ZA's default expert rule is ALLOW and default telnet port is 23). Try telnet again, but this time use port 1234 instead. Windows hangs hard; must power cycle again. Get back to the expert page for the telnet program and change the action to DENY. Try telnet again on port 23, fine. Now port 1234 and windows hangs hard again.

    Basically, it looks to me, after a few hours of serious frustration, that any hit in this version of ZA on an expert rule for a program simply hangs the entire system hard. I have tried to do similar things with other programs (say, the ping program) and the results are always the same -- any hit to a program's 'expert' rule (even an 'everything else' rule at the end of a set of expert rules) will hang the entire machine. No BSOD, no dialogue, no response from mouse or keyboard or network or other input device -- just hard hang that requires a power cycle or hardware reset strobe to recover.

    Oh, this is probably a moot point within this context, but I also noticed that I could not set the message type when I choose ICMP as the protocol in the expert settings.

  2. #2
    Join Date
    Nov 2004
    Location
    localhost
    Posts
    17,292

    Default Re: New ZAES installation hangs on expert rules

    Hi!
    the best is to report directly to ZA technical support. If it is a bug it needs to be logged and troubleshooted.

    Link to support in my signature.

    Let us know when you have news about it. It may help other users with your same problem.

    Thanks,
    Fax

    Click here for ZA Support
    Monday-Saturday 6am to 10pm Central time
    Closed Sundays and Holidays

  3. #3
    Zac Schroff Guest

    Default Re: New ZAES installation hangs on expert rules

    Quote Originally Posted by fax View Post
    the best is to report directly to ZA technical support. If it is a bug it needs to be logged and troubleshooted.
    To quote Jeremy in tech support:

    I understand that Expert rules are not working properly for you.
    I apologize for any inconvenience, but we do not support expert rules here.
    Jeremy suggested that for support on expert rules, I should ask in the forums. I have now been brushed off by zeroth-level tech non-support at yet another company. Bah.

    If the product can not work properly in a new and clean installation, I know it will not work once I have the system configured to my taste. If I can not get this resolved, I have far less reason to buy this version (maybe any future version similarly) since the 'expert rules' feature is one main reason I want ZA instead of the lame thing that ships in Windows.

    I have reiterated to Jeremy that I do not want help *making* rules, but that I am experiencing hard hangs whenever something actually hits a rule, even if it is an ALLOW rule and the thing that hit the rule is not a critical Windows component. I will post any followup I get here, but that first response was very uninspiring.

  4. #4
    Join Date
    Nov 2004
    Location
    localhost
    Posts
    17,292

    Default Re: New ZAES installation hangs on expert rules

    Uuuhm, strange....
    That person must have misunderstood your question. Try again with a different person.

    Can you post the ticket number? To report to ZA...

    Thanks,
    Fax

    Click here for ZA Support
    Monday-Saturday 6am to 10pm Central time
    Closed Sundays and Holidays

  5. #5
    Zac Schroff Guest

    Default Re: New ZAES installation hangs on expert rules

    Quote Originally Posted by fax View Post
    That person must have misunderstood your question. Try again with a different person.
    Can you post the ticket number? To report to ZA...
    How to try with another person? Just send another request?

    Is this what you want: Technical Support Ticket: bsod / crash ISSUE=709125 PROJ=4

    Responding to my followup, Jeremy suggested that I should reset my settings to the defaults and try it again (same result, just as if reinstalling from scratch). I took an image of the drive before installing ZA, and have been reverting to the image after each failed installtion, and reinstalling from there. No longer wiping the drive between iterations; it takes too long (but the restore of an image essentially does a 'fast' format of the volume before restoring the files).

    I'm getting the same behaviour from ZAES and ZAP 8.0.400.020 on the same configuration. I plan on testing it against some other versions, going back to some ZA 7 versions, but the next version back I was able to find from a site I am willing to trust a little was version 3.

    Does anybody actually use this feature, or at least test it? It's rather frustrating to find one of the most attractive features of ZA no longer works, though I just checked and the version I'm running on one of my older boxes is 2.6.357 -- which works perfectly well to allow me to specify only certain protocols and ports can be used by specific programs. Somehow I doubt that version will work well with WinXP, and feel almost certain it will not work at all on Win7 64b.

    More (probably useless information): The system under test is a ThinkPad A31 with BIOS G1.13, microcontroller firmware G1.05, a 2.6GHz Intel P4 'mobile' processor (tried running at 2.6GHz and at 1.2GHz), 1GB of DRAM, a Hitachi 7200RPM 40GB IDE hard disc, docking station. I think it meets the system requirements.

  6. #6
    bunnyfugger Guest

    Default Re: New ZAES installation hangs on expert rules

    Quote Originally Posted by fax View Post
    Hello,
    well, so they have answered and suggested to reinstall. Then please come back to them to report it does not work.
    If there was a problem with expert rule since version 8 the forum should have been flooded of reports. I am afraid it may be limited to your PC. I don't use myself expert rules, so I cannot really help. Have you tried with a different PC? Have you tried with different rules?

    Cheers,
    Fax

    Hi Fax and Zac,

    I can confirm that expert rules DO cause a system hang in version 9.1. on my system. The same rules worked OK in version 8.

    I've disabled mine as Tech Support don't seem interested in the problem.

    Regards....

    Windows Xp SP 3
    ZoneAlarm Security Suite version:9.1.008.000
    TrueVector version:9.1.008.000
    Driver version:9.1.008.000
    Anti-virus engine version:8.0.2.42
    Anti-virus signature DAT file version:997740096
    AntiSpam version:6.0.0.2383

  7. #7
    Zac Schroff Guest

    Default Re: New ZAES installation hangs on expert rules

    Quote Originally Posted by bunnyfugger View Post
    I can confirm that expert rules DO cause a system hang in version 9.1. on my system. The same rules worked OK in version 8.
    The ZA people don't seem to care at all. They should remove features they have no desire to test or support, lest those neglected features become security holes instead of mere bugs.

    Can you tell me which particular version 8 release worked for you? Thanks!

  8. #8
    bunnyfugger Guest

    Default Re: New ZAES installation hangs on expert rules

    Quote Originally Posted by Zac Schroff View Post
    The ZA people don't seem to care at all. They should remove features they have no desire to test or support, lest those neglected features become security holes instead of mere bugs.

    Can you tell me which particular version 8 release worked for you? Thanks!

    Hi,

    The version was 8.0.400.020....

    Cheers...

  9. #9
    Join Date
    Nov 2004
    Location
    localhost
    Posts
    17,292

    Default Re: New ZAES installation hangs on expert rules

    Hi!
    Sorry to hear that it seems a long standing issue.

    I will copy this thread to the product feedback section. To have it looked at ZA product management level.

    Thank you.

    Cheers,
    Fax

    Click here for ZA Support
    Monday-Saturday 6am to 10pm Central time
    Closed Sundays and Holidays

  10. #10
    MikeSpecialist Guest

    Default Re: New ZAES installation hangs on expert rules

    Moved here from duplicate post at http://forums.zonealarm.com/showthread.php?p=271398:

    Hello all, I have been struggling with this issue since June of 2009 when 8.0.400.020 was released. As soon as I updated from 8.0.298.000 the expert rule freezing started. The OP is right about the useless tier 1 support. "It's your operating system or other security software, we can't possibly have an issue." My Windows install was coming up on 18 months old so I decided to reload this morning. I started out with a clean WinXP Pro SP3 32-bit install. Nothing except drivers and ZAP 9.1.008.000. I was able to fully deny applications' access (with basic 'X') with success; but as soon as I applied an expert rule the PC locked as described earlier requiring a hard reset. I decided to wipe AGAIN and reloaded WinXP Pro SP3 32-bit (best OS ever, by the way). Same scenario as before, nothing except nVidia, Creative and Intel drivers with ZAP 8.0.400.020. To my horror the hard locking occurred just as with 9.x. I uninstalled 8.0.400.020 (no format and reload) and installed 8.0.298.000. Like a breath of fresh air everything now works absolutely perfectly.

    Short version: Every version of ZAP after 8.0.298.000 locks up when using Expert rules.

    I can't believe CheckPoint has allowed this severe, crippling issue to permeate so many revisions of the software. They should take a hard look at this incredibly easy-to-replicate issue. I understand they can't troubleshoot every end users' OS issues, but this is coming from an IT expert and 7+ year user of CheckPoint (formerly ZoneLabs) products.

    Link for ZAP 8.0.298.000:
    download dot zonealarm dot com/bin/free/1043_en/zapSetup_80_298_000_en.exe

    -----------------------
    Sky Soldiers's Avatar
    Sky Soldiers Sky Soldiers is online now
    Senior Member

    Join Date: Aug 2009
    Posts: 941
    Default Re: New ZAES installation hangs on expert rules
    [QUOTE=MikeSpecialist I was able to fully deny applications' access (with basic 'X') with success; but as soon as I applied an expert rule the PC locked as described earlier requiring a hard reset. [/QUOTE]

    Readme for ZoneAlarm 9.1

    Location : "C:\Program Files\Zone Labs\ZoneAlarm\readme.html"

    Upgrade issues :

    c. Expert firewall rules not blocking traffic are allowed by program permission. When you give a program permission to communicate and create an expert rule that is set to block, the program permission takes precedence. For example, if you allow the "ping" program and make a rule to block ping replies from and ping another computer, the ping reply is allowed. Though your rule said block, the fact the program was allowed means a reply is allowed.

    Have no other suggestions to address your issue.

    Have a nice Day
    Sky Soldiers
    View Public Profile
    Send a private message to Sky Soldiers
    Find all posts by Sky Soldiers

    -----------------------

    #15
    Old Yesterday, 09:20 AM

    MikeSpecialist MikeSpecialist is offline
    Junior Member

    Join Date: Nov 2009
    Posts: 2
    Default Re: New ZAES installation hangs on expert rules
    Quote:
    Originally Posted by Sky Soldiers View Post
    c. Expert firewall rules not blocking traffic are allowed by program permission. When you give a program permission to communicate and create an expert rule that is set to block, the program permission takes precedence.
    Thanks for the suggestion, I should have been clearer in my post. I am aware of that behavior and did set the program permissions to deny and allow with the same results. I think that issue applies to upgrades, these are clean installs. Even if that issue applied here, it at worst case would allow unwanted traffic. That doesn't explain hard freezing. Also, in 8.x and every previous version I've ever used Expert rules on the behavior is the following (as it logically should be):

    Program deny + Expert rule allowing some or any traffic = no traffic allowed

    Program allow + Expert rule denying all traffic = no traffic allowed

    Program allow + Expert rule denying some traffic = traffic allowed except that blocked by Expert rule
    MikeSpecialist
    View Public Profile
    Send a private message to MikeSpecialist
    Find all posts by MikeSpecialist

    -----------------------

    #16
    Old Yesterday, 09:28 AM
    Sky Soldiers's Avatar
    Sky Soldiers Sky Soldiers is online now
    Senior Member

    Join Date: Aug 2009
    Posts: 941
    Default Re: New ZAES installation hangs on expert rules
    Quote:
    Originally Posted by MikeSpecialist View Post
    Thanks for the suggestion, I should have been clearer in my post. I am aware of that behavior and did set the program permissions to deny and allow with the same results. I think that issue applies to upgrades, these are clean installs. Even if that issue applied here, it at worst case would allow unwanted traffic. That doesn't explain hard freezing. Also, in 8.x and every previous version I've ever used Expert rules on the behavior is the following (as it logically should be):

    Program deny + Expert rule allowing some or any traffic = no traffic allowed

    Program allow + Expert rule denying all traffic = no traffic allowed

    Program allow + Expert rule denying some traffic = traffic allowed except that blocked by Expert rule
    Fully comprehend your post now.

    Have a nice Day
    Sky Soldiers
    View Public Profile
    Send a private message to Sky Soldiers
    Find all posts by Sky Soldiers

Page 1 of 2 12 LastLast

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •