He could export his ZAP settings - Overview pane... Preferences tab... Click "Backup". Then post the file here for folks to look at. Not sure how else to resolve this problem - need to know what each program does and what permissions have been given. Don't just click "Yes" at every alert
Once the program is found, he can then block it and/or reconfigure it to listen locally.