# ZoneAlarm: How robust is this PC firewall? **URL:** \ **Category:** Factual Questions\ **Created:** [September 10, 2003, 1:17am UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649 "2003-09-10T01:17:31Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![Shrinking\_Violet](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Shrinking\_Violet](https://boards.straightdope.com/u/Shrinking_Violet)\ **Post date:** [September 11, 2003, 5:23pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/41 "2003-09-11T17:23:03Z")
> [@](#): > > \*Originally posted by Mort Furd \* > \*\*Shrinking Violet: > > Cork those holes. \*\* Thanks **Mort Furd** , but how? šŸ˜• And how come, with Zone Alarm running, _none_ of my ports show up as ā€œstealthā€? (All but the three open ports show up as closed). šŸ˜• Kinda worried, but in over my head here ā€¦ :rolleyes: Julie ---
**Author:** ![jmizzou](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jmizzou](https://boards.straightdope.com/u/jmizzou)\ **Post date:** [September 11, 2003, 5:50pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/42 "2003-09-11T17:50:15Z")
> [@](#): > > \*Originally posted by Shrinking Violet \* > And how come, with Zone Alarm running, _none_ of my ports show up as ā€œstealthā€? (All but the three open ports show up as closed). šŸ˜• In the ā€œFirewallā€ section, make sure "Internet Zone Security? is set to High. Under the ā€œZonesā€ tab (same section), make sure your internet connection is listed as ā€œInternetā€ and not ā€œTrusted.ā€ ---
**Author:** ![jmizzou](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jmizzou](https://boards.straightdope.com/u/jmizzou)\ **Post date:** [September 11, 2003, 6:01pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/43 "2003-09-11T18:01:38Z")
Whoops, that should be ā€œInternet Zone Security\*\*ā€ **, not "Internet Zone Security**?\*\*. ---
**Author:** ![Shrinking\_Violet](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Shrinking\_Violet](https://boards.straightdope.com/u/Shrinking_Violet)\ **Post date:** [September 11, 2003, 6:11pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/44 "2003-09-11T18:11:05Z")
> [@](#): > > \*Originally posted by jmizzou \* > \*\*In the ā€œFirewallā€ section, make sure "Internet Zone Security? is set to High. Under the ā€œZonesā€ tab (same section), make sure your internet connection is listed as ā€œInternetā€ and not ā€œTrusted.ā€ \*\* Thanks **jmizzou** , but the settings are, and always have been, as you describe. Also, Iā€™ve gone through and disabled all allowed programs, one by one, and retested each time - all three ports still remained open! Think my PC is haunted? :rolleyes: šŸ˜ƒ Julie ---
**Author:** ![Mort\_Furd](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Mort\_Furd](https://boards.straightdope.com/u/Mort_Furd)\ **Post date:** [September 11, 2003, 6:18pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/45 "2003-09-11T18:18:28Z")
> [@](#): > > \*Originally posted by Shrinking Violet \* > Thanks Mort Furd, but how? šŸ˜• > > And how come, with Zone Alarm running, _none_ of my ports show up as ā€œstealthā€? (All but the three open ports show up as closed). šŸ˜• > > Kinda worried, but in over my head here ā€¦ :rolleyes: > > Julie Damifno. Iā€™m using iptables on Linux, and using Guarddog as a setup tool. Guarddog defaults to ā€œstealthā€ - youā€™ve got to intentionally poke holes in it. The firewall is one hundred percent closed when you install it, and you have to change ports to ā€œblockedā€ or ā€œopenā€ for them to even be seen by another computer. Stealthed is the way to go. As a normal user, you have no business offering any services through open ports. Your normal surfing and stuff does not need for your PC to have ports visible to the internet. Iā€™d look for something in ZoneAlarm that lets me block all ports coming into my PC. The allowed programs donā€™t have anything to do with the open ports. ---
**Author:** ![Anonymous\_Coward](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@Anonymous\_Coward](https://boards.straightdope.com/u/Anonymous_Coward)\ **Post date:** [September 11, 2003, 6:23pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/46 "2003-09-11T18:23:36Z")
If you list the programs that you have trusted, it might help. Also, do you have kids/SO that is internet savvy? SSH and port 80 open sounds like someone may be using your PC as a gateway to bypass a school/company firewall. Finally, try rebooting after disabling each program. I used to have a windows utility that would list the open local ports on a PC and tell me the name of the program that is listening on those ports. Sound familiar to anyone? ---
**Author:** ![Anonymous\_Coward](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@Anonymous\_Coward](https://boards.straightdope.com/u/Anonymous_Coward)\ **Post date:** [September 11, 2003, 6:29pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/47 "2003-09-11T18:29:00Z")
Ah, found it. If you still canā€™t find out what is causing this to happen, go to [http://www.ntutility.com/freeware.html](http://www.ntutility.com/freeware.html) and download and install the ā€œActive Portsā€ utility. This will list the ports open on your PC and what process/path is using that port. ---
**Author:** ![Shrinking\_Violet](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Shrinking\_Violet](https://boards.straightdope.com/u/Shrinking_Violet)\ **Post date:** [September 11, 2003, 7:06pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/48 "2003-09-11T19:06:44Z")
> [@](#): > > \*Originally posted by Anonymous Coward \* > \*\*Ah, found it. > > If you still canā€™t find out what is causing this to happen, go to [http://www.ntutility.com/freeware.html](http://www.ntutility.com/freeware.html) and download and install the ā€œActive Portsā€ utility. This will list the ports open on your PC and what process/path is using that port. \*\* Hi **Anon** ā€¦ I really appreciate your help with this. šŸ™‚ I went to download the ā€œActive Portsā€ utility, but itā€™s only for Windows NT/2000/XP, and I use 98SE\*. :rolleyes: Believe me, _no-one_ in this house is computer savvy. Just me and mini-me. šŸ˜ƒ \*Which might give a clue to the problem ā€¦ Iā€™ve never managed to download/install any of the patches for 98SE **duck** ā€¦ it always failed for some reason, and I gave up trying. I believe itā€™s too late now? Julie ---
**Author:** ![Amazingrace](https://avatars.discourse-cdn.com/v4/letter/a/8edcca/32.png) [@Amazingrace](https://boards.straightdope.com/u/Amazingrace)\ **Post date:** [September 11, 2003, 7:56pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/49 "2003-09-11T19:56:22Z")
> [@](#): > > Originally posted by rsa > ZoneAlarm will make your computer appear like it doesnā€™t exist. > > You can test your invisablity here: [https://grc.com/x/ne.dll?bh0bkyd2](https://grc.com/x/ne.dll?bh0bkyd2) I tested my Zone Alarm invisibility. The one section that I failed, I downloaded their patch to correct it. Since Iā€™m running on a LAN, it ended up firewalling myself out of my system. I couldnā€™t access my internet. I had to take it to the tech guys, and they laughed at me. **Be careful!** ---
**Author:** ![Anonymous\_Coward](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@Anonymous\_Coward](https://boards.straightdope.com/u/Anonymous_Coward)\ **Post date:** [September 11, 2003, 8:06pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/50 "2003-09-11T20:06:08Z")
You may have Personal Web Server installed. Try following the instructions on this web page. [http://www.dewassoc.com/support/pws/remove\_pws40.htm](http://www.dewassoc.com/support/pws/remove_pws40.htm) Weā€™ll get it yet! ---
**Author:** ![rowrrbazzle](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rowrrbazzle/32/414_2.png) [@rowrrbazzle](https://boards.straightdope.com/u/rowrrbazzle)\ **Post date:** [September 11, 2003, 8:53pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/51 "2003-09-11T20:53:09Z")
**Mort Furd** : I just pinged myself from [http://network-tools.com](http://network-tools.com) . The response they showed was ā€œtimed outā€, so I assume Iā€™m dropping the packets. (If I werenā€™t, how would I find that out and change that setting? Iā€™m running Win98, ZA 2.6.362.) ZoneAlarm blocked the ping and produced this log entry: FWIN,2003/09/11,15:26:46 -5:00 GMT,66.46.181.116:0,12.248.xxx.xxx:0,ICMP (type:8/subtype:0) For comparison, hereā€™s a typical log entry from one of the numerous hits I mentioned: FWIN,2003/09/11,15:25:46 -5:00 GMT,12.248.35.40:0,12.248.xxx.xxx:0,ICMP (type:8/subtype:0) Doesnā€™t this indicate Iā€™m being pinged as opposed to sending out ping requests? Lest I seem alarmist, let me say that at the moment this situation is just a nuisance. Interestingly, network-tools attempted 10 pings, but only the first got through to me. And when I then did a tracert, it didnā€™t get through either. Maybe my ISP knows of the situation and is blocking multiple pings at one of the servers. ---
**Author:** ![Mort\_Furd](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Mort\_Furd](https://boards.straightdope.com/u/Mort_Furd)\ **Post date:** [September 11, 2003, 11:27pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/52 "2003-09-11T23:27:16Z")
Okay. That IS a normal ping directed at you. Somebody is just looking for open computers to piddle with. The log entries are easier to read than the description, and clearer too. I donā€™t know the particulars of Zone Alarm (Iā€™ve got iptables in my Linux kernel,) but there are some firewalls that respond and then lock down when they get repeat traffic. ZA may be doing it or your ISP. If you want to do traceroute, youā€™ll have to open the ports for it. Tracroute uses the UDP protocol, and goes to ports in the range 33434-33600. So long ZA is dropping the packets, you are clear. What is fun to do is to send WinPopup messages back at such guys. I do it on occassion to the folks whoā€™ve still got W32.Blaster or related stuff. Note the source IP address, then open a DOS box and do this: net send 12.248.35.40 Hey putz leave me the hell alone If it times out, it didnā€™t get through. If it goes through, youā€™ll have scared the britches off a scriptkiddie. Youā€™ll need to open ports 137 and 139 (outgoing only) to make it work, but it can be fun. I see you are using the ISP my father dumped last year. Too expensive and too flaky in his area. ---
**Author:** ![Weird\_AL\_Einstein](https://avatars.discourse-cdn.com/v4/letter/w/c67d28/32.png) [@Weird\_AL\_Einstein](https://boards.straightdope.com/u/Weird_AL_Einstein)\ **Post date:** [September 12, 2003, 2:10am UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/53 "2003-09-12T02:10:13Z")
If anyone is interested, as per **Anthracite** ā€™s recommendation I have been useing ZoneAlarm for 1 1/2 years now, no problems with it. As to this: > [@](#): > > \*Originally posted by Anthracite \* > \*\*And this is a good point that people often overlook. While I use PGP and encryption and firewalls and the works for everything possible myself, I also hold no illusions that Iā€™m ā€œsafeā€ from anyone who really wants the information. If the government, the ā€œMafiaā€, or a well-funded psychopathic ā€œcrackerā€ thinks thereā€™s something on my PC _really_ worth having, theyā€™ll just ā€œdisappearā€ me, and then torture me until I reveal the password. > > The weakest link in the chain - the flesh. \*\* See, what you need to do is have a special alternate password which, when you enter it into the system, causes it to _look_ like itā€™s giving up the info, but itā€™s actually misleading fake info. Sort of like that episode of the old Star Trek, Kirk gave a coded distress signal to Scotty by saying ā€œCondition Greenā€. ---
**Author:** ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)\ **Post date:** [September 12, 2003, 3:08am UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/54 "2003-09-12T03:08:40Z")
> [@](#): > > \*Originally posted by Weird\_AL\_Einstein \* > **See, what you need to do is have a special alternate password which, when you enter it into the system, causes it to _look_ like itā€™s giving up the info, but itā€™s actually misleading fake info.** Thatā€™s actually quite clever. It wouldnā€™t work with my standard PGP Disk setup, but it could work with some other things I useā€¦ ---
**Author:** ![dylan\_73](https://avatars.discourse-cdn.com/v4/letter/d/ecccb3/32.png) [@dylan\_73](https://boards.straightdope.com/u/dylan_73)\ **Post date:** [September 12, 2003, 11:59am UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/55 "2003-09-12T11:59:13Z")
Hehā€¦deniable encryption has been done. See [www.rubberhose.org](http://www.rubberhose.org) for details. (Gotta love the name!) ---
**Author:** ![Shrinking\_Violet](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Shrinking\_Violet](https://boards.straightdope.com/u/Shrinking_Violet)\ **Post date:** [September 12, 2003, 1:20pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/56 "2003-09-12T13:20:47Z")
> [@](#): > > \*Originally posted by Anonymous Coward \* > \*\*You may have Personal Web Server installed. Try following the instructions on this web page. > > [Removing Personal Web Server](http://www.dewassoc.com/support/pws/remove_pws40.htm) > > Weā€™ll get it yet! \*\* Hi **Anon**! šŸ™‚ Well, PWS is indeed installed (it appears on the Program list) ā€¦ but thereā€™s no file for it on my SE98 disc - the very disc\* Windows was installed from in the first place. šŸ˜• - A ā€¦ _ahem_ ā€¦ ripped copy of my original disc (since lost), but nevertheless the actual one used for the installation ā€¦ Julie ---
**Author:** ![GSV\_Consolation\_of\_Dreams](https://avatars.discourse-cdn.com/v4/letter/g/f1d935/32.png) [@GSV\_Consolation\_of\_Dreams](https://boards.straightdope.com/u/GSV_Consolation_of_Dreams)\ **Post date:** [September 12, 2003, 1:52pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/57 "2003-09-12T13:52:26Z")
> [@](#): > > \*Originally posted by Q.E.D. \* > \*\*No, I honestly donā€™t think they could. But nor would they really need to. If they wanted the data on your computer, theyā€™d simply come and confiscate it. \*\* Those of you with Linux/NetBSD who want to prepare for such events might consider a program called ā€œRubberhoseā€. Itā€™s a disk encryption system, the practical upshot of which is that you can have multiple encrypted partitions and the Feds^H^H^HBad guys canā€™t even tell how many there are on the disk. If they get out the rubber hose to persuade you to give up the password, you can give them one for a not-very-incriminating one. [link](http://www.rubberhose.org/current/src/doc/maruguide/t1.html) ---
**Author:** ![GSV\_Consolation\_of\_Dreams](https://avatars.discourse-cdn.com/v4/letter/g/f1d935/32.png) [@GSV\_Consolation\_of\_Dreams](https://boards.straightdope.com/u/GSV_Consolation_of_Dreams)\ **Post date:** [September 12, 2003, 1:56pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/58 "2003-09-12T13:56:55Z")
**dylan\_73** Dunno how the hell you could have posted that at 12:59 PM, merely minutes ahead of my post at 02:52 pm. ---
**Author:** ![Shrinking\_Violet](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Shrinking\_Violet](https://boards.straightdope.com/u/Shrinking_Violet)\ **Post date:** [September 12, 2003, 2:11pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/59 "2003-09-12T14:11:29Z")
> [@](#): > > \*Originally posted by Shrinking Violet \* > \*_ā€¦ the very disc_ Windows was installed from in the first place. \*\* Ummmm ā€¦ ignore the above. After consultation with My Friend The Computer Engineer it seems like I made myself a dud copy of my good copy of the original disc :smack: ā€¦ heā€™s got the _good_ copy in his possession, and is gonna give it back so I can close those damned ports!!! Thanks for all the help Iā€™ve received, and fingers crossed! šŸ†’ Julie ---
**Author:** ![dylan\_73](https://avatars.discourse-cdn.com/v4/letter/d/ecccb3/32.png) [@dylan\_73](https://boards.straightdope.com/u/dylan_73)\ **Post date:** [September 12, 2003, 2:15pm UTC](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649/60 "2003-09-12T14:15:12Z")
**GSV** : Iā€™m a time travelling stalkerā€¦everywhere you go, Iā€™ve just been thereā€¦ šŸ˜‰ [Previous page](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649.md?page=2) [Next page](https://boards.straightdope.com/t/zonealarm-how-robust-is-this-pc-firewall/200649.md?page=4)