Micosoft Update KB951748 (WinXP) kills ZoneAlarm Firewall

ZoneAlarm forum ^ | July 9, 2008 | ZoneAlarm forum moderator

[Constitutionalist Conservative]

We are investigating the issue with the MS update KB951748. For the time being we suggest you uninstall KB951748 until the issue has been resolved. We will post when we have more information

Best regards, Forum Moderator

[Constitutionalist Conservative]

I installed the update last night, and when I booted up this morning, ZoneAlarm was blocking all Internet traffic. Short and sweet: If you use ZoneAlarm Firewall and Windows XP, do not install KB951748 until you get the all-clear from the ZoneAlarm folks.

[Knitebane]

The code isn't done until Lotus Zonealarm won't run.

[TheWasteLand]

Thanks for the heads up.

[Mr. Jeeves]

They are doing their best to make XP update remediation so complex that customers will feel compelled to upgrade to Vista out of sheer frustration.

[JerseyHighlander]

Holy flipping, god damn it. I spent most of the last 20 hours dealing with this for several family members.

Thanks for the post.

[The_Victor]

Shell we start a pool to guess the time to the first “Buy a Mac,” response?

[Sgt_Schultze]

bump

[Pistolshot]

Buy VISTA.

[JerseyHighlander]

For your ping list, this one is a huge pain in the arse due to the user base, I’ve been recommending ZoneAlarm for years to non-techy users, I’ve been getting random calls all night day from people asking for help.

[Bahbah]

Thanks, CC.

[RckyRaCoCo]

After using ZoneAlarm for years I switched over to COMODO a couple of weeks ago....good idea or bad????

[weegee]

yeah, I was seeing something like this.

Figured MS had screwed up. No browser was working (not even Firefox).

[JerseyHighlander]

I'm uninstalling the KB951748 update on friends/customers laptops as we speak. However on my own machine I did the following and it works:

If the windows update changed the usual needed files for networking/internet, then the ZA will not see the changes and continue to use the previously known files and ignore the newer files. Even though the file names and locations are still the same from before, now the file size and checksums no longer match.

To solve this, just reset the ZA database and the ZA will be "fresh" as when it was first installed:

• Boot your computer into the Safe Mode
• Navigate to the c:\windows\internet logs folder
• Delete the backup.rdb, iamdb.rdb, *.ldb and the tvDebug files in the folder
• Clean the Recycle Bin
• Reboot into the normal mode
• ZA will be just like new with no previous settings or data

Once this is finished, reboot back into the normal mode and in the new network found windows, set the new network to Trusted.
Then do this to ensure the ZA is setup properly:

Make sure your DNS and DHCP server IP's are in your Firewall's Trusted zone. Finding DNS and DCHP servers, etc

1. Go to Run and type in command and hit 'ok', and in the command then type in ipconfig /all then press the enter key. In the returned data list will be a line DNS and DHCP Servers with the IP address(s) listed out to the side. Make sure there is a space between the ipconfig and the /all, and the font is the same (no capitals).
2. In ZA on your machine on the Firewall, open the Zones tab, click Add and then select IP Address. Make sure the Zone is set to Trusted. Add the DNS IP(s) .
3. Click OK and Apply. Then do the same for the DHCP server.
4. The localhost (127.0.0.1) must be listed as Trusted.
5. The Generic Host Process (svchost.exe) as seen in the Zone Alarm's Program's list must have server rights for the Trusted Zone.
Plus it must have both Trusted and Internet Access.

Oldsod.

http://forum.zonelabs.org/zonelabs/board/message?board.id=cfg&message.id=52727

 

 

[Mike Fieschko]

According to Some ZoneAlarm users in the dark after Microsoft patch at the Defense in Depth blog on c|net

For those who have already installed the patch, Check Point recommends users remove Microsoft Update KB951748 from their systems. Detailed instructions for doing this can be found here. Another option is to lower the ZoneAlarm Internet security setting to "medium," although Check Point doesn't recommend that.

[djf]

I’ve never been able to get ZA working correctly with Win2K

[doodad]

I found this one yesterday when I got home. I ran the usual suspects and found it was ZA pretty fast and realized the update I had installed that morning had done the deed.

[bcsco]

I had major problems with Comodo. And it was the devil to remove. It left a lot of residual stuff that I had to weed out.

FWIW, I had problem’s connecting this a.m. as well, having installed Zone Alarm a few days ago, and having Windows XP updates over the past few days. I found that my Internet Security was set to HIGH in Zone Alarm. I reset it to MEDIUM and the problems went away.

Of course, this was after about an hour of fooling around with my modem & router.

[Mike Fieschko]

I'm uninstalling the KB951748 update on friends/customers laptops as we speak. However on my own machine I did the following and it works:

[snip]

As I understand the MS update, the patch was to 'address[] the flaw in DNS made public on Tuesday by security researcher Dan Kaminsky. (I am quoting Some ZoneAlarm users in the dark after Microsoft patch.

Do your steps revert to the state where DNS can be poisoned? (If DNS can be poisoned, then for example, a person may think he's visiting his bank's web site, but in fact be visiting a fake site, and have passwords, PINs, etc., stolen.)

[Constitutionalist Conservative]

However on my own machine I did the following and it works:

If you look at the replies to that post, others are getting mixed results. Later on, the same guy ends up recommending completely uninstalling and reinstalling ZA (clearing out additional files in several folders before reinstalling).

[xone]

placeholder