ZonAlarm Pro V5.1 / port 1025

[iadom]

A heads up for anyone using ZoneAlarm that has been updated to version 5.1.
I had not visited grc.com for a long while now, but last night I had nothing better to do , I am well aware of the antipathy towards Mr Gibson and his self promotion, however I was glad that on this instance I ran the Shields Up / Common ports scan. It reported that port 1025 was open. This is the first time any ports had shown open in over 4 years.
A quick look at ZoneAlarm forums and checking the program itself revealed that several people had encountered this problem after the latest update. I am not sure how ( it wasn't me guv) but Generic Host for Win 32 Services had been granted server permissions to the internet as well as the trusted zone, and was keeping port 1025 open.
If like me you use ZoneAlarm without a router and you have not done a check on open ports since the latest ZoneAlarm update it is worthwhile doing so.

In the program control panel in ZoneAlarm, make sure that Generic host for Win 32 Services only has server permissions to the trusted zone and is blocked to the internet.

[Stuart]

Originally Posted by iadom

A heads up for anyone using ZoneAlarm that has been updated to version 5.1.
I had not visited grc.com for a long while now, but last night I had nothing better to do , I am well aware of the antipathy towards Mr Gibson and his self promotion, however I was glad that on this instance I ran the Shields Up / Common ports scan. It reported that port 1025 was open. This is the first time any ports had shown open in over 4 years.
A quick look at ZoneAlarm forums and checking the program itself revealed that several people had encountered this problem after the latest update. I am not sure how ( it wasn't me guv) but Generic Host for Win 32 Services had been granted server permissions to the internet as well as the trusted zone, and was keeping port 1025 open.
If like me you use ZoneAlarm without a router and you have not done a check on open ports since the latest ZoneAlarm update it is worthwhile doing so.

In the program control panel in ZoneAlarm, make sure that Generic host for Win 32 Services only has server permissions to the trusted zone and is blocked to the internet.

Do you you Windows File Sharing enabled (for some reason, XP does this by default, which IMO is stupid for a home PC)? Just did a google search and it seems that Windows uses this port either for Windows File Sharing, or for a system called Dcom (communication system for program components). If you run a program called "Dcomcnfg", you can disable dcom, which may release the port.

You should be aware that by stopping dcom or blocking the port, you may stop various programs (including Windows Update and Automatic Updates) working. However, merely blocking it's server rights (as I notice you have done) is OK.

[iadom]

Originally Posted by scastle

Do you you Windows File Sharing enabled (for some reason, XP does this by default, which IMO is stupid for a home PC)? Just did a google search and it seems that Windows uses this port either for Windows File Sharing,

Always have file sharing disabled, strange thing is this port has only scanned as "open" since the latest update even though I did not alter the priviledges for Generic host myself.

[Stuart]

Originally Posted by iadom

Always have file sharing disabled, strange thing is this port has only scanned as "open" since the latest update even though I did not alter the priviledges for Generic host myself.

Odd

[greencreeper]

See here for how to configure Generic Host Processes for Win32 Services

You won't get me upgrading I tried version 5 and it was a nightmare. There's no guarantee 5.1 is any better - I'll wait for version 6.

[TheBlueRaja]

Im not impressed with Zone Alarm, i thought after posting here before about various issues it have given me at previous releases i would give it a shot.

But its very clumsy to use, has reported 9459 Blocked intrusions (Since last thursday night, 445 of which are high rated (come on)) which could be seen as a good thing but seems excessive and the logs are crap.

Im just gonna buy Norton again methinks.

[greencreeper]

Originally Posted by theblueraja

Im not impressed with Zone Alarm, i thought after posting here before about various issues it have given me at previous releases i would give it a shot.

But its very clumsy to use, has reported 9459 Blocked intrusions (Since last thursday night, 445 of which are high rated (come on)) which could be seen as a good thing but seems excessive and the logs are crap.

Im just gonna buy Norton again methinks.

Zone Alarm or Zone Alarm Pro? I created a rule that prevents ZAP from logging the common connections attempts - mostly viruses. Keep the logs short and reduces disk I/O. High rated usually means that the connection was to a port <1024 and could therefore be a port scan.

[Tezcatlipoca]

I'm still using version 4.5. Already heard lots of bad things about v5 before this...

[iadom]

Originally Posted by greencreeper

See here for how to configure Generic Host Processes for Win32 Services

You won't get me upgrading I tried version 5 and it was a nightmare. There's no guarantee 5.1 is any better - I'll wait for version 6.

I had a bit of fun with this last night. I had used that link and set up the expert rules without problems and all seemed fine.
Last night I registered a new PC via the STB and whilst it was downloading almost 25 MB of Windows updates I tried to use my Zen dial up account on my main PC. I found that I could not gain internet access and traced it to ZA Pro that reported that Generic Host had been blocked from logging onto the Zen DNS servers. I had to set the dial up connection to specific DNS servers and modify the expert rules to allow connection to these to clear the problem, I thought I was doing a "Waynie" for a short while.
Worth remembering if you have dial up and BB connections.

[greencreeper]

Originally Posted by iadom

I had a bit of fun with this last night. I had used that link and set up the expert rules without problems and all seemed fine.
Last night I registered a new PC via the STB and whilst it was downloading almost 25 MB of Windows updates I tried to use my Zen dial up account on my main PC. I found that I could not gain internet access and traced it to ZA Pro that reported that Generic Host had been blocked from logging onto the Zen DNS servers. I had to set the dial up connection to specific DNS servers and modify the expert rules to allow connection to these to clear the problem, I thought I was doing a "Waynie" for a short while.
Worth remembering if you have dial up and BB connections.

Why did you have to specify DNS servers for dial-up? I would have thought it would be enough to just put the DNS servers in your ZAP rules??

[iadom]

Originally Posted by greencreeper

Why did you have to specify DNS servers for dial-up? I would have thought it would be enough to just put the DNS servers in your ZAP rules??

That is what I thought, I have had two Zen DNS servers in my trusted zone for a long time now, I used the Zen ones when the Ntl DNS was a bit shaky a while ago, but both my BB and dial up connection are, or where set to obtain DNS automatically and I have had no problems for ages, it is only since setting up expert rules for Generic Host for Win 32 that my dial up connection failed. ZA Pro kept blocking connection attempts to 212.23.3.11 which is a Zen Dns server but not the two I had in my trusted zone. I have now set expert rules to allow 212.23.8.1 and 212.23.8.6 and set dial up account to use these and the problem is no more. I did try to add these to "Rules" but connection still failed until I specified them in dial up settings.
Using the link you provided to the letter, it blocked anything other than the specific Dns servers you enter into rules on dial up.

I cannot explain why my BB connection works with "Obtain DNS automatically" and yet the dial up is blocked with the same settings.

[greencreeper]

Originally Posted by iadom

That is what I thought, I have had two Zen DNS servers in my trusted zone for a long time now, I used the Zen ones when the Ntl DNS was a bit shaky a while ago, but both my BB and dial up connection are, or where set to obtain DNS automatically and I have had no problems for ages, it is only since setting up expert rules for Generic Host for Win 32 that my dial up connection failed. ZA Pro kept blocking connection attempts to 212.23.3.11 which is a Zen Dns server but not the two I had in my trusted zone. I have now set expert rules to allow 212.23.8.1 and 212.23.8.6 and set dial up account to use these and the problem is no more. I did try to add these to "Rules" but connection still failed until I specified them in dial up settings.
Using the link you provided to the letter, it blocked anything other than the specific Dns servers you enter into rules on dial up.

I cannot explain why my BB connection works with "Obtain DNS automatically" and yet the dial up is blocked with the same settings.

Hmmm.

Source: mycomputer, 127.0.0.1, [your DNS server IP address(es)], trusted zone;
Destination: mycomputer, 127.0.0.1, [your DNS server IP address(es)], trusted zone;

You could put all the servers, including 127.0.0.1, in the trusted zone - that's what I have done. Then the Firewall expert rule (as oppose to Program expert rule) is just MyComputer --> Trusted and Trusted --> MyComputer. I would expect that to work, but I occasionally have trouble with my NTP client and DNS - connections are blocked. I have to remove and re-add my DNS servers to the trusted zone. No doubt something related to the database.

[edit] All my programs have access to the Trusted Zone - I tend to put servers in that zone and then use Program expert rules to limit connections to particular protocols/ports.

Firewall expert rules take priority over anything else, hence the connection to the Zen DNS server being blocked - the one not in the Trusted zone. I only use Firewall expert rules for limiting log entries.

interesting, I did some scans at grc.com, the only port with a problem was 113 showing closed, not stealthed - no doubt due to the router

[Tezcatlipoca]

Originally Posted by homealone

interesting, I did some scans at grc.com, the only port with a problem was 113 showing closed, not stealthed - no doubt due to the router

Probably.

Although some routers do not normally stealth port 113, it is possible:

http://grc.com/port_113.htm

[greencreeper]

Originally Posted by homealone

interesting, I did some scans at grc.com, the only port with a problem was 113 showing closed, not stealthed - no doubt due to the router

What application uses that port? I had a look at the official list and it just says:

ident 113/tcp
auth 113/tcp Authentication Service
auth 113/udp Authentication Service

Which tells me alot

[edit] Ah - Matt's link helps