ZoneAlarm problem

For the past 2 days ZoneAlarm (free) has been giving me fits. According to Task Manager, my CPU is running at 100% most of the time. Looking at Processes, the two culprits seem to be vsmon.exe, which uses 44-55%, and zlclient.exe, which uses 38-51%. They're both ZA functions. When they're both running, my computer slows or hangs, and when I try to shut ZA down my system freezes. A restart helps only briefly, as does a reinstall of ZA. A Google search showed that those two functions were a common problem that supposedly was fixed with MS patches 2 years ago, so why am I having this problem all of a sudden?

The details of my system are in my signature, below. Scans with NAV, A-A and Spybot show no problems. I even ran TrendMicro's Housecall. No problems. Defragging hasn't helped. All the malware programs are up to date, and ZA is the latest version, 6.5.737. I noticed for the first time this morning that when ZA decided to take over the CPU, the little ZA icon had a curved white arrow over it and the hint bubble said something about an update in progress and then my system froze. Significant?

Right now I have ZA shut off so I can submit this post, and I've turned the Windows firewall on to provide some protection.

I sure would like to get this problem fixed, so I welcome any ideas or questions.

 

BOBBO--System Restore??
There also is a ZA forum
http://forums.zonelabs.com/zonelabs

 

Welshjim: Thanks for replying. I checked your ZA forum link and didn't see any posts that seemed to apply to the particular problem I'm having. I've never registered there, so I didn't go any further with that.

I'd thought about doing a System Restore. I haven't tried it yet, but before I do, I'm not sure about a couple things. If I do a restore back to, say, 4 days ago, will that undo the MS updates I downloaded yesterday? And what about e-mails I've received since that restore point? Will I lose them? It's obvious I've never done one before and my questions about it are very basic.

 

Hi BOBBO,

I think ZA's data base got corrupted. The files are located in \Windows\Internet Logs. Everything in there belongs to ZA.

SR in this case wouldn't help - those files are not monitored by SR. As an FYI - if you did use SR, it would roll back MS updates. Emails (archeived) as a rule no - depends on file extensions. .pdf files for example are monitored. And Emails still on the Server wouldn't be affected.

ZA should be uninstalled and re installed.

Before you do that, in the preferences tab, there is a save your settings option. That creates a backup of your settings. Later that can be imported.

Once ZA is uninstalled - delete the Internet Logs folder. On re installation, ZA will re create that folder.

And of course, you do all this disconected from the Net.

Regards - Charles

 

BOBBO--

Yes
But it will not affect your emails. (Personal data files are not affected.)
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sr/sr/monitored_file_extensions.asp

Here are a couple of comprehensive (long winded) articles on what System Restore does
http://www.bleepingcomputer.com/tutorials/tutorial56.html
http://www.jsifaq.com/SF/Tips/Tip.aspx?id=5412

 

Thanks to you both for your ideas. I did a System Restore but it didn't help. While doing that I found out about e-mails (no problem) and MS updates (they were lost, but undoing the SR may have regained them -- at first the orange shield icon alerted me to MS updates being available, but after another restart the icon is gone.)

So I uninstalled ZA, but reinstalling it hasn't worked. I get this message from ZA Installer:

So how exactly do I do that?

 

Hi BOBBO,

Maybe between SR and uninstalling ZA - it got crossed. That message means all of ZA's parts were not uninstalled (did you shutdown ZA before the uninstall?) or between restoring and undoing the restore, parts of ZA returned.

One of the files SR monitors is .exe files. vsmon.exe, that's the firewall part of ZA, zlcient is the UI.

Bring up TM and kill vsmon.exe

Regards - Charles

 

Things are not going well. TM no longer shows vsmon.exe since I did the uninstall and SR. So that doesn't work.

I wondered how to get at the Truevector Service, so did a Google search. It seems quite a few people have encountered the same problem I'm having. A lot of the advice describes different ways to get at Services to fix things there, and every one of their approaches got me to the Services list but there's never any Truevector Service on the list. And ZA's installer still isn't happy.

Now what?

 

Hi BOBBO,

ZA's service line is called TrueVector Internet Monitor. I don't know what happened here.

At this point, I would try SR - go back to that 4 days that you mentioned. At that point you should have the Service line back and most of ZA running. If that's the case - then delete the internet logs folder with ZA totally shut down including the Service line, otherwise you're going to get a can't delete message. There is also an option in the preferences tab to uncheck ZA from starting up on bootup. After that folder is gone and ZA is restarted, see how things are.

Then you can also try the uninstall/re install again.

One other thought, what you might have to do in the end is go back to an earlier version. The latest and greatest doesn't always mean it works well.

Edit: If you have problems deleting the Internet Logs folder, look a this thread for brute force deleters http://www.windowsbbs.com/showthread.php?t=58432

Regards - Charles

 

I don't know if this will post or not, but I was in the midst of another message in which I was claiming the problem was fixed. I'd done another Search, this time with Advanced Option running, for vsmon.* and found 2 instances of it. One was in C:\WINDOWS\Prefetch, the other was in a folder in C:\WINDOWS\SYSTEM32\ZoneLabs. I moved that folder and the file to my F:\ partition, then attempted to install ZA. It worked! It loaded OK and for several minutes TM CPU Usage was showing 5%. But just as I was getting the typos out of the post, it vanished and TM showed 100% and that's where it is now. Arrggghhh!!!

As for SR, the first time I ran that today I found it went back only to Monday. I think all the restores I'd run in the past couple days wiped out all earlier entries. I've run even more today, so who knows what's there now.

I think I know how to reinstall ZA now, but there's still the mystery of what's causing it to go nuts like this.

 

Ok, if you have it running, then shut it down, including the Service line and get rid of that Log folder. I think there is a good possibility that is where the problem lies.

When ZA restarts, it'll recreate that folder and the files it needs. If you haven't saved the current settings, you'll get the permission/deny popups.

Regards - Charles

 

I shut off ZA and then tried to delete the Internet Logs folder. This error message appeared:

What's that all about? I'd gotten off-line, so my browser wasn't using it, nor was ZA. I'd turned the Windows firewall on. Would that make a difference? I can't remember if I'd disabled it, too, but if I was off-line I wouldn't think that mattered.

One strange thing I've noticed. When I turn ZA off I go to Control Panel to turn the Windows firewall on but I find it's already on, and when I turn ZA on, the Windows firewall is already off, as though it's automatically adjusting to whether ZA is on or not. I know ZA doesn't like another firewall to run when it's on, but is ZA the one that's turning the Win firewall on and off, or is it the other way around?

Later: I finally got the Internet Logs folder deleted. AZ needs to be uninstalled first. I did that and then later reinstalled it. I configured it this time so it won't automatically start on start-up. That gives me time to open TM and do anything else necessary before it takes over and runs the CPU usage up to 100%. If I wait until after it opens, trying to close it is what messes everything up, eventually freezing the whole system. For the time being I'm leaving it turned off and using the Win firewall. I'm tired of bothering with it today. Any more ideas are still welcome. I appreciate your sticking with me so long on this.

 

Hi BOBBO,

Forgot to tell you to try file deletions in safe mode.

It's ZA that turns off WF.

Thru the left Firewall tab > Advanced on main page > General Settings section > uncheck Disable Windows Firewall.

I'm running Pro - should be the same for free version.

Regards - Charles

 

In case you haven't seen this: http://forum.zonelabs.org/zonelabs/board/message?board.id=AllowAccess&message.id=103

Regards - Charles

 

BOBBO This is what worked for me.

1. Go to Start>Programs>Zone Labs and right click on Uninstall and choose Properties. In the target box, put your cursor after the last " and add space/clean. This will take out all ZA stuff.

2. I went back to ZA version 6.1.744.001. It has never given me another problem.

3. In prefs, turn off auto update check.

I hung out in the ZA forums for a long time and read umpteen zillion posts about the problems that are caused by the 6.5 versions. It seems to be according to your particular hardware and software combination as to whether you have problems or not.

I have had none since doing the above stuff.

 

Not sure you want to hear this but when I ran into somewhat similar problems I finally abandoned ZA and tried Kerio. I've been a happy camper ever since.

 

Glad to have more people joining in.

I checked all the links you offered and decided to once again uninstall ZA 6.5.737. Did that successfully, including a number of reboots. Finally found a source for ZA 6.1.744.001, downloaded and installed it. It's up and running now, and so far no problems although it's only been a few minutes.

Because of all the recent uninstalls lately, I'm getting a lot of Windows Installer and Veritas Update Manager windows opening up. After this last ZA install, I expect it to take awhile for everything to settle down, but right now I think my original problem is over with. * knocking on wood *

Thanks to everyone for your assistance.