Results 1 to 4 of 4

Thread: ZoneAlarm Free alerting to new behavior

  1. #1
    capn_easy Guest

    Default ZoneAlarm Free alerting to new behavior

    Hi, I'm using the free version of ZoneAlarm on my home computer.

    About a month ago I got some Google searches redirected and my Google toolbar unexpectedly changed. I got rid of it, but I've been a bit paranoid since them.

    Repeated checks of my system by Malwarebytes Anti-Malware and my antivirus, Avast! (including boot-time scans and a thorough scan) have come up clean -- other than some confirmed false positives -- but I'm still a bit paranoid.

    Yesterday as soon as I turned on my computer I was barraged by alerts from ZoneAlarm that "agent.exe" was trying to make connections. This is the name of a legit program from InstallShield, but new behavior. I've denied access to it, but it''s still trying at least once a minute to get past ZoneAlarm, mostly to establish loopback connections.

    I have logged hundreds, if not thousands, of attempts just today.

    Does this sound right to anyone? Is there anything I should be checking for?

    Thanks for your time!

  2. #2
    garywa Guest

    Default Re: ZoneAlarm Free alerting to new behavior

    There appears to be no easy or quick answer. A web search finds a lot of discussion about agent.exe. Some opinions seem to be to block it with the firewall. Its used by more programs than InstallShield. There are different files with the same name. It also depends what folder the file is in.

    Read here: http://www.file.net/process/agent.exe.html

    You'll need to try to determine what program is using agent.exe on your PC and decide if you want to let it run or not.

    EDIT: I just did a file search on both my WinXP PCs and neither one even had a file named agent.exe anywhere on it. And yes, I DO have a folder named C:\Program Files\Common Files\InstallShield on both PCs, but no file by that name.
    Last edited by garywa; December 22nd, 2009 at 03:51 PM.

  3. #3
    capn_easy Guest

    Default Re: ZoneAlarm Free alerting to new behavior

    Hi, garywa -- thanks for the reply.

    I've got an "agent.exe" file in C:\Program Files\Common Files\InstallShield\UpdateService. I can't find an option to include a screenshot, but you can see it here:

    http://i220.photobucket.com/albums/d...tos/InstSh.jpg

    Unfortunately, I can't find any way to manually set the update schedule. I believe I have at least two applications that use InstallShield -- Acronis True Image Home and RecordNow! -- but neither of them provides a way for a user to control the updates.



    Here's an example of the attempts that agent.exe is making to get out:

    http://i220.photobucket.com/albums/d.../ZA-122209.jpg

    It's fuzzy, but it's apparently trying to loopback, attempting ports in roughly numerical order -- 127.0.0.1.4519, then 127.0.0.1.4520, then 4521, 4523, etc.


    I know this isn't your program, but I'm open to opinions and suggestions. Does this look right, does it look odd, should I permit it access, etc.?

  4. #4
    capn_easy Guest

    Default Re: ZoneAlarm Free alerting to new behavior

    Okay, I may have found it. I still need Acronis, but RecordNow! was an old CD burner that I have not used in some time. I uninstalled RecordNow! and its updater, and rebooted. Since then agent.exe has not tried to get past ZoneAlarm and has not popped up in Windows Task Manager.

    I still have "agent.exe" in the UpdateService folder, but it's quiet.

    I'll know better after a little more time, but that may have fixed it.

    Thanks for your help! I appreciate it!

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •