Hide Notes 

Slide 1: User Guide for ZoneAlarm security software version 7.0 Smarter Security TM
Slide 2: © 2007 Zone Labs, LLC. All rights reserved. © 2007 Check Point Software Technologies Ltd. All rights reserved. Check Point, Application Intelligence, Check Point Express, the Check Point logo, AlertAdvisor, ClusterXL, Cooperative Enforcement, ConnectControl, Connectra, CoSa, Cooperative Security Alliance, FireWall-1, FireWall-1 GX, FireWall-1 SecureServer, FloodGate-1, Hacker ID, IMsecure, INSPECT, INSPECT XL, Integrity, InterSpect, IQ Engine, Open Security Extension, OPSEC, Policy Lifecycle Management, Provider-1, Safe@Home, Safe@Office, SecureClient, SecureKnowledge, SecurePlatform, SecurRemote, SecurServer, SecureUpdate, SecureXL, SiteManager-1, SmartCenter, SmartCenter Pro, Smarter Security, SmartDashboard, SmartDefense, SmartLSM, SmartMap, SmartUpdate, SmartView, SmartView Monitor, SmartView Reporter, SmartView Status, SmartViewTracker, SofaWare, SSL Network Extender, TrueVector, UAM, User-to-Address Mapping, UserAuthority, VPN-1, VPN-1 Accelerator Card, VPN-1 Edge, VPN-1 Pro, VPN-1 SecureClient, VPN-1 SecuRemote, VPN-1 SecureServer, VPN-1 VSX, Web Intelligence, ZoneAlarm, Zone Alarm Pro, Zone Labs, and the Zone Labs logo, are trademarks or registered trademarks of Check Point Software Technologies Ltd. or its affiliates. All other product names mentioned herein are trademarks or registered trademarks of their respective owners. The products described in this document are protected by U.S. Patent No. 5,606,668, 5,835,726 and 6,496,935 and may be protected by other U.S. Patents, foreign patents, or pending applications. Zone Labs, LLC. A Check Point Company 800 Bridge Parkway Redwood City, CA 94065 ZLD -0422-0650-2007-0115
Slide 3: Contents Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi Figures Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii About ZoneAlarm security software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv About this guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv ZoneAlarm User Forum . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv Chapter 1 Installation and setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 System requirements and supported software . . . . . . . . . . . . . . . . . . . . . . . 2 Hardware requirements and supported operating systems . . . . . . . . . . . . . . . . . . . . 2 Supported protocols for e-mail protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Supported browser software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Supported IM clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Installing ZoneAlarm security software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Installing ZoneAlarm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Installing ZoneAlarm security software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Upgrading from a previous version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Upgrading and the Windows XP SP2 Windows Firewall . . . . . . . . . . . . . . . . . . . . . 6 Upgrading and IMsecure myVault settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Upgrading and MailFrontier settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Configuring basic options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Configuring program access permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Joining the DefenseNet community . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Uninstalling ZoneAlarm security software . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Chapter 2 ZoneAlarm security software basics. . . . . . . . . . . . . . . . . . . . . . . . . 11 Tour of the ZoneAlarm security software Control Center . . . . . . . . . . . . . . 12 Getting around the Control Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Using the dashboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 System Tray icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Shortcut menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Using the Status tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Understanding Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Zones manage firewall security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Zones provide program control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Responding to alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 User Guide for ZoneAlarm security software i
Slide 4: New Program alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 New Network and VPN alerts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Setting product preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Setting update options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Setting your password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Backing up and restoring security settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Setting general product preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Setting contact preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Setting product display and proxy server options . . . . . . . . . . . . . . . . . . . . . . . . . 25 Creating an online fraud protection profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Licensing, registration, and support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Updating your product license . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Registering ZoneAlarm security software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Accessing technical support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Chapter 3 Networking with ZoneAlarm security software . . . . . . . . . . . . . . . 31 Configuring a new network connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Using the Network Configuration Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Disabling the Network Configuration Wizard. . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Using the Wireless Network Configuration Wizard . . . . . . . . . . . . . . . . . . . . . . . . 33 Disabling the Wireless Network Configuration Wizard. . . . . . . . . . . . . . . . . . . . . . 33 Integrating with network services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Enabling file and printer sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Connecting to network mail servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Enabling Internet Connection Sharing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Configuring your VPN connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Supported VPN protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Configuring your VPN connection automatically . . . . . . . . . . . . . . . . . . . . . . . . . 37 Configuring your VPN connection manually . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Adding a VPN gateway and other resources to the Trusted Zone. . . . . . . . . . . . . . . 39 Removing a VPN gateway from a blocked range or subnet. . . . . . . . . . . . . . . . . . . 39 Allowing VPN protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Granting access permission to VPN software . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Chapter 4 Firewall protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Understanding Firewall protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Choosing security levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Setting the security level for a Zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Setting advanced security options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Setting gateway security options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Setting ICS (Internet Connection Sharing) options . . . . . . . . . . . . . . . . . . . . . . . 44 Setting general security options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Setting network security options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Setting wireless network security options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Managing traffic sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Viewing the traffic source list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Modifying traffic sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Adding to the Trusted Zone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Adding to the Blocked Zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 User Guide for ZoneAlarm security software ii
Slide 5: Viewing logged Firewall events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Blocking and unblocking ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Default port permission settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Adding custom ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Understanding expert firewall rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 How expert firewall rules are enforced. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Expert firewall rule enforcement rank . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Creating expert firewall rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Creating groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Creating a location group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Creating a protocol group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Creating a day/time group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Managing Expert Firewall Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Viewing the Expert Rules list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Editing and re-ranking rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Chapter 5 Program control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Understanding Program Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Setting program permissions automatically . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Setting program permissions manually . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Setting general program control options . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Setting the program control level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Configuring OSFirewall protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Enabling Component Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Setting the SmartDefense Advisor level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Enabling the automatic lock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Viewing logged program events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 Viewing logged OSFirewall events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Configuring advanced program settings . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Setting global program properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Setting access permissions for new programs . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Setting permissions for specific programs . . . . . . . . . . . . . . . . . . . . . . . . . 80 Using the programs list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Adding a program to the programs list. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Granting a program permission to access the Internet . . . . . . . . . . . . . . . . . . . . . 84 Granting a program permission to act as a server . . . . . . . . . . . . . . . . . . . . . . . . 85 Granting send mail permission to a program . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Setting program options for a specific program . . . . . . . . . . . . . . . . . . . . . 86 Setting Advanced Program Control options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Disabling Outbound Mail protection for a program. . . . . . . . . . . . . . . . . . . . . . . . 86 Setting Filter options for a program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Setting authentication options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Setting passlock permission for a program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Managing program components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Creating expert rules for programs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Creating an expert rule for a Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Sharing expert rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 User Guide for ZoneAlarm security software iii
Slide 6: Chapter 6 Spyware and Virus protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Spyware and Virus Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Turning on virus and spyware protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Scheduling a scan. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Updating virus and spyware definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Customizing virus protection options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Specifying scan targets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 On-Access scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 E-mail Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Enabling automatic virus treatment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Specifying virus scan options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Excluding suspected extended database items from scans . . . . . . . . . . . . . . . . . 102 Customizing spyware protection options . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Enabling automatic spyware treatment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Specifying spyware detection methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Excluding spyware from scans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Spy Site Blocking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Preventing spyware attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Performing a virus scan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Understanding virus scan results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Treating virus files manually . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Repairing files in an archive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Submitting viruses and spyware to ZoneAlarm for review . . . . . . . . . . . . . . . . . . 108 Viewing logged virus events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Performing a spyware scan. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Understanding spyware scan results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Errors in spyware scan results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Viewing items in quarantine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Viewing logged spyware events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Viewing virus and spyware protection status. . . . . . . . . . . . . . . . . . . . . . . 115 Monitoring virus protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 Monitoring Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 Monitoring in ZoneAlarm, ZoneAlarm Pro, and ZoneAlarm Anti-Spyware . . . . . . . . 116 Monitoring in ZoneAlarm Anti-virus and ZoneAlarm Security Suite . . . . . . . . . . . . 117 Enabling and disabling Anti-virus Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . 117 Viewing Status Messages in the Anti-virus Monitoring panel . . . . . . . . . . . . . . . . 118 Viewing Anti-virus Monitoring alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 Chapter 7 E-mail protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Understanding e-mail protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 Inbound MailSafe protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 Outbound MailSafe protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Enabling Inbound MailSafe protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Enabling Outbound MailSafe protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Customizing Inbound MailSafe protection . . . . . . . . . . . . . . . . . . . . . . . . 126 Viewing the Attachments list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Changing the quarantine setting for an attachment type. . . . . . . . . . . . . . . . . . . 126 Adding and removing attachment types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 Opening a quarantined attachment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 Customizing Outbound MailSafe protection . . . . . . . . . . . . . . . . . . . . . . . 129 User Guide for ZoneAlarm security software iv
Slide 7: Enabling Outbound MailSafe protection by program . . . . . . . . . . . . . . . . . . . . . 129 Setting Outbound MailSafe protection options . . . . . . . . . . . . . . . . . . . . . . . . . 129 Filtering junk e-mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Allowing or blocking e-mail from specific senders . . . . . . . . . . . . . . . . . . . . . . . 131 Allowing or blocking e-mail from specific companies . . . . . . . . . . . . . . . . . . . . . 132 Adding contacts to the Allowed List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Scanning your Inbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Allowing e-mail from distribution lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Reporting junk e-mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Reporting fraudulent e-mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Specifying junk e-mail message options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Challenging e-mail from unknown senders . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Specifying your outbound e-mail server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 Customizing junk e-mail filter settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Restoring e-mail incorrectly identified as junk . . . . . . . . . . . . . . . . . . . . . . . . . 139 Viewing junk e-mail filter reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 Anti-virus protection for e-mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Enabling E-mail scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 How e-mail infections are handled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Chapter 8 Privacy protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 Understanding privacy protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Setting general privacy options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 Setting privacy protection levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 Applying privacy protection to programs other than browsers. . . . . . . . . . . . . . . . 145 Using Privacy Advisor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 Setting privacy options for specific Web sites . . . . . . . . . . . . . . . . . . . . . 148 Viewing the privacy site list. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 Adding sites to the privacy site list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Editing sites on the site list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Customizing cookie control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Blocking session cookies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Blocking persistent cookies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Blocking third-party cookies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 Setting an expiration date for cookies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 Customizing ad blocking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 Specifying which ads to block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 Setting ad void control options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 Customizing mobile code control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 Specifying which types of mobile code to block . . . . . . . . . . . . . . . . . . . . . . . . 154 Understanding Cache cleaner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Using Cache Cleaner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Customizing hard drive cleaning options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 Customizing browser cleaning options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 Chapter 9 Alerts and Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 Understanding alerts and logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 About ZoneAlarm security software alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 User Guide for ZoneAlarm security software v
Slide 8: About event logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 Setting basic alert and log options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 Setting the alert event level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 Setting event and program logging options. . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 Controlling the number of alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 Showing or hiding firewall alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 Enabling system tray alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 Game Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174 Setting event and program log options . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 Formatting log appearance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 Customizing event logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 Customizing program logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 Viewing log entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Viewing the text log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 Archiving log entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 Using SmartDefense Advisor and Hacker ID. . . . . . . . . . . . . . . . . . . . . . . 182 Chapter 10 Identity protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 Understanding the ID Lock feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 How your personal information is protected . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 Setting the ID Lock protection level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 About myVAULT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 Adding data to myVAULT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 Editing and removing myVAULT contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 Using the Trusted Sites list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 Viewing the Trusted Sites list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 Adding to the Trusted Sites list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 Editing and removing trusted sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 Identity Protection Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 Chapter 11 Parental Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 Understanding Parental Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 Enabling parental control and smart filtering . . . . . . . . . . . . . . . . . . . . . . 199 Enabling or disabling parental control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 Enabling or disabling Smart Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 Setting timeout options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 Choosing which content categories to block . . . . . . . . . . . . . . . . . . . . . . . 201 Chapter 12 Instant Messaging Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 IM Security Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 Blocking spam . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 Feature Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 Inbound protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 Encrypting instant messaging traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 Setting IM Security options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 User Guide for ZoneAlarm security software vi
Slide 9: Setting the protection level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 Viewing IM Security protection status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 Customizing protection settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 Setting advanced IM Security options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 Viewing logged IM Security events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 Appendix A Alert reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 Informational alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 Firewall alerts/Protected . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 MailSafe alert. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 Blocked Program alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 Internet Lock alert. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Remote alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224 Program alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225 New Program alert. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226 Repeat Program alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 Changed Program alert. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 Program Component alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 Server Program alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 Advanced Program alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 Automatic VPN Configuration alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 Manual Action Required alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232 OSFirewall alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 Medium-rated Suspicious Behavior alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 High-rated Suspicious Behavior alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 Malicious behavior alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235 ID Lock alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236 New Network alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237 Instant Messaging alerts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 Appendix B Keyboard shortcuts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 Navigation shortcuts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 Global function shortcuts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 Dialog box commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 Button shortcuts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246 Appendix C Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250 Configuring ZoneAlarm security software for VPN traffic . . . . . . . . . . . . . . . . . . . 250 VPN auto-configuration and expert rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250 Automatic VPN detection delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250 Networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 Making your computer visible on your local network . . . . . . . . . . . . . . . . . . . . . 252 Sharing files and printers across a local network . . . . . . . . . . . . . . . . . . . . . . . . 252 Resolving a slow start up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 Internet Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254 User Guide for ZoneAlarm security software vii
Slide 10: Connecting to the Internet fails after installation . . . . . . . . . . . . . . . . . . . . . . . 254 Allowing ISP Heartbeat messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255 Connecting through an ICS client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255 Connecting through a proxy server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 Unable to connect to program advice server . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 IM Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 IM programs not appearing in status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 Anti-virus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258 Anti-virus feature installation problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258 Anti-virus Monitoring alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258 Resolving conflicts with anti-virus products . . . . . . . . . . . . . . . . . . . . . . . . . . . 258 E-mail scanning or IM Security is unavailable . . . . . . . . . . . . . . . . . . . . . . . . . 259 Third-party software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260 Anti-virus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260 Browsers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260 Chat and instant messaging programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 E-mail programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 Internet answering machine programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 File sharing programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 FTP programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 Games . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263 Remote control programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 VNC programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 Streaming media programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 Voice over IP programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 Web conferencing programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 Appendix D Program behavior. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 Medium-rated suspicious behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268 High-rated suspicious behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273 285 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . User Guide for ZoneAlarm security software viii
Slide 11: Tables Table 2-3: System Tray icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Table 2-4: Update messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Table 3-1: Supported VPN protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Table 3-2: Required VPN-related network resources . . . . . . . . . . . . . . . . . . . . 39 Table 4-1: Traffic source list fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Table 4-2: Firewall event log fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Table 4-3: Default access permissions for incoming and outgoing traffic types 52 Table 5-1: Program event log fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 Table 5-2: OSFirewall event log fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Table 5-3: Program List symbols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Table 6-2: Icons indicating scan targets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Table 6-3: Virus event log fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Table 6-4: Spyware event log fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Table 9-6: Log viewer fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 Table 11-1: Parental Control categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201 Table 12-6: Log Viewer field explanations . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 Table A-1: IM alert messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 Table B-1: Navigation shortcuts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 Table B-2: Global shortcuts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 Table B-3: Dialog box shortcuts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 Table B-4: Keystrokes for activating buttons . . . . . . . . . . . . . . . . . . . . . . . . . 246 Table C-1: Troubleshooting VPN problems . . . . . . . . . . . . . . . . . . . . . . . . . . 250 Table C-2: Troubleshooting network problems . . . . . . . . . . . . . . . . . . . . . . . . 252 Table C-3: Troubleshooting Internet connection problems . . . . . . . . . . . . . . . 254 Table C-4: Troubleshooting IM Security problems . . . . . . . . . . . . . . . . . . . . . 257 Table C-5: Troubleshooting ZoneAlarm Anti-virus problems . . . . . . . . . . . . . . 258 User Guide for ZoneAlarm security software ix
Slide 12: Table D-1: Medium-rated suspicious behavior guide . . . . . . . . . . . . . . . . . . . 268 Table D-2: High-rated suspicious behavior guide . . . . . . . . . . . . . . . . . . . . . . 269 User Guide for ZoneAlarm security software x
Slide 13: Figures Figure 2-1: ZoneAlarm security software Control Center . . . . . . . . . . . . . . . . . 12 Figure 2-2: ZoneAlarm security software dashboard . . . . . . . . . . . . . . . . . . . . 13 Figure 4-4: Expert firewall rule rank order. . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Figure 4-5: Expert Rules list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Figure 5-3: Programs list. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Figure 5-4: Components List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Figure 6-1: Anti-virus and Anti-spyware status . . . . . . . . . . . . . . . . . . . . . . . 98 Figure 6-2: Scan targets dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Figure 6-3: Virus scan results dialog. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Figure 6-4: Spyware scan results dialog . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Figure 6-5: Anti-virus Monitoring Status area in ZoneAlarm . . . . . . . . . . . . . 118 Figure 7-1: Attachments list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Figure 7-2: The junk e-mail filter toolbar . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Figure 7-3: Challenge options tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Figure 7-4: Example of an infection report . . . . . . . . . . . . . . . . . . . . . . . . . 141 Figure 8-1: Privacy Advisor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 Figure 8-2: Privacy site list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 Figure 9-1: Firewall alert. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 Figure 9-2: New Program alert. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 Figure 9-3: New Network alert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 Figure 9-4: ID Lock alert. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 Figure 9-5: Medium-rated Suspicious Behavior alert . . . . . . . . . . . . . . . . . . 169 Figure 9-6: High-rated Suspicious Behavior alert . . . . . . . . . . . . . . . . . . . . . 170 Figure 10-1: Transmission of myVAULT contents . . . . . . . . . . . . . . . . . . . . 187 Figure 10-2: Receipt of myVAULT contents . . . . . . . . . . . . . . . . . . . . . . . . 187 Figure 10-3: Trusted Sites list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 User Guide for ZoneAlarm security software xi
Slide 14: Figure 12-1: Sending a voice transmission that is blocked . . . . . . . . . . . . . . 210 Figure 12-2: Blocking an incoming voice transmission . . . . . . . . . . . . . . . . . 210 Figure 12-3: Sending an executable URL to a contact . . . . . . . . . . . . . . . . . 211 Figure 12-4: Potentially harmful link removed. . . . . . . . . . . . . . . . . . . . . . . 211 Figure 12-5: Example of an encrypted conversation. . . . . . . . . . . . . . . . . . . 213 Figure 12-6: Example of an unencrypted conversation . . . . . . . . . . . . . . . . . 213 User Guide for ZoneAlarm security software xii
Slide 15: Preface “About ZoneAlarm security software,” on page xiv “About this guide,” on page xv User Guide for ZoneAlarm security software xiii
Slide 16: Preface About ZoneAlarm security software About ZoneAlarm security software ZoneAlarm security software is a family of security products that offers a wide range of features and benefits. This release supports the following versions of ZoneAlarm security software: ZoneAlarm Offers firewall protection, limited MailSafe protection and Program Control, and Antivirus Monitoring. ZoneAlarm Anti-virus Includes the same features available in free ZoneAlarm, plus Kaspersky Anti-virus protection, Inbound and Outbound MailSafe protection, Program Control with SmartDefense Advisor, and OSFirewall protection. ZoneAlarm Anti-Spyware Includes the same features available in free ZoneAlarm, plus Anti-spyware protection, Inbound and Outbound MailSafe Protection, Program Control with SmartDefense Advisor, and OSFirewall protection. ZoneAlarm Pro Includes expert firewall protection, Inbound and Outbound MailSafe protection, Program Control with SmartDefense Advisor, Privacy control, Identity Protection, Antispyware protection, and OSFirewall protection. ZoneAlarm Security Suite Includes the features available in ZoneAlarm Pro, plus IM Security, Parental Control, Identity Protection, Kaspersky Anti-virus protection, Junk E-mail Filtering, and offers protection for mobile laptop users and wireless home networks. User Guide for ZoneAlarm security software xiv
Slide 17: Preface About this guide About this guide This guide is intended for users of ZoneAlarm, ZoneAlarm Anti-virus, ZoneAlarm Pro, ZoneAlarm Anti-Spyware, and ZoneAlarm Security Suite. Throughout this guide, these products are collectively referred to as ZoneAlarm security software. In cases where a reference to a specific product is required, the product name is used. Conventions This guide uses the following formatting and graphics conventions. Convention Bold Description Used for user interface elements such as panels, tabs, fields, buttons, and menu options. Used for file names and paths. Used to separate panel and tab selections in procedures. Example: Select Overview|Status, then click Add. Tip icon. Suggests alternative methods for accomplishing tasks or procedures. Note icon. Emphasizes related, reinforcing, or important information. Caution icon. Indicates actions or processes that can potentially damage data or programs. Italic | ZoneAlarm User Forum Connect with other users of ZoneAlarm security software. Ask questions, get answers, and see how fellow users get the most out of their ZoneAlarm security software. Visit: http://www.zonelabs.com/store/content/support/userForum/ userForum_agreement.jsp User Guide for ZoneAlarm security software xv
Slide 18: Preface ZoneAlarm User Forum User Guide for ZoneAlarm security software xvi
Slide 19: Chapter Installation and setup This chapter provides system requirements and instructions for installing, upgrading, configuring, and uninstalling ZoneAlarm security software. Topics: “System requirements and supported software” on page 2 “Installing ZoneAlarm security software” on page 4 “Upgrading from a previous version” on page 6 “Configuring basic options” on page 7 “Uninstalling ZoneAlarm security software” on page 9 1 1
Slide 20: Chapter 1: Installation and setup System requirements and supported software System requirements and supported software This section lists hardware and software needed to run ZoneAlarm security software. Hardware requirements and supported operating systems The computer on which you install ZoneAlarm security software must have: One of the following operating systems and minimum RAM required: Microsoft® Windows® XP, Home or Professional Edition, 128MB of RAM Microsoft Windows 2000 Professional, 64MB of RAM 50MB of available hard-disk space Pentium® III 800Mhz or higher The ideal resolution for ZoneAlarm security software is 1024 x 768 or higher. Some software screens might not display properly at resolutions of 800 x 600 or lower. Supported protocols for e-mail protection HTTP (Junk e-mail filtering in conjunction with Outlook or Outlook Express) IMAP4 (Incoming only) - IMAP4 is not supported for virus scanning of e-mail. POP3 (Incoming only) SMTP (Outgoing only) Supported browser software Internet Explorer 5.5, 6.0 SP1, 6.0 SP2 Netscape Navigator 7.2, 8.1 FireFox 1.00, 1.5 Mozilla 1.4 and up MSN Explorer 6.0, 7.02 AOL 9.0 User Guide for ZoneAlarm security software 2
Slide 21: Chapter 1: Installation and setup Supported IM clients Supported IM clients MSN 7.5.0299, 7.5.0324 Windows Messenger 4.7.3001, 5.0.468, 5.1.0701 Yahoo! IM 5.6.0.1351, 6.0.0.1643 - 6.0.0.1922, 7.0.0.xxx Yahoo! Japan IM 6.0.0.1703 Japan Yahoo IM does not support non-Japanese Yahoo's ID. Also, Japan IM uses a different process: YPagerJ.exe AOL Instant Messenger 5.9.x AOL9 Triton (AIM) 1.0.4.1 ICQ Pro 2003b (build 3916) ICQ Lite 5.04 build 2321, 5.1 build 3916 Trillian Free (MSN/YIM/AIM/ICQ) 0.74i, 2.0.12 - 3.1 Trillian Pro (MSN/YIM/AIM/ICQ) 2.0.12 - 3.1 GAIM (MSN/YIM/AIM/ICQ) 1.0.0 - 1.5.0, 2.0.0 beta 3 Miranda (MSN/YIM/ICQ) v.0.4rc1, 0.4.0.3 User Guide for ZoneAlarm security software 3
Slide 22: Chapter 1: Installation and setup Installing ZoneAlarm security software Installing ZoneAlarm security software The installation and setup process for ZoneAlarm security software involves installing the software files, running the configuration wizard to set basic protection options, and viewing the Tutorial. If you have a previous version of ZoneAlarm security software installed, you may receive a security warning during installation. Click OK to dismiss these warnings before proceeding with installation. Installing ZoneAlarm Before you can begin the installation process, you must download ZoneAlarm from the ZoneAlarm Web site, then browse to the location on your computer where you saved the installation file. 1. Double-click the installation file you downloaded. The installation program begins. 2. Either specify a location for the installation files, or click Next to continue. The default location is C:Program FilesZone LabsZoneAlarm. 3. Type your name, company (optional), and e-mail address, then click Next. 4. Read and accept the license agreement, then click Install. The installation program runs. 5. Click Finish to close the installation program. 6. Click Yes to start ZoneAlarm. The License Wizard appears. 7. Select either the ZoneAlarm Pro trial or free ZoneAlarm, then click Next When installing ZoneAlarm, you have the option to install a trial version of ZoneAlarm Pro, free for 15 days. During the trial period you will experience the advanced security protection available in ZoneAlarm Pro. At the end of the trial period, you can continue to use these advanced features by purchasing ZoneAlarm Pro, or you can revert to ZoneAlarm. When reverting to ZoneAlarm after the ZoneAlarm Pro trial, any custom settings you have created in ZoneAlarm Pro will be discarded. Installing ZoneAlarm security software Before you can begin the installation process, you will need to insert the ZoneAlarm security software CD into your CD-ROM drive, or if you downloaded the software from User Guide for ZoneAlarm security software 4
Slide 23: Chapter 1: Installation and setup Installing ZoneAlarm security software the ZoneAlarm Web site, browse to the location on your computer where you saved the installation file. To install ZoneAlarm security software: 1. Double-click the installation file. The installation program begins. 2. Either specify a location for the installation files, or click Next to continue. The default location is C:Program FilesZone LabsZoneAlarm. 3. Type your name, company (optional), and e-mail address, then click Next. 4. Read and accept the license agreement, then click Install. 5. Click Finish to close the installation program. If you are upgrading from a previous version, you may be prompted to restart your computer to complete the installation process. 6. Click OK to restart your computer, or click Cancel. If you click Cancel, remember to restart your computer later to complete the installation process. User Guide for ZoneAlarm security software 5
Slide 24: Chapter 1: Installation and setup Upgrading from a previous version Upgrading from a previous version ZoneAlarm security software is designed for easy upgrade from version to version. In most cases, you do not need to uninstall your existing version before upgrading to version 6.5. However, if you are using any version of Integrity Client (for enterprise use only), you should first uninstall that product before upgrading. Upgrading and the Windows XP SP2 Windows Firewall If you are running Windows XP SP2 and upgrading to version 6.5, after upgrading you may need to manually turn the Windows XP SP2 Windows Firewall back on. In the Windows XP Help system, search for firewall to learn how to turn on the Windows XP Windows Firewall. Upgrading and IMsecure myVault settings If you are running the standalone version of IMsecure or IMsecure Pro and upgrading to ZoneAlarm Security Suite, the upgrade program has been designed for security reasons to not transfer Social Security, credit card, and Access PIN numbers. Upgrading and MailFrontier settings If you are running the standalone version of MailFrontier and upgrading to ZoneAlarm Security Suite, the upgrade process transfers your Address Book but other MailFrontier settings may be lost. To upgrade from a previous version: 1. Double-click the installation file. The installation program begins. 2. Select an upgrade option, then click Next to continue. Upgrade This option preserves your existing security settings and applies them to the new version. New features that are added during upgrade receive default settings. This option discards your existing security settings and restores default settings. Clean Install User Guide for ZoneAlarm security software 6
Slide 25: Installation and setup Configuring basic options Configuring basic options After completing installation, you will see the Configuration Wizard. The Configuration Wizard appears only after installation and assists you in setting the basic ZoneAlarm security software options. You can use the Configuration Wizard to enable privacy protection, set new network detection behavior, specify alert settings, enable Anti-virus protection, and configure program permissions. Configuring program access permissions ZoneAlarm security software can configure many of the most popular programs in the following software categories: Instant Messaging programs Web browsers Microsoft Office E-mail Anti-virus Microsoft Windows processes Document utilities ZoneAlarm software applications For more information about assigning permission to programs, see “Setting permissions for specific programs” on page 80. Joining the DefenseNet community ZoneAlarm security software users can help shape the future of ZoneAlarm security products by joining the DefenseNet community protection network and periodically sending anonymous configuration data to ZoneAlarm for analysis. By joining DefenseNet, you can help us focus our attention on the features and services that you use most often and to introduce new functionality that will provide even smarter security. Configuration data is not collected from ZoneAlarm or ZoneAlarm Anti-virus users. Even with the “Alert me before I make contact” preference selected in the Overview|Preferences tab, you will not be alerted before sending configuration data to ZoneAlarm. The data collected is completely anonymous and is for ZoneAlarm internal use only and will not be shared with others. Of the millions of ZoneAlarm security software users, only a small percentage of users will have their information collected. The frequency of User Guide for ZoneAlarm security software 7
Slide 26: Installation and setup Joining the DefenseNet community data transmission depends upon the configuration of your computer. For most users, data will be sent once per day. To send configuration data to ZoneAlarm, select Yes, automatically and anonymously share my settings in the Configuration Wizard. If you later decide that you do not want to send anonymous data, select Overview|Preferences, in the Contact with ZoneAlarm area, then clear the Share my settings anonymously... check box. User Guide for ZoneAlarm security software 8
Slide 27: Installation and setup Uninstalling ZoneAlarm security software Uninstalling ZoneAlarm security software If you need to uninstall ZoneAlarm security software, run the uninstall program included with your installation rather than using the Windows Add/Remove Programs utility. This ensures that all traces of ZoneAlarm security software are removed from your computer You must be logged in as a user with administrator privileges in order to uninstall ZoneAlarm security software. If you are upgrading, there is no need to uninstall your existing version. For more information, see “Installing ZoneAlarm security software” on page 4. To uninstall ZoneAlarm security software: 1. Select Start|Programs. 2. Select ZoneAlarm|Uninstall ZoneAlarm Security. The Uninstallation program begins. User Guide for ZoneAlarm security software 9
Slide 28: Installation and setup Uninstalling ZoneAlarm security software User Guide for ZoneAlarm security software 10
Slide 29: Chapter ZoneAlarm security software basics This chapter provides an introduction to the main tools and concepts of ZoneAlarm security software. Topics: “Tour of the ZoneAlarm security software Control Center,” on page 12 “Understanding Zones,” on page 18 “Responding to alerts,” on page 20 “Setting product preferences,” on page 22 “Licensing, registration, and support,” on page 27 2 11
Slide 30: Chapter 2: ZoneAlarm security software basics Tour of the ZoneAlarm security software Control Center Tour of the ZoneAlarm security software Control Center The ZoneAlarm security software Control Center provides one-stop access to the security features that keep your computer safe. ZoneAlarm security software’s major features are presented in a menu on the left side of the Control Center. Getting around the Control Center To move from feature to feature, first select the feature you want from the menu, then select the tab you want to view. Menu bar Tab selectors Dashboard Help Click to show or hide help text Figure 2-1: ZoneAlarm security software Control Center Click to resize Menu bar The menu bar provides access to the available panels. The tools in each panel are arranged in two or more tabs. 12 User Guide for ZoneAlarm security software
Slide 31: Chapter 2: ZoneAlarm security software basics Using the dashboard Tab selectors Click a tab selector to bring the tab you want to see to the top. With the exception of the Overview panel, each panel in the Control Center has a Main tab and one or two other tabs. The Main tab contains the global controls for that panel. Show /Hide Text Click this link to show or hide instructional text for the selected tab. The text gives a brief explanation of the tab and its controls. Help button To get help with the controls on any panel, click the Help link in the upper-right corner. ZoneAlarm security software’s online help system goes immediately to the help topic for the selected tab. Using the dashboard The dashboard provides constant access to basic security indicators and functions. The dashboard appears at the top of every panel. Stop button Internet Lock Inbound/Outbound Networks indicator traffic indicator Figure 2-2: ZoneAlarm security software dashboard System area Inbound/Outbound traffic indicator The traffic indicator shows you when traffic leaves (red) or enters (green) your computer. This does not imply that the traffic is illegal or that any security problem has occurred. Some applications access network resources in the background, so you may see network traffic occurring even when you aren’t actively accessing the Internet. Stop button Click the Stop button to immediately block all network activity including Internet access. Clicking the Stop button on the dashboard instantly closes your computer to incoming and outgoing Internet traffic. Therefore, you should click the Stop button only if you believe your computer is under attack, otherwise, ZoneAlarm security software may block legitimate programs that require access, as well as DHCP (Dynamic Host Configuration Protocol) messages or ISP heartbeat messages used to maintain your Internet connection. To re-open access, click the Stop button again. User Guide for ZoneAlarm security software 13
Slide 32: Chapter 2: ZoneAlarm security software basics Using the dashboard Internet Lock The Internet Lock stops all traffic except traffic initiated by programs to which you have given pass-lock permission. Clicking the Internet Lock instantly blocks DHCP messages or ISP heartbeats used to maintain your Internet connection. As a result, you may lose your Internet connection. To reopen access, click the Lock button again. You also can activate the Stop button and Internet Lock by right-clicking on the system tray icon and choosing either Stop all Internet activity or Engage Internet Lock from the shortcut menu. Networks indicator The networks indicator shows you when you have wired or wireless networks in either the Trusted Zone or Internet Zone. Click the network symbol to go immediately to the Zones tab, where the settings for the network are stored. Active Programs area The active programs area displays the icons of programs that are currently open and that have accessed the Internet in your current session. To see information about a program displayed here, hover your mouse pointer over the icon. The icon blinks when the program is sending or receiving data. A hand symbol under the icon indicates that the program is active as server and is listening for connection requests. System area This area can display two messages. All Systems Active Indicates that ZoneAlarm security software is functioning normally. Error Please Reboot Indicates that you are not protected by ZoneAlarm security software because the underlying security process is not running. Restart your computer to allow ZoneAlarm security software to reset. User Guide for ZoneAlarm security software 14
Slide 33: Chapter 2: ZoneAlarm security software basics System Tray icons System Tray icons The icons displayed in the system tray let you monitor your security status and Internet activity as frequently as you wish, and access your security settings in just a few clicks. Icon Description ZoneAlarm security software is installed and running. Your computer is sending (red band) or receiving (green band) network traffic. This does not imply that you have a security problem, or that the network traffic is dangerous. ZoneAlarm security software is running a spyware and/or virus scan. For details about scans, see “Performing a spyware scan,” on page 110, or “Performing a virus scan,” on page 105. Game Mode is activated, causing ZoneAlarm security software to suppress updates, scans, and most alerts. For details about this feature, see “Game Mode,” on page 174. ZoneAlarm security software is receiving an update, such as an update of new spyware definitions or virus definitions. ZoneAlarm security software has blocked a communication, but your settings prevent a full-sized alert from being shown. (Yellow lock) The Internet Lock is engaged. (Red lock) The Stop button is engaged. You may also begin to see a lot of alerts. Table 2-3: System Tray icons Shortcut menu Right-click any of the system tray icons to access a shortcut menu. Engage Internet Lock This menu option engages the Internet Lock and displays the yellow lock icon in the system tray. All Internet traffic initiated by programs without pass-lock permission is blocked. Provides the same function as clicking on the Internet Lock in the dashboard. Stop All Internet Traffic This menu option engages the Stop button and displays the red lock icon in the system tray. All Internet traffic is blocked. Provides the same function as clicking on the Stop button in the dashboard. Game Mode / Stop Game Mode The Game Mode option brings up the dialog that controls Game Mode. When activated, Game Mode causes ZoneAlarm security software to suppress updates, scans, and most alerts. Depending on your settings, ZoneAlarm security software will either deny or allow most program and network permission requests while Game Mode is active. You can use the Stop Game Mode option, which appears only while Game Mode User Guide for ZoneAlarm security software 15
Slide 34: Chapter 2: ZoneAlarm security software basics Using the Status tab is active, to turn Game Mode off. For details about this feature, see “Game Mode,” on page 174. Help Displays help files. View Scan Displays the Scanning Status dialog box, which tracks the progress of spyware and virus scans. This menu option is available only during such scans. About Displays version information for the Zone Labs security software you have installed, including driver and engine information. If you are experiencing problems with your software you can copy this information to the clipboard and paste it into an e-mail to support. Restore ...Control Center Restores the Zone Labs security software Control Center to its full size. The label for this menu option reflects the version of Zone Labs security software you have installed (for example ZoneAlarm Anti-virus or ZoneAlarm Security Suite). Shutdown... Closes the Zone Labs security software application. The label for this menu option reflects the version of the Zone Labs security software you have installed (for example, ZoneAlarm Anti-virus or ZoneAlarm Security Suite). Using the Status tab The protection area of the Status tab tells you whether your security settings are enabled and provides a summary of security activity. From the Status tab you can: See at a glance if your computer is secure See a summary of ZoneAlarm security software’s activity See if your version of ZoneAlarm security software is up to date Access the product tutorial To reset the alert counts in this area, click Reset to Default at the bottom of the panel. Blocked intrusions Shows you how many times the ZoneAlarm security software firewall and MailSafe have acted to protect you, and how many were high-rated alerts. Inbound Protection Indicates whether your firewall is on and displays the number of Firewall alerts, MailSafe alerts, and Internet Lock alerts that have occurred since the last reset. If a warning is displayed, click the underlined warning text to go immediately to the panel where you can adjust your settings. User Guide for ZoneAlarm security software 16
Slide 35: Chapter 2: ZoneAlarm security software basics Using the Status tab Outbound Protection Indicates whether program control is configured safely and displays the number of program alerts that have occurred since the last reset. ZoneAlarm security software will warn you if program control is disabled. Anti-virus Protection Indicates whether your computer is protected against viruses and displays the number of viruses that have been treated to date. The Anti-virus Protection status only appears in ZoneAlarm Anti-virus and ZoneAlarm Security Suite. If you are using ZoneAlarm or ZoneAlarm Pro, you will see Anti-virus Monitoring status instead. E-mail Protection area Indicates whether MailSafe is enabled and displays the number of attachments that have been quarantined since the last reset. If a warning is displayed, click the underlined warning text to go immediately to the panel where you can adjust your settings. Anti-virus / Anti-spyware Indicates whether virus and spyware protection is enabled and displays the number of viruses and spies that have been treated. IM Security Protection Indicates whether Instant Messaging protection is enabled and displays the number of messages that have been scanned. Update and tutorial information When you purchase ZoneAlarm security software, you receive an automatic update subscription valid for one year. The update box helps you make sure you’re running the latest version of ZoneAlarm security software, and gives you quick access to product updates when they arrive. Message “Check for update.” Meaning Click the link to see if there are any important updates to Zone Labs security software available for download. Your automatic update subscription indicates that an update to ZoneAlarm security software is available. Click the link to go to the ZoneAlarm Web site to download the update. You have the most up-to-date version of ZoneAlarm security software. Your automatic update subscription has expired. Click the link to go to the ZoneAlarm Web site to renew your subscription. “An update is available.” “Firewall is up to date” “Update subscription expired. Click to Renew.” Table 2-4: Update messages Click Tutorial to learn the basics of how ZoneAlarm security software works. User Guide for ZoneAlarm security software 17
Slide 36: Chapter 2: ZoneAlarm security software basics Understanding Zones Understanding Zones ZoneAlarm security software keeps track of the good, the bad, and the unknown out on the Internet by using virtual containers, called Zones, to classify the computers and networks that connect to your computer. The Internet Zone is the “unknown.” All the computers and networks in the world belong to this Zone—until you move them to one of the other Zones. The Trusted Zone is the “good.” It contains all the computers and networks you trust and want to share resources with—for example, the other machines on your local or home network. The Blocked Zone is the “bad.” It contains computers and networks you distrust. When another computer wants to communicate with your computer, ZoneAlarm security software looks at the Zone it is in to help decide what to do. To learn how to put a computer, network, or program in the Trusted Zone, see “Managing traffic sources,” on page 48. Zones manage firewall security ZoneAlarm security software uses security levels to determine whether to allow or block inbound traffic from each Zone. Use the Firewall panel, Main tab to view and adjust security levels. High security setting High security places your computer in stealth mode, making it invisible to hackers. High security is the default configuration Internet Zone. In High security, file and printer sharing is disabled; but outgoing DNS, outgoing DHCP, and broadcast/multicast are allowed, so that you are able to browse the Internet. All other ports on your computer are closed except when used by a program that has access permission and/or server permission. Medium security setting Medium security places your computer in component learning mode, where ZoneAlarm security software quickly learn the MD5 signatures of many frequently used program components without interrupting your work with multiple alerts. Medium security is the default setting for the Trusted Zone. In Medium security, file and printer sharing is enabled, and all ports and protocols are allowed. (If Medium security is applied to the Internet Zone, however, incoming NetBIOS traffic is blocked. This protects your computer from possible attacks aimed at your Windows networking services.) At Medium security, you are no longer in stealth mode. We recommend that you use the Medium security setting for the first few days of normal Internet use after installing ZoneAlarm security software. After a few days of normal use, ZoneAlarm security software will have learned the signatures of the User Guide for ZoneAlarm security software 18
Slide 37: Chapter 2: ZoneAlarm security software basics Zones provide program control majority of the components needed by your Internet-accessing programs, and will remind you to raise the Program Authentication level to High. No security level is necessary for the Blocked Zone, because no traffic to or from that Zone is allowed. Advanced users can customize high and medium security for each Zone by blocking or opening specific ports. For more information, see “Blocking and unblocking ports,” on page 52. Zones provide program control Whenever a program requests access permission or server permission, it is trying to communicate with a computer or network in a specific Zone. For each program you can grant or deny the following permissions: Access permission for the Trusted Zone. Access permission for the Internet Zone. Server permission for the Trusted Zone. Server permission for the Internet Zone. By granting access or server permission for the Trusted Zone, you enable a program to communicate only with the computers and networks you have put in that Zone. This is a highly secure strategy. Even if a program is tampered with, or given permission accidentally, it can only communicate with a limited number of networks or computers. By granting access or server permission for the Internet Zone, however, you enable a program to communicate with any computer or network, anywhere. Advanced users can specify the ports and protocols a particular program can use, the hosts it can access, and other details. For more information, see “Creating an expert rule for a Program,” on page 91. User Guide for ZoneAlarm security software 19
Slide 38: Chapter 2: ZoneAlarm security software basics Responding to alerts Responding to alerts When you first start using ZoneAlarm security software, it is not unusual to see a number of alerts. Don’t worry! This doesn’t mean you’re under attack. It just means that ZoneAlarm security software is learning your program and network configurations, and giving you the opportunity to set up your security the way you want it. How you respond to an alert depends upon the type of alert displayed. For information on responding to a particular type of alert, see Appendix A,“Alert reference,” starting on page 219. New Program alerts The majority of the initial alerts you see will be New Program alerts. These alerts occur when a program on your computer requests access or server permission to the Internet or your local network. Use the New Program alert to give access permission to programs that need it—like your browser and e-mail program. Use the check box labeled Remember this answer to give permanent permission to programs you trust. Few programs or processes actually require server permission in order to function properly. Some processes, however, are used by Microsoft Windows to carry out legitimate functions. Some of the more common ones you may see in alerts are: lsass.exe spoolsv.exe svchost.exe services.exe winlogon.exe If you do not recognize the program or process that is asking for server permission, search the Microsoft Support Web site (http://support.microsoft.com/) for information on the process to determine what it is and what it’s used for. Be aware that many legitimate Windows processes, including those listed above, have the potential to be used by hackers to disguise worms and viruses, or to provide backdoor access to your system for Trojan horses. If you were not performing a function (such as browsing files, logging onto a network, or downloading files) when the alert appeared, then the safest approach is to deny server permission. At any time, you can assign permissions to specific programs and services from the Programs List, accessed by selecting Program Control|Programs tab. To learn more about New Program alerts and how to respond to them, see “New Program alert,” on page 226. User Guide for ZoneAlarm security software 20
Slide 39: Chapter 2: ZoneAlarm security software basics New Network and VPN alerts New Network and VPN alerts The other initial alerts you may see are the New Network alert and VPN Configuration alerts. These occur when ZoneAlarm security software detects a network connection or VPN connection. They help you configure your Trusted Zone, port/protocol permission, and program permissions correctly so that you can work securely over your network. For details about these alerts and how to respond to them, see Appendix A,“Alert reference,” starting on page 219. User Guide for ZoneAlarm security software 21
Slide 40: Chapter 2: ZoneAlarm security software basics Setting product preferences Setting product preferences Use the Preferences tab to set or change your ZoneAlarm security software password, log in or log out, manage updates, set general options for the display of the ZoneAlarm security software Control Center, and configure privacy settings for communications with ZoneAlarm. Setting update options When you purchase ZoneAlarm security software you receive a year of free updates. You can check for updates manually, or set ZoneAlarm security software to check automatically. To set check for update settings: 1. Select Overview|Preferences. 2. In the Check for Updates area, choose an update option. Automatically Manually ZoneAlarm security software automatically notifies you when an update is available. You monitor the Status tab for updates. To invoke an update check immediately, click Check for Update. Setting your password By setting a password, you prevent anyone but you from shutting down or uninstalling ZoneAlarm security software, or changing your security settings. Setting a password will not prevent other people from accessing the Internet from your computer. The ability to create a password is not available in ZoneAlarm. If your version of ZoneAlarm security software was installed by an administrator with an installation password, that administrator can access all functions. When you set a password for the first time, be sure to log out before leaving your computer. Otherwise, others can still change your settings. To set or change a ZoneAlarm security software password: 1. Select Overview|Preferences. 2. Click Set Password. 3. Type your password and password verification in the fields provided. 4. Select Allow others to use programs without a password (unless the program permission is set to “Block”) to allow others to use programs you haven’t explicitly blocked, even if they don’t have a password. User Guide for ZoneAlarm security software 22
Slide 41: Chapter 2: ZoneAlarm security software basics Backing up and restoring security settings 5. Click OK. Valid passwords are between 6 and 31 characters long. Valid characters include A-Z, a-z, 0-9, and characters !,@,#,$,%,^,&,*. Once you have set a password, you must log in before you can change settings, shut down the TrueVector security engine, or uninstall ZoneAlarm security software. Backing up and restoring security settings You can back up your existing security settings to an XML file so that you can restore them later, should you need to. The backup and restore feature should not be used to share settings among different computers or to distribute security policies. To do so could cause an extremely high number of alerts to appear due to differences among computers, applications, and Windows processes. The ability to back up and restore settings is only available in ZoneAlarm Pro and ZoneAlarm Security Suite. To back up security settings 1. Select Overview|Preferences. 2. In the Backup and Restore Security Settings area, click Backup. 3. Type a file name or select an existing file to overwrite. 4. Click Save. To back up or restore security settings 1. Select Overview|Preferences. 2. In the Backup and Restore Security Settings area, click Restore. 3. Select the XML file which contains the settings you want to use. 4. Click Open. Setting general product preferences By default, ZoneAlarm security software starts automatically when you turn on your computer. Use the settings in the General area to change this and other options. User Guide for ZoneAlarm security software 23
Slide 42: Chapter 2: ZoneAlarm security software basics Setting contact preferences To set general display preferences: 1. Select Overview|Preferences. 2. In the General area, specify your preferences. Load ZoneAlarm security software at startup Protect the ZoneAlarm security software client ZoneAlarm security software starts automatically when you turn on your computer. Prevents Trojan horses from sending Keyboard and Mouse requests to ZoneAlarm security software. Note: To ensure maximum security, only disable this feature if you are having problems with your keyboard or mouse while using remote access programs. 3. In the General area, click Options. The Options dialog box appears. 4. In the Display settings area, choose your display preferences. Remember the last tab visited Color-scheme Opens ZoneAlarm security software to the tab that you had open the last time you closed the Control Center. Allows you to change the default color scheme of the Control Center. Additional color choices are not available in ZoneAlarm. 5. In the Proxy Configuration area, enter the IP address of your proxy server information only if you are certain that it is necessary to do so. ZoneAlarm security software automatically detects most proxy configurations, such as those configured through Internet Explorer. making it unnecessary to enter that information here. You should enter proxy information only if you have an uncommon proxy configuration, such as a scripted proxy, and if some product features such as anti-virus updates or instant messaging aren't working. Setting contact preferences Setting contact preferences ensures that your privacy is protected when ZoneAlarm security software communicates with ZoneAlarm (for example, to check automatically for updates). To set contact preferences: 1. Select Overview|Preferences. User Guide for ZoneAlarm security software 24
Slide 43: Chapter 2: ZoneAlarm security software basics Setting product display and proxy server options 2. In the Contact with ZoneAlarm area, specify your preferences. Alert me with a pop-up before I make contact Displays a warning before contacting ZoneAlarm to deliver registration information, get product updates, research an alert, or access DNS to look up IP addresses. Note: There are certain situations in which you will not be notified before contact is made. Those include sending DefeneseNet data to ZoneAlarm, contacting ZoneAlarm for program advice, when an anti-virus update is performed, or when monitoring your anti-virus status. The “Share setting anonymously...” setting below, turns off the DefenseNet transfer. All other settings can be disabled from the main tab of their respective panels. Hide my IP address when applicable Prevents your computer from being identified when you contact Zone Labs, LLC. Hide the last octet of my Omits the last section of your IP address (for example, IP address when applica- 123.456.789.XXX) when you contact Zone Labs, LLC. ble Share my security settings anonymously with ZoneAlarm Periodically sends anonymous configuration data to ZoneAlarm. For more information, see “Joining the DefenseNet community,” on page 7. Note: Configuration data is not collected from ZoneAlarm or ZoneAlarm Anti-virus users. Setting product display and proxy server options You can use the Options dialog box to specify display setting options and proxy server information. To set product display and proxy options: 1. Select Overview|Preferences. 2. In the General area, click Options. The Options dialog box appears. 3. In the Display settings area, specify your preferences. Remember the last tabs visited in the panels Color-scheme Opens ZoneAlarm security software to the most recently viewed panel and tab the next time you open the Control Center. Allows you to change the default color scheme of the Control Center. Additional color choices are not available in ZoneAlarm. 4. Enter proxy server information, where necessary. ZoneAlarm Security Software automatically detects most proxy configurations, such as those configured through Internet Explorer, making it unnecessary to enter that information here. You only need to enter your proxy information if you have an 25 User Guide for ZoneAlarm security software
Slide 44: Chapter 2: ZoneAlarm security software basics Creating an online fraud protection profile uncommon proxy configuration, such as a scripted proxy, and if you find that some product features such as anti-virus updates aren't working. Creating an online fraud protection profile If you are an eBay user, you can protect yourself against online fraud by storing your online credentials in ZoneAlarm security software. ZoneAlarm security software protects your profile by making sure it is only sent to authorized eBay destinations. To create your online protection profile in ZoneAlarm and ZoneAlarm Anti-virus: 1. Select Overview|Preferences. 2. In the eBay Protection Profile area, click Password. The Alliance Partner Password dialog displays. 3. Select eBay from the Alliance Partner drop-down list. 4. Type your eBay password into the password and confirm fields, then click OK. To enter your eBay password in ZoneAlarm Pro or ZoneAlarm Security Suite: 1. Select ID Lock|myVAULT, then click Add. The Add information to myVAULT dialog appears. 2. Type a description of the item, then select eBay password from the category dropdown list. 3. Type your eBay password into the password and confirm fields, then click OK. Asterisks will appear in place of the data you entered and an encrypted form of your eBay password will be stored in myVAULT. The original information is not stored on your computer. 4. Specify whether you want the information to be protected when using Web and Email. 5. Click OK to save your changes. For more information about how ZoneAlarm security software keeps passwords and other personal data safe, see Chapter 10,“Identity protection,” starting on page 185. User Guide for ZoneAlarm security software 26
Slide 45: Chapter 2: ZoneAlarm security software basics Licensing, registration, and support Licensing, registration, and support In order to receive support and updates for ZoneAlarm security software, you must have a valid license. Updating your product license If you have been using a trial or beta license key and have purchased a full license, or if your trial or beta is about to expire, you can purchase a full license from ZoneAlarm. To purchase a license: 1. Select Overview|Product Info. 2. In the Licensing Information area, click Buy Now! You will be directed to the ZoneAlarm Web site, where you can complete your product purchase. To change your license key: 1. Select Overview|Product Info. 2. In the Licensing Information area, click Change Lic. The License Information dialog appears. 3. In the space provided, either type or paste your license key. 4. Click Apply, then click OK. Registering ZoneAlarm security software Register ZoneAlarm security software to receive security news from ZoneAlarm. To register ZoneAlarm security software: 1. Select Overview|Product Info. 2. In the Registration area, click Change Reg. The Registration Information dialog appears. 3. Type your name, organization, and e-mail address in the fields provided. The e-mail address you enter here is used to configure your Outbound MailSafe protection. Be sure to enter your e-mail address correctly. For more information, see “Setting Outbound MailSafe protection options,” on page 129. 4. To be notified of product news and updates, select the check box labeled Inform me of important updates and news. 5. Click OK. User Guide for ZoneAlarm security software 27
Slide 46: Chapter 2: ZoneAlarm security software basics Accessing technical support To change your registration information: Select Overview|Prod Info, then click Change Reg. Accessing technical support If you are eligible to receive technical support, you can access support resources, such as FAQs and known issues, directly from ZoneAlarm security software. To access support resources: 1. Select Overview|Prod Info. 2. In the Support and Update Information area, click the click here link. The ZoneAlarm Support Center Web site appears. 3. Click the Support & Services link, then select the product for which you need support. User Guide for ZoneAlarm security software 28
Slide 47: ZoneAlarm security software basics Accessing technical support User Guide for ZoneAlarm security software 29
Slide 48: ZoneAlarm security software basics Accessing technical support User Guide for ZoneAlarm security software 30
Slide 49: Chapter Networking with ZoneAlarm security software If you’re on a home network, business Local Area Network (LAN), or Virtual Private Network (VPN), or a wireless network, you want to ensure smooth communication with the network while still maintaining high security. The Network Configuration Wizard, automatic VPN configuration, and other features of ZoneAlarm security software help you to quickly set up your network environment. Topics: “Configuring a new network connection,” on page 32 “Integrating with network services,” on page 35 “Configuring your VPN connection,” on page 37 3 31
Slide 50: Chapter 3: Networking with ZoneAlarm security software Configuring a new network connection Configuring a new network connection If your computer connects to a network, you have to decide whether to place that network in the Trusted Zone or in the Internet Zone. Placing a network in the Trusted Zone enables you to share files, printers, and other resources with other computers on that network. Networks you know and trust, such as your home or business LAN and known protected wireless networks, should go in the Trusted Zone. Placing a network in the Internet Zone prevents you from sharing resources with other computers on that network and protects you from the security risks associated with resource sharing. Unknown networks and most wireless networks, even secured wireless networks, should go in the Internet Zone. The Network Configuration Wizard helps you make this decision by determining whether the detected LAN network is public or private. The Wireless Network Configuration Wizard helps you make this decision by determining whether the detected wireless network is secured or unsecured. Disabling the Wireless Network Configuration Wizard Using the Network Configuration Wizard When your computer connects to a new network, ZoneAlarm security software opens the Network Configuration Wizard, displaying the IP address of the detected network. The IP address of the network is used to determine whether it is a private network or a public network. A private network is usually a home or business Local Area Network (LAN). Private networks are placed in the Trusted Zone by default. A public network is usually a much larger network, such as that associated with an ISP. Public networks are placed in the Internet Zone by default. To configure your network connection using the Network Configuration Wizard: 1. Choose the Zone you want this network in, then click Next. 2. Name the network. The name you enter here will be displayed in the Zones tab of the Firewall panel. If you prefer not to use the Network Configuration Wizard, click Cancel in the Wizard screen. A New Network alert will appear. The detected network will be placed in the Internet Zone, even if it is a private network. For information on using the New Network alert, see “New Network alert,” on page 237. User Guide for ZoneAlarm security software 32
Slide 51: Chapter 3: Networking with ZoneAlarm security software Disabling the Network Configuration Wizard Disabling the Network Configuration Wizard The Network Configuration Wizard is enabled by default. If you prefer to use the New Network Alert to configure new networks, you can disable the Network Configuration Wizard. To disable the Network Configuration Wizard: In screen four of the Wizard, select the check box labeled Do not show this Wizard the next time a new network is detected, then click Finish. Using the Wireless Network Configuration Wizard When your computer connects to a new wireless network, ZoneAlarm security software opens the Wireless Network Configuration Wizard, then displays the IP address of the detected network. The WEP (Wireless Encryption Protocol) setting on the wireless access point is used to determine whether it is a secured wireless network or an unsecured wireless network. A secured wireless network is WEP enabled. WEP provides an initial barrier that can be easily penetrated by hackers. In order to truly secure the network, the wireless access point must have other features implemented, such as a limited access list or SSID (Service Set Identifier) broadcast disabled. Only place wireless networks that you know have a higher level of security and where you need to share resources or print in the Trusted Zone. An unsecured wireless network may be completely unprotected and accessible by anyone. Unsecured networks are placed in the Internet Zone by default. To configure a wireless connection: 1. Choose the Zone you want this network in, then click Next. 2. Name the network. The name you enter in the Configuration Wizard displays in the Zones tab of the Firewall panel. If you prefer not to use the Network Configuration Wizard, click Cancel in any Wizard screen. A New Network alert will appear. The detected network will be placed in the Internet Zone, even if it is a secured wireless network. For information on using the New Network alert, see “New Network alert,” on page 237. Disabling the Wireless Network Configuration Wizard The Network Configuration Wizard is enabled by default. If you prefer to use the New Network Alert to configure new networks, you can disable the Network Configuration Wizard. User Guide for ZoneAlarm security software 33
Slide 52: Chapter 3: Networking with ZoneAlarm security software Disabling the Wireless Network Configuration Wiz- To disable the Wireless Network Configuration Wizard: In screen four of the Wizard, select the check box labeled Do not show this Wizard the next time a new network is detected, then click Finish. User Guide for ZoneAlarm security software 34
Slide 53: Chapter 3: Networking with ZoneAlarm security software Integrating with network services Integrating with network services If you’re working on a home or business network, you may want to share files, network printers, or other resources with other people on the network, or send and receive email through your network’s mail servers. Use the instructions in this section to enable safe resource sharing. Enabling file and printer sharing To share printers and files with other computers on your network, you will need to configure ZoneAlarm security software to allow access to the computers with which you plan to share resources. To configure ZoneAlarm security software for file and printer sharing: 1. Add the network subnet (or, in a small network, the IP address of each computer you’re sharing with) to your Trusted Zone. See “Adding to the Trusted Zone,” on page 49. 2. Set the Trusted Zone security level to Medium. This allows trusted computers to access your shared files. See “Setting the security level for a Zone,” on page 43. 3. Set Internet Zone security to High. This makes your computer invisible to nontrusted machines. See “Setting the security level for a Zone,” on page 43. Connecting to network mail servers ZoneAlarm security software is configured to automatically work with Internet-based mail servers using POP3 and IMAP4 protocols, when you give your e-mail client permission to access the Internet. Some mail servers, like Microsoft Exchange, include collaboration and synchronization features that might require you to trust the server in order for those services to work. To configure ZoneAlarm security software for mail servers with collaboration and synchronization features: 1. Add the network subnet or IP address of the mail server to your Trusted Zone. 2. Set the Trusted Zone security level to Medium. This allows server collaboration features to work. 3. Set Internet Zone security level to High. This makes your computer invisible to nontrusted machines. User Guide for ZoneAlarm security software 35
Slide 54: Chapter 3: Networking with ZoneAlarm security software Enabling Internet Connection Sharing Enabling Internet Connection Sharing If you are using Windows’ Internet Connection Sharing (ICS) option, or a third-party connection sharing program, you can protect all of the computers that share the connection from inbound threats by installing ZoneAlarm security software on the gateway machine only. However, to receive outbound protection, or to see alerts on the client machines, you must have ZoneAlarm security software installed on the client machines as well. Before you configure ZoneAlarm security software, use your ICS software to set up the gateway and client relationships. If you use hardware such as a router to share your Internet connection rather than Microsoft’s Internet Connection Sharing (ICS), ensure that the local subnet is in the Trusted Zone. User Guide for ZoneAlarm security software 36
Slide 55: Chapter 3: Networking with ZoneAlarm security software Configuring your VPN connection Configuring your VPN connection ZoneAlarm security software is compatible with many types of VPN client software and can automatically configure the connection for certain VPN clients. Supported VPN protocols ZoneAlarm security software monitors the VPN protocols listed in the table below. Networking Protocol AH ESP GRE IKE IPSec L2TP LDAP PPTP SKIP Table 3-1: Supported VPN protocols Explanation and Comments Authentication Header Protocol Encapsulating Security Payload protocol Generic Routing Encapsulation protocol Internet Key Exchange protocol IP Security protocol. Layer 2 Tunneling protocol. L2TP is a more secure variation of PPTP. Lightweight Directory Access protocol Point-to-Point Tunneling protocol Simple Key Management for Internet Protocol Configuring your VPN connection automatically When VPN traffic is detected, an Automatic VPN Configuration alert is displayed. Depending upon the type of VPN activity detected, and whether ZoneAlarm security software was able to configure your VPN connection automatically, you may see one of three Automatic VPN Configuration alerts. For detailed information about the types of Automatic VPN Configuration alerts you may see and how to respond to them, see “Automatic VPN Configuration alert,” on page 231. For instance, manual action may be required if the loopback adaptor or the IP address of the VPN gateway falls within a range or subnet that you have blocked. For more information, see “Configuring your VPN connection manually,” on page 38. If you have created an expert firewall rule that blocks VPN traffic, you will need to modify the expert rule to allow VPN traffic. See “Creating expert firewall rules,” on page 57. User Guide for ZoneAlarm security software 37
Slide 56: Chapter 3: Networking with ZoneAlarm security software Configuring your VPN connection manually Configuring your VPN connection manually If your VPN connection cannot be configured automatically, ZoneAlarm security software displays a Manual Action Required alert informing you of the manual changes you need to make to configure your connection. Refer to the following sections for manual configuration instructions: Adding a VPN gateway and other resources to the Trusted Zone Removing a VPN gateway from a blocked range or subnet Allowing VPN protocols Granting access permission to VPN software If you have created an expert firewall rule that has blocked PPTP traffic and your VPN software uses PPTP, you will need to modify the expert rule. See “Creating expert firewall rules,” on page 57. User Guide for ZoneAlarm security software 38
Slide 57: Chapter 3: Networking with ZoneAlarm security software Adding a VPN gateway and other resources to the Adding a VPN gateway and other resources to the Trusted Zone In addition to the VPN gateway, There may be other VPN-related resources that need to be in the Trusted Zone for your VPN to function properly. Required Resources The resources below are required by all VPN client computers and must be added to the Trusted Zone. VPN Concentrator Other Resources The resources below may or may not be required, depending on your specific VPN implementation. DNS servers Remote host computers connected to the Local host computer’s NIC loopback address VPN client (if not included in the subnet def- (depending on Windows version). If you initions for the corporate network) specify a local host loopback address of 127.0.0.1, do not run proxy software on the local host. Corporate Wide Area Network (WAN) subnets Internet Gateway that will be accessed by the VPN client computer Corporate LANs that will be accessed by the VPN computer Local subnets Security servers (for example, RADIUS,ACE, or TACACS servers) Table 3-2: Required VPN-related network resources See “Adding to the Trusted Zone,” on page 49, to learn how to add resources to your computer’s Trusted Zone. Removing a VPN gateway from a blocked range or subnet If the VPN gateway falls within a range or subnet that you have blocked, you must manually unblock the range. To unblock an IP range or subnet: 1. Select Firewall|Zones. 2. In the Zone column, select the blocked IP range or subnet. 3. Select Trusted from the shortcut menu, then click Apply. Allowing VPN protocols To ensure proper configuration of your VPN software with ZoneAlarm security software, you will need to modify your general security settings to allow VPN protocols. To allow VPN protocols: 1. Select Firewall|Main, then click Advanced. User Guide for ZoneAlarm security software 39
Slide 58: Networking with ZoneAlarm security software Granting access permission to VPN software 2. In the General settings area, select the check box labeled Allow VPN protocols. 3. Click OK. If your VPN program uses protocols other than GRE, ESP, and AH, also select the check box labeled Allow uncommon protocols at high security. Granting access permission to VPN software Grant access permission to the VPN client and any other VPN-related programs. To grant permission to your VPN program: 1. Select Program Control|Programs. 2. In the Programs column, select your VPN program. 3. In the Access column, click below Trusted, then select Allow from the shortcut menu. If your VPN program is not listed, click Add to add it to the list. To grant access to VPN-related components: 1. Select Program Control|Components. 2. In the Components column, select the VPN component for which you want to grant access. 3. In the Access column, select Allow from the shortcut menu. If you are experiencing problems with your VPN connection, refer to the VPN troubleshooting tips in Appendix C,“Troubleshooting,” starting on page 249. User Guide for ZoneAlarm security software 40
Slide 59: Chapter Firewall protection Firewall protection is your front line of defense against Internet threats. ZoneAlarm security software’s default Zones and security levels give you immediate protection against the vast majority of threats. If you’re an advanced user, custom port permissions and expert rules give you detailed control of traffic based on source, destination, port, protocol, and other factors. Topics: “Understanding Firewall protection,” on page 42 “Choosing security levels,” on page 43 “Setting advanced security options,” on page 44 “Managing traffic sources,” on page 48 “Blocking and unblocking ports,” on page 52 “Understanding expert firewall rules,” on page 55 “Creating expert firewall rules,” on page 57 “Creating groups,” on page 59 “Managing Expert Firewall Rules,” on page 63 4 41
Slide 60: Chapter 4: Firewall protection Understanding Firewall protection Understanding Firewall protection In buildings, a firewall is a barrier that prevents a fire from spreading. In computers, the concept is similar. There are a variety of “fires” out there on the Internet—hacker activity, viruses, worms, and so forth. A firewall is a system that stops these attempts to damage your computer. The ZoneAlarm security software firewall guards the “doors” to your computer—that is, the ports through which Internet traffic comes in and goes out. ZoneAlarm security software examines all the network traffic arriving at your computer, and asks these questions: What Zone did the traffic come from and what port is it addressed to? Do the rules for that Zone allow traffic through that port? Does the traffic violate any global rules? Is the traffic authorized by a program on your computer (Program Control settings)? The answers to these questions determine whether the traffic is allowed or blocked. User Guide for ZoneAlarm security software 42
Slide 61: Chapter 4: Firewall protection Choosing security levels Choosing security levels The default firewall security levels (High for the Internet Zone, Med. for the Trusted Zone) protect you from hacker activity (such as a port scan), while enabling you to share printers, files, and other resources with trusted computers on your local network. In most cases, you don’t have to make any adjustment to these defaults. You’re protected as soon as ZoneAlarm security software is installed! Setting the security level for a Zone Security levels make it easy to configure your firewall settings. You can apply a preconfigured security level (High, Medium, or Off) to each Zone, or you can specify the port and protocol restrictions for each level. See “Blocking and unblocking ports,” on page 52. To set the security level for a Zone: 1. Select Firewall|Main. 2. In the Internet Zone Security area, click the slider and drag it to the desired setting. High Your computer is in stealth mode, making it invisible to other computers. Access to Windows NetBIOS (Network Basic Input/Output System) services, file and printer shares is blocked. Ports are blocked unless you have provided permission for a program to use them. Med Your computer is visible to other computers. Access to Windows services, file and printer shares is allowed. Program permissions are still enforced. Off Your computer is visible to other computers. Access to Windows services, file and printer shares is allowed. Program permissions are still enforced. 3. In the Trusted Zone Security area, click the slider and drag it to the desired area. High Your computer is in stealth mode, making it invisible to other computers. Access to Windows (NetBIOS) services, file and printer shares is blocked. Ports are blocked unless you have provided permission for a program to use them. Med Your computer is visible to other computers. Access to Windows services, file and printer shares is allowed. Program permissions are still enforced. Off Your computer is visible to other computers. Access to Windows services, file and printer shares is allowed. Program permissions are still enforced. User Guide for ZoneAlarm security software 43
Slide 62: Chapter 4: Firewall protection Setting advanced security options Setting advanced security options Advanced security options enable you to configure the firewall for a variety of special situations, such as gateway enforcement and Internet Connection Sharing (ICS). Setting gateway security options Some companies require their employees to use ZoneAlarm security software when connecting to the Internet through their corporate game mode. When the Automatically check the gateway... control is selected, ZoneAlarm security software checks for any compatible gateways and confirms that it is installed so that gateways requiring ZoneAlarm security software will grant access. You can leave this option selected even if you are not connecting through a gateway. Your Internet functions will not be affected. Setting ICS (Internet Connection Sharing) options If you are using ICS (Internet Connection Sharing), use these controls to configure ZoneAlarm security software to recognize the ICS gateway and clients. To set Internet Connection Sharing preferences: 1. Select Firewall|Main. 2. Click Advanced. 3. In the Internet Connection Sharing area, choose your security settings. This computer is not on an ICS/NAT network This is a client of an ICS/NAT gateway running ZoneAlarm security software Internet Connection sharing is disabled. ZoneAlarm security software automatically detects the IP address of the ICS gateway and displays it in the Gateway Address field. You also can type the IP address into the Gateway address field. Selecting Forward alerts from gateway to this computer will log and display alerts on the client computer that occur on the gateway. This computer is an ICS/NAT gateway ZoneAlarm security software automatically detects the IP address of the ICS gateway and displays it in the Local Address field. You also can type the IP address into the Gateway address field. Selecting Suppress alerts locally if forwarded to clients, will suppress alerts forwarded from the gateway to clients to also be displayed on the gateway. 4. Click OK. User Guide for ZoneAlarm security software 44
Slide 63: Chapter 4: Firewall protection Setting general security options Setting general security options These controls apply global rules regarding certain protocols, packet types and other forms of traffic (such as server traffic) to both the Trusted Zone and the Internet Zone. To modify general security settings: 1. Select Firewall|Main. 2. Click Advanced. 3. In the General area, choose your security settings. Block all fragments Blocks all incomplete (fragmented) IP data packets. Hackers sometimes create fragmented packets to bypass or disrupt network devices that read packet headers. Caution: If you select this option, ZoneAlarm security software will silently block all fragmented packets without alerting you or creating a log entry. Do not select this option unless you are aware of how your online connection handles fragmented packets. Block trusted servers Prevents all programs on your computer from acting as servers to the Trusted Zone. Note that this setting overrides permissions granted in the Programs panel. Prevents all programs on your computer from acting as servers to the Internet Zone. Note that this setting overrides permissions granted in the Programs panel. Blocks all incoming ARP (Address Resolution Protocol) requests except broadcast requests for the address of the target computer. Also blocks all incoming ARP replies except those in response to outgoing ARP requests. Allows the use of VPN protocols (ESP, AH, GRE, SKIP) even when High security is applied. With this option disabled, these protocols are allowed only at Medium security. Allows the use of protocols other than ESP, AH, GRE, and SKIP, at High security. Prevents your computer’s hosts file from being modified by hackers through sprayer or Trojan horses. Because some legitimate programs need to modify your hosts file in order to function, this option is turned off by default. Detects and disables Windows Firewall. This option will only appear if you are using Windows XP with Service Pack 2. Filters FireWire traffic. Block Internet servers Enable ARP protection Allow VPN Protocols Allow uncommon protocols at high security Lock hosts file Disable Windows Firewall Filter IP over 1394 traffic 4. Click OK. User Guide for ZoneAlarm security software 45
Slide 64: Chapter 4: Firewall protection Setting network security options Setting network security options Automatic network detection helps you configure your Trusted Zone easily so that traditional local network activities such as file and printer sharing aren’t interrupted. ZoneAlarm security software detects only networks that you are physically connected to. Routed or virtual network connections are not detected. You can have ZoneAlarm security software silently include every detected network in the Trusted Zone; or ask you in each case whether to add a newly detected network. To specify Network settings: 1. Select Firewall|Main. 2. Click Advanced. 3. In the Network settings area, choose your security settings. Include networks in the Trusted Zone upon detection Exclude networks from the Trusted Zone upon detection Automatically moves new networks into the Trusted Zone. This setting provides the least security. Automatically blocks new networks from being added to the Trusted Zone and places them in the Internet Zone. This setting provides the most security. ZoneAlarm security software displays a New Network alert or the Network Configuration Wizard, which give you the opportunity to specify the Zone. Puts unsecured wireless networks into the Internet Zone automatically, which prevents unauthorized access to your data from others accessing the network. Ask which Zone to place new networks in upon detection Automatically put new unprotected wireless networks (WEP or WPA} in the Internet Zone 4. Click OK. For more information about networking, see Chapter 3,“Networking with ZoneAlarm security software,” starting on page 31. Setting wireless network security options Automatic wireless network detection helps you configure your Internet Zone to ensure that you computer remains secure without being interrupted each time a new wireless network is detected. ZoneAlarm security software detects only wireless networks that your computer is connected to. (Networks that you are not actually connected to may appear as available networks in your network neighborhood but the New Wireless Network Configuration Wizard only appears when you connect establish a connection to that network.) You can have ZoneAlarm security software silently include every detected wireless network in the Internet Zone. User Guide for ZoneAlarm security software 46
Slide 65: Chapter 4: Firewall protection Setting wireless network security options To specify Network settings: 1. Select Firewall|Main. 2. Click Advanced. 3. In the Wireless Network settings area, choose your security settings. Automatically put new unprotected wireless networks (WEP or WPA) in the Internet Zone ZoneAlarm security software places new wireless networks in the Internet Zone when they are detected. 4. Click OK. For more information about networking, see Chapter 3,“Networking with ZoneAlarm security software,” starting on page 31. User Guide for ZoneAlarm security software 47
Slide 66: Chapter 4: Firewall protection Managing traffic sources Managing traffic sources The Zones tab contains the traffic sources (computers, networks, or sites) you have added to the Trusted Zone or Blocked Zone. It also contains any networks that ZoneAlarm security software has detected. If you are using a single, non-networked PC, the traffic source list displays only your ISP’s (Internet Service Provider’s) network, which should be in the Internet Zone. Viewing the traffic source list The traffic source list displays the traffic sources and the Zones they belong to. You can sort the list by any field by clicking the column header. The arrow ( ^ ) next to the header name indicates the sort order. Click the same header again to reverse the sort order. Field Name IP Address/Site Entry Type Zone Description The name you assigned to this computer, site, or network The IP address or host name of the traffic source The type of traffic source: Network, Host, IP, Site, or Subnet The Zone the traffic source is assigned to: Internet, Trusted, or Blocked Table 4-1: Traffic source list fields Modifying traffic sources From the traffic source list, you can move the traffic source from one Zone to another, add, edit, or remove a traffic source. To change the Zone of a traffic source: 1. Select Firewall|Zones. 2. Locate the traffic source, then click in the Zone column. 3. Select a Zone from the shortcut menu, then click Apply. To add, remove, or edit a traffic source: 1. Select Firewall|Zones. 2. In the Name column, click the traffic source, then click Add, Edit, or Remove. 3. Click Apply. User Guide for ZoneAlarm security software 48
Slide 67: Chapter 4: Firewall protection Adding to the Trusted Zone Adding to the Trusted Zone The Trusted Zone contains computers you trust want to share resources with. For example, if you have three home PCs that are linked together in an Ethernet network, you can put each individual computer or the entire network adapter subnet in the Trusted Zone. The Trusted Zone’s default medium security settings enable you to safely share files, printers, and other resources over the home network. Hackers are confined to the Internet Zone, where high security settings keep you safe. To add a single IP address: 1. Select Firewall|Zones. 2. Click Add, then select IP address from the shortcut menu. The Add IP Address dialog appears. 3. Select Trusted from the Zone drop-down list. 4. Type the IP address and a description in the boxes provided, then click OK. To add an IP range: 1. Select Firewall|Zones. 2. Click Add, then select IP address from the shortcut menu. The Add IP Range dialog appears. 3. Select Trusted from the Zone drop-down list. 4. Type the beginning IP address in the first field, and the ending IP address in the second field. 5. Type a description in the field provided, then click OK. To add a subnet: 1. Select Firewall|Zones. 2. Click Add, then select Subnet from the shortcut menu. The Add Subnet dialog appears. 3. Select Trusted from the Zone drop-down list. 4. Type the IP address in the first field, and the Subnet mask in the second field. 5. Type a description in the field provided, then click OK. To add to a Host or Site to the trusted Zone: 1. Select Firewall|Zones. 2. Click Add, then select Host/Site. The Add Host/Site dialog appears. User Guide for ZoneAlarm security software 49
Slide 68: Chapter 4: Firewall protection Adding to the Blocked Zone 3. Select Trusted from the Zones drop-down list. 4. Type the fully qualified host name in the Host name field. 5. Type a description of the host/site, then click OK. To add a network to the Trusted Zone: 1. Select Firewall|Zones. 2. In the Zone column, click the row containing the network, then select Trusted from the shortcut menu. 3. Click Apply. ZoneAlarm security software automatically detects new network connections and helps you add them to the right Zone. For more information, see Chapter 3,“Networking with ZoneAlarm security software,” starting on page 31. Adding to the Blocked Zone To add to the Blocked Zone, follow the instructions for adding to the Trusted Zone, but select Blocked from the drop-down list in step 2. Viewing logged Firewall events By default, all Firewall events are recorded in the Log Viewer. To view logged firewall events: 1. Select Alerts & Logs|Log Viewer. 2. Select Firewall, from the Alert Type drop-down list. Table 5-2 provides an explanation the log viewer fields available for Firewall events. Field Rating Information Each alert is high-rated or medium-rated. High-rated alerts are those likely to have been caused by hacker activity. Mediumrated alerts are likely to have been caused by unwanted but harmless network traffic. The date and time the alert occurred. The type of alert: Firewall, Program, ID Lock, or Lock Enabled. The communications protocol used by the traffic that caused the alert. Date/Time Type Protocol Table 4-2: Firewall event log fields User Guide for ZoneAlarm security software 50
Slide 69: Chapter 4: Firewall protection Viewing logged Firewall events Field Program Information The name of the program attempting to send or receive data. (Applies only to Program and ID Lock alerts). The IP address of the computer that sent the traffic that ZoneAlarm security software blocked. The address of the computer the blocked traffic was sent to. The direction of the blocked traffic. “Incoming” means the traffic was sent to your computer. “Outgoing” means the traffic was sent from your computer. How the traffic was handled by ZoneAlarm security software. The number of times an alert of the same type, with the same source, destination, and protocol, occurred during a single session. The domain name of the sender of the traffic that caused the alert. The domain name of the intended addressee of the traffic that caused the alert. Source IP Destination IP Direction Action Taken Count Source DNS Destination DNS Table 4-2: Firewall event log fields User Guide for ZoneAlarm security software 51
Slide 70: Chapter 4: Firewall protection Blocking and unblocking ports Blocking and unblocking ports ZoneAlarm security software’s default security levels determine which ports and protocols are allowed and which are blocked. If you are an advanced user, you can change the definition of the security levels by changing port permissions and adding custom ports. Default port permission settings The default configuration for High security blocks all inbound and outbound traffic through ports not being used by programs you have given access or server permission except: DHCP broadcast/multicast Outgoing DHCP (port 67) - on Windows 9x systems Outgoing DNS (port 53) - If the computer is configured as an ICS gateway Traffic Type DNS outgoing DHCP outgoing broadcast/multicast Security levels HIGH block block allow MED n/a n/a allow OFF allow allow allow ICMP incoming (ping echo) incoming (other) outgoing (ping echo) outgoing (other) block block block block allow allow allow allow allow allow allow allow IGMP incoming outgoing block block allow allow allow allow NetBIOS incoming outgoing n/a n/a block allow allow allow UDP (ports not in use by a permitted program) incoming outgoing block block allow allow allow allow TCP (ports not in use by a permitted program) Table 4-3: Default access permissions for incoming and outgoing traffic types 52 User Guide for ZoneAlarm security software
Slide 71: Chapter 4: Firewall protection Adding custom ports Traffic Type incoming outgoing Security levels HIGH block block MED allow allow OFF allow allow Table 4-3: Default access permissions for incoming and outgoing traffic types To change a port’s access permission: 1. Select Firewall|Main. 2. In either the Internet Zone Security or the Trusted Zone Security area, click Custom. The Custom Firewall Settings dialog appears. 3. Scroll to locate High and Medium security settings. 4. To block or to allow a specific port or protocol, click the check box beside it. Be aware that when you select a traffic type in the High security settings list, you are choosing to ALLOW that traffic type to enter your computer under High security, thus decreasing the protection of the High security level. Conversely, when you select a traffic type in the Medium security settings list, you are choosing to BLOCK that traffic type under Medium security, thus increasing the protection of the Med security level. 5. Click Apply, then click OK. Adding custom ports You can allow communication through additional ports at High security, or block additional ports at Medium security by specifying individual port numbers or port ranges. To specify additional ports: 1. Select Firewall|Main. User Guide for ZoneAlarm security software 53
Slide 72: Chapter 4: Firewall protection Adding custom ports 2. In either the Trusted Zone or Internet Zone area, click Custom. The Custom Firewall settings dialog appears. Select one of these options, then specify the port number in the field that appears. 3. Scroll to the security level (High or Medium) to which you want to add ports. 4. Select the desired port type: incoming UDP, outgoing UDP, incoming TCP, or outgoing TCP. 5. Type the port or port ranges you want to allow or block in the Ports field, separated by commas. For example, 139, 200-300 6. Click Apply, then click OK. User Guide for ZoneAlarm security software 54
Slide 73: Chapter 4: Firewall protection Understanding expert firewall rules Understanding expert firewall rules Expert firewall rules are intended for users experienced with firewall security and networking protocols. Expert rules do not take the place of other rules. They are an integral part of the multiple layer security approach and work in addition to other firewall rules. Expert rules use four attributes to filter packets: Source and/or destination IP address Source and/or destination port number Network protocol/message type Day and Time Source and destination addresses can be specified in a number of formats, including a single IP network address, a range of IP addresses, a subnet description, a gateway address, or a domain name. Source and destination ports are used only for network protocols that use ports, such as UDP and TCP/IP. ICMP and IGMP messages, for example, do not use the port information. Network protocols can be selected from a list of common IP or VPN protocols, or specified as an IP protocol number. For ICMP, the message type can also be specified. Day and Time ranges can be applied to a rule to restrict access based on the day of the week and the time of day. How expert firewall rules are enforced It is important to understand how expert rules are enforced in combination with Zone rules, program permissions, and other expert rules. Expert rules and Zone rules Expert firewall rules are enforced before Zone firewall rules. That is, if a packet matches an expert rule, that rule is enforced, and ZoneAlarm security software skips evaluation of Zone rules. Example: Imagine you have your Trusted Zone security level set to Medium. This allows outgoing NetBIOS traffic. However, you have also created an expert rule that blocks all NetBIOS traffic between the hours of 5PM and 7AM. Any outbound NetBIOS traffic during those hours will be blocked, in spite of the Trusted Zone setting. Expert firewall rules and program permissions Expert rules and Zone rules together are enforced in tandem with Program permissions. That is, if either your program permissions or Zone rules/expert firewall User Guide for ZoneAlarm security software 55
Slide 74: Chapter 4: Firewall protection Expert firewall rule enforcement rank rules determine that traffic should be blocked, it is blocked. Note that this means that you can use firewall rules to override or redefine program permissions. Note that packets coming from the Blocked Zone will not be blocked if they are allowed by an Expert Firewall Rule. Expert firewall rule enforcement rank Within the realm of firewall rules, rule evaluation order becomes a factor. ZoneAlarm security software first checks expert firewall rules. If a match is found and a rule is enforced, the communication is marked as either blocked or allowed, and ZoneAlarm security software skips evaluation of Zone rules. If no expert firewall rule is matched, ZoneAlarm security software checks Zone rules to see if the communication should be blocked. The enforcement rank of expert firewall rules is also important. Each rule has a unique rank number, and rules are evaluated in order of rank. Only the first rule that matches is executed. Consider these two rules: Figure 4-4: Expert firewall rule rank order Rule 1 allows FTP clients in the Trusted Zone to connect to an FTP server on port 21. Rule 2 blocks all FTP clients from connecting on port 21, regardless of Zone. These two rules together allow clients in the Trusted Zone to use an FTP server on the client computer, but block all other FTP access. If the order of the rules were reversed, Rule 2 would match first, and all FTP access would be blocked. Rule 1 would never have a chance to execute, so the FTP clients in the Trusted Zone would still be blocked. User Guide for ZoneAlarm security software 56
Slide 75: Chapter 4: Firewall protection Creating expert firewall rules Creating expert firewall rules Creating expert firewall rules involves specifying the source or destination of the network traffic to which the rule applies, setting tracking options, and specifying the action of the rule: whether to block or to allow traffic that meets the specifications of the rule. You can create new rules from scratch, or you can copy an existing rule and modify its properties. To create a new expert firewall rule: 1. Select Firewall|Expert, then click Add. The Add rule dialog appears. 2. In the General area, specify the rule settings. Rank Name State Action Track Comments The order in which rules will be enforced. A rule with a rank of 1 is enforced first. Provide a descriptive name for the rule. Specify whether the rule is enabled or disabled. Indicates whether to block or allow traffic that matches this rule. Indicates whether to log, alert and log, or do nothing when the expert rule is enforced. Optional field for entering notes about the expert rule. 3. In the Source area, select a location from the list, or click Modify, then select Add location from the shortcut menu. You can add any number of sources to a rule. My Computer Trusted Zone Internet Zone All Host/Site IP Address IP Range Subnet Gateway New Group Applies the expert rule to traffic originating on your computer. Applies the expert rule to network traffic from sources in your Trusted Zone. Applies the expert rule to network traffic from sources in your Internet Zone. Applies the expert rule to network traffic coming from any source. Applies the expert rule to network traffic coming from specified domain name. Applies the expert rule to network traffic coming from specified IP address. Applies the expert rule to network traffic coming from a computer within the specified IP range. Applies the expert rule to network traffic coming from a computer within the specified subnet. Applies the expert rule to network traffic coming from a computer on the specified gateway. Choose this option, then click Add to create a new location group to apply to the expert rule. 57 User Guide for ZoneAlarm security software
Slide 76: Chapter 4: Firewall protection Creating expert firewall rules Existing Group Choose this option to select one or more location groups to apply to the expert rule, then click OK. 4. In the Destination area, select a location from the list, or click Modify, then select Add location from the shortcut menu. Available location types are the same for Source and Destination locations. 5. In the Protocol area, select a protocol from the list, or click Modify, then select Add Protocol. Add Protocol New Group Choose this option to add a protocol to the rule. Specify: TCP, UDP, TCP + UDP, ICMP, IGMP, or Custom. Choose this option, then click apply to the expert rule. Add to create a new protocol group to Existing Group Choose this option to select one or more protocol groups to apply to the expert rule, then click OK. 6. In the Time area, select a time from the list, or click Modify, then select Add Time. Day/Time Range New Group Choose this option to add a day/time range to the rule. Specify a description, time range and one or more days. Time range is specified using a 24 hour clock. Choose this option, then click apply to the expert rule. Add to create a new day/time group to Existing Group Choose this option to select one or more day/time groups to apply to the expert rule, then click OK. 7. Click OK. To create a new rule from an existing rule: 1. Select Firewall|Expert. 2. Select the expert firewall rule you want to duplicate, then either press Ctrl+C or right-click the rule and choose Copy. 3. Paste the copied rule either by pressing Ctrl+V, or by right-clicking and choosing Paste. If a rule is currently selected in the list, the pasted rule will be inserted above the selected rule. If no rule is selected, the pasted rule will be inserted at the top of the rules list. A “1” is appended to the name of the copied rule. If you paste a rule a second time, the number 2 is appended to the second rule copied. 4. Click Apply to save your changes. 5. Right-click the new rule and choose Edit to modify the rule properties as necessary. User Guide for ZoneAlarm security software 58
Slide 77: Chapter 4: Firewall protection Creating groups Creating groups Use groups to simplify the management of locations, protocols, and days/times that you use in your expert firewall rules. Creating a location group Use location groups to combine non-contiguous IP addresses and ranges, or different types of locations (for example, subnets and hosts), into an easily manageable set. You can then easily add that set of locations to any expert firewall rule. To create a location group: 1. Select Firewall|Expert, then click Groups. The Group Manager dialog appears. 2. Select the Locations tab, then click Add. The Add Location Group dialog appears. 3. Specify the name and description of the location group, then click Add and select a Location type from the menu. Host/Site A description and host name of the Host/Site location, then click OK. Do not include http:// in the host name. Click Lookup to preview the site’s IP address. A description and IP address of the IP Address location, then click IP Address IP Range Subnet Gateway OK. A description and beginning IP address and ending IP address of the IP Range location, then click OK. Specify a description, IP address, and Subnet Mask of the Subnet location, then click OK. Specify an IP address, MAC Address, and description of the Gateway location, then click OK. 4. Click OK to close the Group Manager dialog box. Once created, the names of groups cannot be changed. For example, if you create a Location Group named “Home” and subsequently decide to call the group “Work”, you would need to remove the group called “Home” and create a new group with the name “Work.” Creating a protocol group Create a protocol group to combine well-known TCP/UDP ports, protocols, and protocol-specific message types (for example, ICMP message types), into sets that you User Guide for ZoneAlarm security software 59
Slide 78: Chapter 4: Firewall protection Creating a protocol group can easily add to expert rules. For example, you might create a group including POP3 and IMAP4 protocols in order to simplify the administration of your rules regarding email traffic. To create a Protocol group: 1. Select Firewall|Expert, then click Groups. The Group Manager dialog appears. 2. Select the Protocols tab, then click Add. The Add Protocol Group dialog appears. 3. Specify the name and description of the Protocols group, then click Add. The Add Protocol dialog appears. 4. Select a protocol type from the Protocol drop-down list. TCP UDP TCP + UDP ICMP IGMP Custom 5. If you chose TCP, UDP, or TCP/UDP, in step 4, specify a destination, source and port number. Name FTP Telnet POP3 NNTP NetBIOS Name NetBIOS Datagram NetBIOS Session IMAP4 HTTPS RTSP Windows Media AOL Real Networks Port number 21 23 110 119 137 138 139 143 443 554 1755 5190 7070 User Guide for ZoneAlarm security software 60
Slide 79: Chapter 4: Firewall protection Creating a protocol group Other FTP Data TFTP HTTP DHCP DHCP Client SMTP DNS Specify port number 20 69 80 67 68 25 53 6. If you chose ICMP in step 4, specify a description, message name, and type number. Message name Source Quench Redirect Alt Echo Request Router Advertisement Router Solicitation Time Exceeded Parameter Problem Timestamp Timestamp reply Information request Information reply Address Mask Request Address Mask Reply Traceroute Other Type number 4 5 6 8 9 10 11 12 13 14 15 16 17 18 30 Specify type number 7. If you chose IGMP in step 4, specify a description, message name, and type number. Membership Query Membership Report (ver 1) Cisco Trace Membership Report (ver 2) Leave Group (ver 2) Multicast Traceroute Response 17 18 21 22 23 30 User Guide for ZoneAlarm security software 61
Slide 80: Chapter 4: Firewall protection Creating a day/time group Multicast Traceroute Membership Report (ver 3) Other 31 34 Specify type number. 8. If you chose Custom in step 4, specify a description, protocol type, and protocol number. RDP GRE ESP AH SKIP Other 27 47 50 51 57 Specify protocol number. 9. Click OK, to close the Add Protocol dialog. Creating a day/time group To allow or block network traffic to or from your computer during specified periods of time, you can create a day/time group and then add it to an expert rule. For example, to block traffic coming from pop-up ad servers during business hours, you could create a group that blocks HTTP traffic coming from a specified domain during the hours of 9 AM and 5 PM, Monday through Friday. To create a Day/Time group: 1. Select Firewall|Expert, then click Groups. The Group Manager dialog appears. 2. Select the Times tab, then click Add. The Add Time Group dialog appears. 3. Specify the name and description of the Time group, then click Add. The Add Time dialog appears. 4. Specify a description of the time, then select a time and day range. 5. Click OK, then click OK to close the Group Manager. User Guide for ZoneAlarm security software 62
Slide 81: Chapter 4: Firewall protection Managing Expert Firewall Rules Managing Expert Firewall Rules From the Expert tab of the Firewall panel, you can view the status of existing expert rules, enable or disable rules, edit or remove rules, add new rules, change the order of rules, and create groups. Viewing the Expert Rules list The Expert Rules tab presents a list of all expert firewall rules. Rules are listed in order of enforcement priority (rank). The arrow buttons on the right-hand side more selected rules up and down the list, changing the enforcement order of the selected rules. You also can change rank order of rules by dragging and dropping rules from one position to another. For example, dragging and dropping rule 2 to the top of the list changes the rank of that rule to 1. Rank Tracking Use controls to change rule rank Click to add location, protocol, or Figure 4-5: Expert Rules list Rank The enforcement priority of the rule. Rules are evaluated in order of rank, starting with number 1, and the first rule that matches will be enforced. Disabled rules will display “Off ” instead of a rank number, but will retain their rank ordering in the list. Action A red means the rule will block network traffic; a green check mark rule will allow network traffic. means the User Guide for ZoneAlarm security software 63
Slide 82: Chapter 4: Firewall protection Editing and re-ranking rules Track None means no notification when the rule is applied. Log ( ) means a log entry will be created when the rule is applied. Alert and Log ( ) means that an alert will be displayed and a log entry will be created when an expert rule is applied. Name A descriptive name for the rule. Source The source addresses and ports for the rule. Destination The destination addresses and ports for the rule. Protocol The network protocol to which the rule applies. Time The time period during which the rule is active. Editing and re-ranking rules You can edit or reorder existing expert rule from the Expert Rules list by selecting rules and dragging them into the desired rank. Note that if you have copied an expert rule into the rules for a Program, changing the expert rule does not automatically change the Program rule. For more information, see “Creating expert rules for programs,” on page 91. To edit a rule: 1. Select Firewall|Expert. 2. Select the rule you want to edit, then click Edit. The Edit Rule dialog appears. 3. Modify rule attributes as necessary, then click OK. To change the rank of a rule: 1. Select Firewall|Expert. 2. Right-click the rule you want to move, then select Move Rule. Move to Top Move to Bottom Move Up Move Down Moves the selected rule to the top of the Rules list. Moves the selected rule to the bottom of the Rules list. Moves the selected rule one row up in the Rules list. Moves the selected rule one row down in the Rules list. User Guide for ZoneAlarm security software 64
Slide 83: Firewall protection Editing and re-ranking rules User Guide for ZoneAlarm security software 65
Slide 84: Firewall protection Editing and re-ranking rules User Guide for ZoneAlarm security software 66
Slide 85: Chapter Program control Program Control protects you by making sure that only programs you trust can access the Internet or perform certain actions on your computer. You can assign program permissions manually or let ZoneAlarm security software assign permissions when program advice is available. Advanced users can control the ports that each program is permitted to use. ZoneAlarm Security Suite includes the added protection of the Triple Defense Firewall, which prevents even trusted programs from carrying out potentially malicious behavior. Topics: “Understanding Program Control,” on page 68 “Setting general program control options,” on page 71 “Configuring advanced program settings,” on page 78 “Setting permissions for specific programs,” on page 80 “Managing program components,” on page 89 “Creating expert rules for programs,” on page 91 5 67
Slide 86: Chapter 5: Program control Understanding Program Control Understanding Program Control Everything you do on the Internet—from browsing Web pages to downloading MP3 files—is managed by specific programs on your computer. Hackers exploit this fact by planting “malware”—literally, malicious software—on your computer. Malware can masquerade as harmless e-mail attachments or as updates to legitimate programs. Once on your computer, however, the malware can hijack trusted programs and carry out malicious activities under the guise of legitimacy. ZoneAlarm security software protects your computer from hackers and malicious attacks by assigning policies to programs that indicate their level of trustworthiness, and specify the actions they are allowed to perform. ZoneAlarm Security Suite provides the added feature of OSFirewall protection, which detects when programs try to use your operating system to perform suspicious actions on your computer. Setting program permissions automatically The SmartDefense Advisor and Program Control settings work together to ensure that good programs are given access and that bad programs are denied access. By default, Program Control is set to Medium and SmartDefense Advisor is set to Auto. With these defaults, ZoneAlarm security software assigns permission to programs automatically. For information about customizing Program Control and SmartDefense Advisor, see “Setting general program control options,” on page 71. If SmartDefense Advisor and Program Control are set to their defaults, one of three things may occur when a program requests access for the first time: Access is granted - Access is granted if the program is known to be safe and requires the permissions it is asking for in order to function properly. Access is denied - Access is denied if the program is a known bad program or if the program does not require the permissions it is asking for. A New Program alert appears - Program alerts appear when you need to decide whether to allow or deny access to a program. The alert may contain a recommendation about whether to allow or deny access, and, if neccessary, you can click More info to get details about the program to help you respond. As long as SmartDefense Advisor is set to Auto, Zone Labs security software issues Program alerts only if no automatic setting is available. If you choose Remember this setting in a Program alert when allowing or denying program access, Zone Labs security software keeps your setting unless SmartDefense Advisor comes out with a different setting, or until you change the setting manually in the Programs tab. If you do not choose Remember this setting, Zone Labs security software will issue another Program alert the next time the program attempts the same action. For more information about Program alerts, see “Program alerts,” on page 225 User Guide for ZoneAlarm security software 68
Slide 87: Chapter 5: Program control Setting program permissions manually Safe programs ZoneAlarm security software validates your programs against a database of known safe programs and automatically assigns the permissions required for the programs to function properly. If you accepted the default program settings in the Configuration Wizard, ZoneAlarm security software is set up to automatically configure the most popular programs in the following general categories: Browsers (e.g., Internet Explorer, Netscape) E-mail applications (e.g., Microsoft Outlook, Eudora) Instant Messengers (e.g., AOL, Yahoo!) Anti-virus (e.g., Symantec, ZoneAlarm) Document utilities (e.g., WinZip® and Adobe® Acrobat®) ZoneAlarm software applications Even programs that are considered safe can be used by hackers to perform actions that are not. OSFirewall protection, available in ZoneAlarm Security Suite, displays alerts when it detects suspicious program behavior. For more information about these alerts, see “Program alerts,” on page 225. Setting program permissions manually If you want to assign permissions to programs on your own, or if ZoneAlarm security software was unable to assign permissions automatically, you can set permissions manually by using Program alerts, or by setting permissions for specific programs on the Programs tab of the Program panel. Program alerts When a program requests access for the first time, a New Program alert asks you if you want to grant the program access permission. When a program is detected to be listening to the ports on your computer, a Server Program alert is displayed. Suspicious behavior alerts inform you that a trusted or unknown program on your computer is trying to perform an action that could be considered suspicious. For a list of actions that are considered suspicious, see “Program behavior,” on page 267. To avoid seeing numerous alerts for the same program, select Remember this setting before clicking Allow or Deny. ZoneAlarm security software will continue to apply your Allow or Deny setting (without issuing alerts) unless you set SmartDefense Advisor to Auto and it has a setting different from yours. Because Trojan horses and other types of malware often need server rights in order to do mischief, you should be particularly careful to give server permission only to programs that you know and trust, and that need server permission to operate properly. Several common types of applications, such as chat programs, e-mail clients, and Internet Call Waiting programs, may need server permission to operate properly. Grant User Guide for ZoneAlarm security software 69
Slide 88: Chapter 5: Program control Setting program permissions manually server permission only to programs you're sure you trust, and that require it in order to work. If possible, avoid granting a program server permission for the Internet Zone. If you need to accept incoming connections from only a small number of machines, add those machines to the Trusted Zone, and then allow the program server permission for the Trusted Zone only. For more information about program alerts, see “Program alerts,” on page 225. You also can allow ZoneAlarm security software to automatically allow or deny all new programs without displaying an alert. For example, if you are sure you have given access permission to all the programs you want, you might automatically deny access to any other program that asks for permission. For more information, see “Setting access permissions for new programs,” on page 78. Programs list The Programs list allows you to set or customize permissions for specific programs based on your individual needs. For more information about using the Programs list and customizing permissions, see “Using the programs list,” on page 80. User Guide for ZoneAlarm security software 70
Slide 89: Chapter 5: Program control Setting general program control options Setting general program control options When you’re using ZoneAlarm security software, no program on your computer can access the Internet or your local network, or act as a server, unless it has permission to do so. Setting the program control level ZoneAlarm security software offers several methods of program control. Basic program control lets you determine access and server rights for individual programs. Advanced Program Control prevents malware from misusing trusted programs. Application Interaction Control alerts you if a process tries to use another process or a program tries to start another program. OSFirewall protection detects when programs try to use your operating system to perform suspicious actions on your computer. (This section explains how to set a general program control level, and how to customize settings for Advanced Application Control and Application Interaction Control. For details on OSFirewall, see “Configuring OSFirewall protection,” on page 72.) To limit the number of alerts you see, you can use the following features: If you use ZoneAlarm security software with Anti-virus, use the Auto-Learn program control level. Auto-Learn provides a moderate amount of protection during the first 7-21 days of using ZoneAlarm security software. Once ZoneAlarm security software learns your computer, it resets the program control level to Max. To benefit from ZoneAlarm’ recommended program settings, use SmartDefense Advisor in conjunction with program control. For details on SmartDefense Advisor, see “Setting the SmartDefense Advisor level,” on page 74. To set the program control level: 1. Select Program Control|Main. 2. In the Program Control area, click the slider and drag it to the desired setting. Max (for ver- With this setting, you may see a large number of alerts. sions with Programs must ask for Internet access and server rights. Anti-virus) High (for versions without Antivirus) Auto (for versions with Antivirus) OSFirewall will monitor for suspicious behaviors. Advanced Program control and Application Interaction Control are enabled. By default, component control is disabled.* This mode minimizes the number of alerts. This control level is less secure for the first 7-21 days. Network and OSFirewall will screen some programs. User Guide for ZoneAlarm security software 71
Slide 90: Chapter 5: Program control Configuring OSFirewall protection Medium (for versions without Antivirus) This is the default setting. Programs must ask for Internet access and server rights. OSFirewall will monitor for suspicious behaviors. By default, component control is disabled.* Min (for versions with Antivirus) Low (for versions without Antivirus) Off OSFirewall is disabled. By default, component control is disabled.* Server control and stealth mode are available OSFirewall is disabled. By default, component control is disabled.* Server control and stealth mode are not available Program control is disabled. No programs or components are authenticated or learned. No program permissions are enforced. All programs are allowed access/server rights. All programs are allowed to perform suspicious behavior. No program alerts are displayed. * Component control is disabled by default. If you have turned component control on, it will remain enabled as long as program control is set to High, Medium, or Low. For information about component control, including directions for turning it on, see “Enabling Component Control,” on page 73. To set custom program control options: 1. Select Program Control|Main. 2. In the Program Control area, click Custom. The Custom Program Control Settings dialog appears. 3. On the Program Control tab, specify the settings to apply. Enable Advanced Program Control Prevents trusted programs from being used by untrusted programs to circumvent outbound protection. Alerts you when a process attempts to use another process or any time a program launches another program. Enable Application Interaction Control 4. Click OK. Configuring OSFirewall protection OSFirewall protection, which is enabled by default, detects when programs try to use your operating system to perform suspicious actions on your computer. You can also User Guide for ZoneAlarm security software 72
Slide 91: Chapter 5: Program control Enabling Component Control configure various OSFirewall Special System Protections, which determine whether programs on your computer can perform specific actions such as modifying your Internet Explorer home page or installing ActiveX controls. To configure OSFirewall settings: 1. Select Program Control|Main. 2. In the Program Control area, click Custom. 3. In the Custom Program Control Settings dialog box that appears, select the OSFirewall tab. 4. Select or deselect Enable OSFirewall, as desired. (Note that, to configure any OSFirewall Special System Protections in the next step, you must first enable OSFirewall.) 5. Optionally, configure any OSFirewall Special System Protections. For any action in the list, click the State field and select Allow, Deny, Ask, or Use Program Setting. If you choose Use Program Setting, Zone Labs security software defers to SmartDefense Advisor settings or to your manual settings. 6. Click Apply to save the setting and leave the dialog open, or OK to save the setting and close the dialog. Enabling Component Control In addition to controlling permissions for all programs on a computer, advanced users may also want to monitor and, if desired, restrict individual components that these programs load (such as DLL files or ActiveX controls). ZoneAlarm security software keeps a list of components (used by allowed programs) that have tried to access the Internet or the local network. Depending on your program control and component control settings, ZoneAlarm security software can simply monitor components or it can alert you each time a new component attempts access. This section explains how to enable component control. For details about viewing the Components List and modifying component permissions manually, see “Managing program components,” on page 89. By default, component control is turned off, though ZoneAlarm security software does add components to the Components List. If you enable component control and set program control to Medium, component control tracks components but does not restrict their activity. If you then reset program control to High, component control grants access to all previously known components but prompts you to allow or deny any components discovered subsequently. For advanced users concerned about component activity, the best practice is to install ZoneAlarm security software on a freshly set up computer, enable component control and set the program control level to Medium, and, after ZoneAlarm security software has had a chance to detect all normal components that require access, reset program control to High. (For information about the program control setting, see “Setting the program control level,” on page 71.) User Guide for ZoneAlarm security software 73
Slide 92: Chapter 5: Program control Setting the SmartDefense Advisor level To enable component control: 1. Select Program Control|Main. 2. In the Program Control area, click Custom. The Custom Program Control Settings dialog appears. 3. On the Program Control tab, select Enable component control. 4. Click OK. Setting the SmartDefense Advisor level Whenever you use a program that requests access, SmartDefense Advisor queries the ZoneAlarm server to determine the policy for that program. You can choose to have SmartDefense Advisor set the permissions for the program automatically, or you can configure program access manually. The SmartDefense Advisor level is set to Auto by default. If you set SmartDefense Advisor to Auto and there is no advice available for a program, ZoneAlarm security software displays a Program alert prompting you to allow or deny access to the program. If you select Remember this setting when responding to such a Program alert, Zone Labs security software keeps your setting unless SmartDefense Advisor comes out with a different setting, or until you change the setting manually in the Programs tab. For information about setting program permissions manually, see “Setting permissions for specific programs,” on page 80. You can set SmartDefense Advisor to Manual or Off and set all program permissions manually. Or, you can set SmartDefense Advisor to Auto and set manual program permissions only when SmartDefense Advisor does not recommend a policy. To set the SmartDefense Advisor level 1. Select Program Control|Main. 2. In the SmartDefense Advisor area, choose your setting. Auto In Auto mode, SmartDefense Advisor automatically implements the recommendation returned from the server. Program Control must be set to Medium or High to set SmartDefense Advisor to Auto. In Manual mode, you will receive Program alerts when programs request access and can set the permission on your own. SmartDefense Advisor will not contact the server for program advice. Manual Off User Guide for ZoneAlarm security software 74
Slide 93: Chapter 5: Program control Enabling the automatic lock Enabling the automatic lock The automatic Internet lock protects your computer if you leave it connected to the Internet for long periods even when you’re not actively using network or Internet resources. When the lock engages, only traffic initiated by programs to which you have given passlock permission is allowed. All traffic to and from your computer is stopped, including DHCP messages, or ISP heartbeats, used to maintain your Internet connection. As a result, you may lose your Internet connection. You can set the Internet lock to engage: When your screen saver engages, or After a specified number of minutes of network inactivity. To enable or disable the automatic lock: 1. Select Program Control | Main. 2. In the Automatic Lock area, select On or Off. To set automatic lock options: 1. Select Program Control | Main. 2. In the Automatic Lock area, click Custom. The Custom Lock Settings dialog appears. 3. Specify the lock mode to use. Lock after n minutes of inactivity Engages automatic lock after the specified number of minutes has passed. Specify a value between 1 and 99. Engages automatic lock whenever your screensaver is activated. Lock when screensaver activates 4. If desired, specify Internet access permissions for periods when the lock is engaged. Allow pass-lock programs to access the Internet Allows programs with pass-lock permission to access the Internet. Programs without pass-lock permission have no access. This is the default behavior when the lock is engaged. Prevents all programs, regardless of pass-lock status, from accessing the Internet when the lock is engaged. Block all Internet access 5. Click OK. User Guide for ZoneAlarm security software 75
Slide 94: Chapter 5: Program control Viewing logged program events Viewing logged program events By default, all Program events are recorded in the Log Viewer. To view logged program events: 1. Select Alerts & Logs|Log Viewer. 2. Select Program, from the Alert Type drop-down list. Table 5-1 provides an explanation of the log viewer fields available for Program events. Field Rating Date/Time Type Explanation Event rating based on the Protection Level of the security option. Date and time the event occurred. Type of program alert that occurred. Possible values for this column include: • Program Access • Repeat Program • New Program Program The program (displayed as the application file) that requested access. If a program name is unavailable, refer to the Description field of the Entry Details window. The IP address of the computer sending the request. If the source IP cannot be determined, this field may be left blank. The IP address of the computer receiving the request. If the destination IP cannot be determined, this field may be left blank. Specifies whether the request that caused the event was incoming, outgoing, or occurred as a result of internal traffic on your computer (data). Specifies whether the request was Allowed or Blocked. Action is followed by / The number of times this action was taken. The domain name server of the computer that is sending the request. The domain name server of the computer that is receiving the request. Source IP Destination IP Direction Action Taken Count Source DNS Destination DNS Table 5-1: Program event log fields User Guide for ZoneAlarm security software 76
Slide 95: Chapter 5: Program control Viewing logged OSFirewall events Viewing logged OSFirewall events By default, all OSFirewall events are recorded in the Log Viewer. To view logged OSFirewall events: 1. Select Alerts & Logs|Log Viewer. 2. Select OSFirewall, from the Alert Type drop-down list. Table 5-2 provides an explanation of the log viewer fields available for OSFirewall events. Field Rating Date/Time Type Explanation Event rating based on the Protection Level of the security option. Date and time the event occurred. Type of OSFirewall alert that occurred. Possible values for this column include: • Process • Message • Module • Registry • File • Execution • Driver • Physical memory Subtype Data Program Action Taken The specific event that initiated the Type of access requested (for example, OpenThread would be a subtype of Process). The path to the file that was attempting to be modified. Displays the path to the program that performed the behavior. Specifies whether the request was Allowed or Blocked. Action is followed by /manual or /auto to indicate whether the action was performed by you or by SmartDefense Advisor. The number of times this action was taken. Count Table 5-2: OSFirewall event log fields User Guide for ZoneAlarm security software 77
Slide 96: Chapter 5: Program control Configuring advanced program settings Configuring advanced program settings By default, ZoneAlarm security software always asks you whether to block or to allow connection attempts and server access attempts for the Internet and Trusted Zones. In addition, if the TrueVector service is running, but ZoneAlarm security software is not, program access is denied by default. Setting global program properties You can customize program control by specifying whether access is always allowed, always denied, or if you want to be asked, each time a program in either the Internet or Trusted Zone requests access. To set global program properties: 1. Select Program Control|Main. 2. Click Advanced, then select the Alerts & Functionality tab. 3. Specify global program options. Show alert when Internet access is denied Displays a Blocked Program alert when ZoneAlarm security software denies access to a program. To have access denied silently, clear this option. In rare cases, an independent process such as a Trojan horse could shut down the ZoneAlarm security software user interface, but leave the TrueVector service running. This setting prevents the application from hanging if this occurs. Require password to allow a program temporary Internet access Prompts you to enter a password to grant access permission. Requires that you be logged in to respond Yes to a Program alert. To allow access without a password, clear this option. Deny access if permission is set to “ask” and the TrueVector service is running but ZoneAlarm security software is not 4. Click OK. Setting access permissions for new programs ZoneAlarm security software displays a New Program alert when a program on your computer tries to access the Internet or local network resources for the first time. It displays a Server Program alert when a program tries to act as a server for the first time. However, you can configure ZoneAlarm security software to automatically allow or block new programs without displaying an alert. For example, if you are sure you have given access permission to all the programs you want, you might automatically deny access to any program that asks for permission. User Guide for ZoneAlarm security software 78
Slide 97: Chapter 5: Program control Setting access permissions for new programs To set connection attempt permissions for new programs: 1. Select Program Control|Main. 2. Click Advanced. 3. In the Connection Attempts area, specify your preferences for each Zone. Always allow access Always deny access Always ask for permission Allows all new programs access to the specified Zone. Denies programs access to the specified Zone. Displays an alert asking for permission for the program to access the specified Zone. Settings for individual programs can be established in the Programs tab. Settings in this panel apply ONLY to programs not yet listed in the Programs tab. To set server attempt permissions for new programs: 1. Select Program Control|Main. 2. Click Advanced. In the Server Attempts area, specify your preferences for each Zone. Always accept the connection Always deny the connection Always ask before connecting Allows all programs attempting to act as a server. Denies all programs attempting to act as a server. Displays an alert asking for permission for the program to act as a server. User Guide for ZoneAlarm security software 79
Slide 98: Chapter 5: Program control Setting permissions for specific programs Setting permissions for specific programs In some cases, you may want to specify different settings for an individual program than the global program control level will allow. For example, if you wanted to allow access to a particular program, but keep security High for all other programs, you could set the permission for that program to Allow. After you manually set permissions for a program, the permissions for that program will not change even if you later set the SmartDefense Advisor level to Auto. To benefit from automatic program advice, remove the program from the Programs List, then set the SmartDefense Advisor level to Auto. Using the programs list The programs list provides an overview of the programs on your computer that have tried to access the Internet or the local network. For each program, the program list provides detailed information about its current state, trustworthiness, and the functions it is allowed to perform. The programs list is organized in alphabetical order. You can sort the programs in the list by any column by clicking on column header. As you use your computer, ZoneAlarm security software detects every program that requests network access and adds it to the programs list. To access the Programs List, select Program Control|Programs. Selecting a program name in the list displays program information in the yellow Entry Detail area below the list. This area provides details about the program, including its full name, the program’s OSFirewall policy, and the date of the last policy update. The SmartDefense Advisor and Trust Level columns indicate OSFirewall Protection for your computer and specify whether a program is allowed to perform operating system- User Guide for ZoneAlarm security software 80
Slide 99: Chapter 5: Program control Using the programs list level actions like changing TCP/IP parameters, loading or installing drivers, or changing your browser’s default settings. status indicator Figure 5-3: Programs list Active Indicates the current status of a program. A green circle indicates that the program is currently running. Programs The name of the program. SmartDefense Advisor The SmartDefense Advisor column indicates where the program policy comes from. The column may contain any of the following designations: Auto—SmartDefense Advisor determines the program policy, unless a recommendation is not available. (Note that, if SmartDefense Advisor is turned on, and you select Remember this setting when responding to a Program alert, the SmartDefense Advisor column will still say Auto, since the permissions will still change to conform to any SmartDefense Advisor recommendations that come out later.) Custom—You determined the program policy manually. If you change a program’s permissions (by changing a value in any of the columns in the program’s row, for example), the SmartDefense Advisor column displays “Custom” for that program. User Guide for ZoneAlarm security software 81
Slide 100: Chapter 5: Program control Using the programs list System—SmartDefense Advisor determines the program policy, and the program is used by your operating system. Manually changing the policy for “System” programs could interfere with the normal functions of your computer. Trust Level The Trust Level determines the actions that a program is allowed to perform. The Trust Levels are Super, Trusted, Restricted, Ask, Kill, and No Enforcement. A program’s Trust Level setting is determined by its policy. ZoneAlarm security software assigns policies to known programs automatically. The SmartDefense Advisor security team constantly monitors programs for changes in behavior and trustworthiness and updates the programs permissions accordingly. A program with a Trust Level setting of Super today, might have a Trust Level of Restricted tomorrow, if security experts determine that the program could pose a risk to your computer. Once a program’s policy setting has been changed from Auto to Custom, however, it will no longer be monitored for changes in Trust Level. For this reason, it is recommended that you keep the default settings for your programs. Refer to the table below for a description the symbols used in this list. Access The Access column refers to a program’s right to retrieve information from the Internet or networks in the Trusted Zone. Server Allows a program to passively listen for contact from the Internet or network. Few programs require server rights. User Guide for ZoneAlarm security software 82
Slide 101: Chapter 5: Program control Adding a program to the programs list Send Mail Allows a program to send and receive e-mail. Refer to the table below for a description of the symbols used in this list.. Symbol Meaning The program is currently active. The program is allowed access/server rights. When this symbol appears in the Access or Server columns, it means that ZoneAlarm security software will display a Program alert when the program asks for access, server rights. When this symbol appears in the Trust Level column, it means that ZoneAlarm security software will display a Suspicious Behavior alert when a program performs actions considered suspicious. The program is denied access/server rights. Super access. Program can perform suspicious actions without seeking permission. No alerts will be displayed. Trusted access. Trusted Programs can perform suspicious actions without seeking permission, but unknown programs must ask for permission. Restricted access. Program can perform trustedlevel actions but cannot perform suspicious actions. No access. Programs marked with the No access (Kill) symbol cannot run. No enforcement. Program is not monitored at all and can perform any action whatsoever. This setting can pose a security risk. Table 5-3: Program List symbols For more information about what program actions are considered suspicious, see Appendix D,“Program behavior,” starting on page 267. Adding a program to the programs list If you want to specify access or server permission for a program that does not appear on the programs list, you can add the program to the list and then grant the appropriate permissions. User Guide for ZoneAlarm security software 83
Slide 102: Chapter 5: Program control Granting a program permission to access the Internet To add a program to the programs list: 1. Select Program Control|Programs, then click Add. The Add Program dialog appears. 2. Locate the program you want to add, then click Open. Be sure to select the program’s executable file (for example, program.exe). To edit a program on the programs list: 1. Select Program Control|Programs. 2. Right-click a program in the Programs column and choose one of the available options. Changes Frequently If this option is selected, ZoneAlarm security software will use only file path information to authenticate the program. The MD5 signature will not be checked. Caution: This is a Low security setting. Options Properties Remove Opens the Program Options dialog box, in which you can customize security options and create expert rules for programs. Opens your operating system’s properties dialog box for the program. Deletes the program from the list. Granting a program permission to access the Internet Many of your most commonly used programs can be automatically configured for safe Internet access. To determine whether a program was configured manually or automatically, select the program in the Programs List and refer to the Policy field in the Entry Details area. To grant a program permission to access the Internet: 1. Select Program Control|Programs. 2. In the Programs column, click the program for which you want to grant access, then select Allow from the shortcut menu. For information about granting programs permission by responding to an alert, see “New Program alert,” on page 226. Built-in rules ensure a consistent security policy for each program. Programs with access to the Internet Zone also have access to the Trusted Zone, and programs with server permission in a Zone also have access permission for that Zone. This is why (for example) selecting Allow under Trusted Zone/Server automatically sets all of the program’s other permissions to Allow. User Guide for ZoneAlarm security software 84
Slide 103: Chapter 5: Program control Granting a program permission to act as a server Granting a program permission to act as a server Exercise caution when granting permission for programs to act as a server, as Trojan horses and other types of malware often need server rights in order to do mischief. Permission to act as a server should be reserved for programs you know and trust, and that need server permission to operate properly. To grant a program permission to act as a server: 1. Select Program Control|Programs. 2. In the Programs column, click the program for which you want to grant server access, then select Allow from the shortcut menu. Granting send mail permission to a program To enable your e-mail program to send e-mail messages and to enable protection against e-mail threats, grant send mail permission to your e-mail program. For more information about protecting your e-mail, see Chapter 7, “E-mail protection,” starting on page 123. To grant send mail permission to a program: 1. Select Program Control|Programs. 2. Select a program from the list, then click in the Send Mail column. 3. Select Allow from the shortcut menu. You also can access the Program Options dialog by right-clicking a program name and selecting Options. User Guide for ZoneAlarm security software 85
Slide 104: Chapter 5: Program control Setting program options for a specific program Setting program options for a specific program How a program is authenticated, whether it uses Outbound MailSafe protection, or is held to privacy standards, is determined globally by setting the Program Control level. You can modify these and other settings on a per-program basis from the Programs List. Setting Advanced Program Control options Advanced Program Control tightens your security by preventing unknown programs from using trusted programs to access the Internet, or preventing hackers from using the Windows CreateProcess and OpenProcess functions to manipulate your computer. To enable Advanced Program Control for a program: 1. Select Program Control|Programs. 2. In the Programs column, select a program, then click Options. The Program Options dialog appears. 3. Select the Security tab, then choose your Advanced Program Control options. This program may use other pro- Allows the selected program to use other programs to access the Internet grams to access the Internet. Allow Application Interaction Allows the selected program to use OpenProcess and CreateProcess functions on your computer. 4. Click OK. Disabling Outbound Mail protection for a program By default, Outbound Mail protection is enabled for all programs. Because the ability to send e-mail is not a characteristic of all programs, you may choose to disable Outbound Mail protection for any program that does not require it. To disable Outbound Mail protection for a program: 1. Select Program Control|Programs. 2. Select a program from the list, then click Options. The Program Options dialog appears. 3. Select the Security tab. User Guide for ZoneAlarm security software 86
Slide 105: Chapter 5: Program control Setting Filter options for a program 4. Clear the check box labeled Enable Outbound MailSafe Protection for this program. This check box will not appear unless the SendMail permission for this program is set to Allow. 5. Click Apply to save your changes, then click OK. For more information about Outbound MailSafe Protection, see “Outbound MailSafe protection,” on page 125. Setting Filter options for a program When Parental Control and Privacy features are enabled globally, individual programs like Word Processing programs can still access restricted content unless filter options have also been enabled for that program. For example, although Parental Control blocks access to the site “http://www.playboy.com” from your browser, the site could still be accessed by clicking a URL within a Microsoft Word document unless Parental Control was also enabled for that program. To enable filter options for a program: 1. Select Program Control|Programs. 2. Select a program from the list, then click Options. The Program Options dialog appears. 3. Select the Security tab. 4. Under Filter Options, select the check box beside the protection you want, then click OK. For more information about Privacy protection, see Chapter 8, “Privacy protection,” starting on page 143. For more information about Parental Control, see Chapter 11, “Parental Control,” starting on page 197. Setting authentication options You can specify whether a program is authenticated by using its full pathname or by its components. By default, all programs are authenticated by their components. To specify an authentication method: 1. Select Program Control|Programs. 2. Select a program from the list, then click Options. The Program Options dialog appears. 3. Select the Security tab. User Guide for ZoneAlarm security software 87
Slide 106: Chapter 5: Program control Setting passlock permission for a program 4. Under Authentication, select the check box beside the option you want, then click OK. Setting passlock permission for a program When the Internet Lock is engaged, programs given passlock permission can continue to access the Internet. If you grant passlock permission to a program, and that program uses other applications to perform its functions (for example, services.exe), be sure to give those other programs passlock permission as well. To grant or revoke passlock permission: 1. Select Program Control|Programs. 2. Select a program from the list, then click Options. 3. Select the Enable Pass Lock check box. 4. Click Apply, then click OK. User Guide for ZoneAlarm security software 88
Slide 107: Chapter 5: Program control Managing program components Managing program components In addition to controlling permissions for all programs on a computer, advanced users may also want to monitor and, if desired, restrict individual components that these programs load (such as DLL files or ActiveX controls). ZoneAlarm security software keeps a list of components (used by allowed programs) that have tried to access the Internet or the local network. Depending on your program control and component control settings, ZoneAlarm security software can simply monitor components or it can alert you each time a new component attempts access. This section explains how to access the Components List and how to change component permissions. For details about enabling component control, see “Enabling Component Control,” on page 73. The Components List contains a list of program components for allowed programs that have tried to access the Internet or the local network. The Access column indicates whether the component is always allowed access, or whether ZoneAlarm security software should alert you when that component requests access. By default, the Components List is organized in alphabetical order, but you can sort the components in the list by any column by clicking on the Component column header. To access the Components List: Select Program Control | Components. Figure 5-4: Components List To grant access permission to a program component: 1. Select Program Control|Components. User Guide for ZoneAlarm security software 89
Slide 108: Chapter 5: Program control Managing program components 2. Select a component from the list, then click in the Access column. 3. Select Allow from the shortcut menu. User Guide for ZoneAlarm security software 90
Slide 109: Chapter 5: Program control Creating expert rules for programs Creating expert rules for programs By default, programs given access permission or server permission can use any port or protocol, and contact any IP address or host at any time. Conversely, programs that you block have no access rights at all. By creating expert rules for particular programs, you can heighten protection against hijacked programs by specifying ports and protocols, source and destination addresses, and time and day ranges during which activity is either allowed or denied. You can also apply tracking options to specific types of traffic in order to see alerts or generate log entries when allowed program traffic occurs, enable or disable rules at will, and apply multiple, ranked rules to a program. If you created port rules for Programs in a version of ZoneAlarm security software, prior to 4.0, those port rules will be automatically converted to expert rules and visible in the Expert tab of the Program Options dialog. To access the Expert tab, select Program Control|Programs, then click Options. Creating an expert rule for a Program Expert rules for programs are enforced in the order they are ranked. Therefore, when you create expert rules for a program, make sure that the last rule you create for that program is a “Block All” rule. For tips on setting up expert rules for your programs, visit the ZoneAlarm User Forum (http://www.zonelabs.com/forum) and search for “program rules”. To create an expert rule for a program: 1. Select Program Control|Programs, then click Options. 2. Select Expert Rules, then click Add. The Add rule dialog appears. 3. Create Expert Program rule. The Add rule dialog contains the same fields and options that are available when you create Expert Firewall rules. Note, however, that IGMP and Custom protocols cannot be applied to expert rules for Programs. See “Creating expert firewall rules,” on page 57. 4. Click OK. User Guide for ZoneAlarm security software 91
Slide 110: Chapter 5: Program control Sharing expert rules Sharing expert rules Expert firewall rules (created in the Expert tab in the Firewall panel) cannot be directly applied to a single program. If the rule is enabled, it is applied globally. Similarly, an expert rule you created for one program cannot be directly applied to another program. However, you can create a copy of the existing expert rule and apply it to any program. Note that none of the changes you make to the copy will be reflected in the original. To apply an existing expert firewall rule to a program: 1. Select Firewall|Expert. 2. Select the rule you want to apply, then press CTRL+C. 3. Select Program Control|Programs. 4. In the Programs column, select the program to which you want to apply the expert rule, then click Options. 5. Select Expert Rules, then press CTRL+V. The Expert rule is applied to the program. 6. Click Apply, then click OK. To disable an Expert rule: 1. Select Program Control|Programs. 2. Select the program for which you want to disable an Expert Program rule, then right-click and select Disable from the shortcut menu. The rule will be grayed-out. 3. Click Apply, then click OK. User Guide for ZoneAlarm security software 92
Slide 111: Program control Sharing expert rules User Guide for ZoneAlarm security software 93
Slide 112: Program control Sharing expert rules User Guide for ZoneAlarm security software 94
Slide 113: Chapter Spyware and Virus protection The integrated Anti-virus and Anti-spyware feature protects your computer against viruses and spyware in a single powerful operation. Multiple scanning options automatically detect viruses and spyware and render them harmless before they can damage your computer. Spyware Community Watch updates your signature database with information on the latest spyware outbreaks gathered from more than 30 million ZoneAlarm users. The Anti-virus feature is only available in ZoneAlarm Antivirus and ZoneAlarm Security Suite. The Anti-spyware feature is only available in ZoneAlarm Anti-Spyware, ZoneAlarm Pro, and ZoneAlarm Security Suite. Topics: “Spyware and Virus Protection,” on page 96 “Customizing virus protection options,” on page 99 “Customizing spyware protection options,” on page 103 “Performing a virus scan,” on page 105 “Performing a spyware scan,” on page 110 “Viewing virus and spyware protection status,” on page 115 “Monitoring virus protection,” on page 116 6 95
Slide 114: Chapter 6: Spyware and Virus protection Spyware and Virus Protection Spyware and Virus Protection The Anti-spyware feature detects spyware components on your computer and either removes them automatically, or places them in quarantine so that you can remove them manually after assessing their risk. The Anti-virus feature keeps known and unknown viruses from affecting your computer by scanning files and comparing them to a database of known viruses and against a set of characteristics that tend to reflect virus behavior. Files can be scanned as they are opened, closed, executed, or as part of a full computer-wide scan. If a virus is detected, ZoneAlarm security software renders it harmless, either by repairing or denying access to the infected file. Turning on virus and spyware protection If you are using ZoneAlarm Security Suite and you chose not to turn on the anti-virus protection feature in the Configuration Wizard following installation, you can turn it on manually. The ZoneAlarm Anti-virus protection feature is incompatible with other virus protection software. Before you turn on the Anti-virus protection feature, you must uninstall any other anti-virus software from your computer, including suite products that include virus protection among their features. ZoneAlarm security software can automatically uninstall some anti-virus applications for you. If you are using a program that cannot be uninstalled automatically, you can uninstall it using Add/Remove Programs, accessible from the Windows Control Panel. To enable virus and spyware protection: 1. Select Anti-virus / Anti-spyware|Main. 2. In the Anti-virus area, select On. 3. In the Anti-spyware area, select On. Scheduling a scan Scanning your computer for viruses and spyware is one of the most important things you can do to protect the integrity of your data and computing environment. Since scanning is most effective when performed at regular intervals, it often makes sense to schedule it as a task to run automatically. If your computer is not on when the scheduled scan is set to occur, the scan will occur fifteen minutes after your computer is restarted. To schedule a scan: 1. Select Anti-virus/Anti-spyware|Main. 2. In the Anti-virus area, click Advanced Options. The Advanced Options dialog appears. User Guide for ZoneAlarm security software 96
Slide 115: Chapter 6: Spyware and Virus protection Updating virus and spyware definitions 3. Under Advanced Settings, select Scan Schedule. 4. Select the Scan for viruses check box, then specify a day and time for the scan. 5. Specify the scan frequency. By default, a virus scan is performed once per week. 6. Select the Scan for spyware check box, then specify a day and time for the scan. 7. Specify the scan frequency. By default, a spyware scan is performed once per week. 8. Click OK. Updating virus and spyware definitions Every virus or spyware application contains unique identification information, known as its definition file. These definition files are the maps used to locate viruses and spyware on your computer. As new viruses or spyware applications are discovered, ZoneAlarm security software updates its databases with the definitions files it needs to detect these new threats. Therefore, your computer is vulnerable to viruses and spyware whenever its database of virus definitions files becomes outdated. The Details area User Guide for ZoneAlarm security software 97
Slide 116: Chapter 6: Spyware and Virus protection Updating virus and spyware definitions located on the Main tab of the Anti-virus / Anti-spyware panel displays the status of your definition files. Indicates that definition files are out of date Click here to update definition files. Figure 6-1: Anti-virus and Anti-spyware status By enabling the automatic update feature, you will always receive the latest definition files when they are available. To enable automatic updates: 1. Select Anti-virus / Anti-spyware|Main. 2. In the Anti-virus area, click Advanced Options. The Advanced Options dialog appears. 3. Select Updates, then select the enable automatic anti-virus updates check box. 4. Select the enable automatic anti-spyware updates check box. 5. Click OK. User Guide for ZoneAlarm security software 98
Slide 117: Chapter 6: Spyware and Virus protection Customizing virus protection options Customizing virus protection options In addition to choosing the type of scan you want to perform, you also can specify the method used to detect viruses, and set treatment methods. ZoneAlarm security software provides several types of virus scans to keep your computer and data safe: system scans, on-access scans, and e-mail scans. Specifying scan targets You can specify which drives, folders, and files are scanned when a system scan occurs. Exclude or include an item in the scan by selecting the check box beside it. By default, ZoneAlarm security software only scans local hard drives. Figure 6-2: Scan targets dialog box Table 6-2 below provides an explanation of the icons shown in the Scan Targets dialog box. Icon Explanation The selected disk and all sub-folders and files will be included in the scan. The selected disk and all sub-folders and files will be excluded from the scan. Table 6-2: Icons indicating scan targets User Guide for ZoneAlarm security software 99
Slide 118: Chapter 6: Spyware and Virus protection On-Access scanning Icon Explanation The selected disk will be included in the scan, but one or more sub-folders or files will be excluded from the scan. The selected folder will be excluded from the scan, but one or more sub-folders or files will be included in the scan. The selected folder will be included in the scan. A gray check mark indicates that scanning of the folder or file is enabled because scanning has been enabled for a higher level disk or folder. The selected folder will be excluded from the scan. A gray “x” mark indicates that scanning of the folder or file is disabled because scanning has been disabled for a higher level disk or folder. Table 6-2: Icons indicating scan targets To specify scan targets: 1. Select Anti-virus / Anti-spyware|Main. 2. Click Advanced Options. The Advanced Options dialog appears. 3. Under Virus Management, select Scan Targets. 4. Select the drives, folders, and files to be scanned. 5. Select or clear the scan boot sectors for all local drives check box. 6. Select or clear the scan system memory check box, then click OK. On-Access scanning On-Access scanning protects your computer from viruses by detecting and treating viruses that may be dormant on your computer. On-Access scanning is enabled by default. On-Access scanning supplies the most active form of virus protection. Files are scanned for viruses as they are moved, opened, executed, or closed, thereby allowing immediate detection and treatment of viruses. (Note that archive files, such as .zip files, are scanned only when you open them.) To enable on-access scanning: 1. Select Anti-virus / Anti-spyware|Main. 2. In the Protection area, click Advanced Options. The Advanced Anti-virus Settings dialog appears. 3. Under Advanced Settings, select On-Access Scanning. 4. Select the Enable On-Access Scanning check box, then click OK. User Guide for ZoneAlarm security software 100
Slide 119: Chapter 6: Spyware and Virus protection E-mail Scanning E-mail Scanning E-mail scanning builds on the protection offered by MailSafe, by scanning for viruses in the body and attachments of e-mail messages and removing them before they can do damage. Where MailSafe scans for potentially harmful attachments based on file extension, the E-mail scanning feature scans for harmful files by comparing the attachments to the signature files of known viruses. If an infected attachment is detected, the attachment is removed from the e-mail message and replaced with a text file log that provides details about the removed file. For details about performing an email scan, see “Anti-virus protection for e-mail,” on page 141. E-mail scanning is on by default. To enable or disable E-mail scanning: 1. Select Anti-virus / Anti-spyware|Main, then click Advanced Options. The Advanced Options dialog appears. 2. Under Virus Management, select E-mail Scanning. 3. Select or clear the Enable E-mail Scanning check box, then click OK. Enabling automatic virus treatment When a virus infection is detected, the Scan Results dialog offers the available treatment options, such as Quarantine, Repair, or Delete. By default, ZoneAlarm security software automatically attempts to treat files that contain viruses. If a file cannot be repaired, the Scan Results dialog will inform you so that you can take the appropriate action. To enable automatic virus treatment: 1. Select Anti-virus / Anti-spyware|Main, then click Advanced Options. 2. Under Virus Management, select Auto Treatment. 3. Select the auto treatment option you want: Alert me - do not treat automatically Try to repair, and alert me if repair fails Try to repair, quarantine if repair fails (recommended) 4. Click OK. Specifying virus scan options You can configure your virus scan to ignore any file larger than a specified size (default setting is 8 MB). This option improves scan time without increasing risk, as virus files are usually smaller than 8 MB. While large files ignored by the scan may contain viruses, your computer is still protected if you have on-access scan enabled. You can also enable the extended database. This database includes a comprehensive list of malware in addition to the standard virus list. However, some malware listed in the extended database may also be listed in the standard anti-spyware database; some User Guide for ZoneAlarm security software 101
Slide 120: Chapter 6: Spyware and Virus protection Excluding suspected extended database items from suspected malware may be scanned twice. Also, the extended database malware list may include programs that you consider to be benign. To specify virus scan options: 1. Select Anti-virus / Anti-spyware|Main, then click Advanced Options. The Advanced Options dialog appears. 2. Under Virus Management, select Scan Options. 3. Select or clear the skip if the object is greater than check box. If you checked this box, enter a maximum object size in the MB field. 4. Select or clear the enable extended database check box, then click OK. Excluding suspected extended database items from scans Although some programs considered to be suspicious by the extended database have the potential to harm your computer or to make your data vulnerable to hackers, there are many potentially benign applications that still will be detected as viruses during a scan. If you are using one of these applications, you can exclude it from antivirus scans by adding it to the exceptions list. You can add programs to the exceptions list by rightclicking the item in the Scan Results list and choosing Ignore Always from the menu. Once programs are on the exceptions list, they no longer will be detected during virus scans. If a virus was added to the exceptions list accidentally, you can remove it manually. To remove viruses from the exceptions list: 1. Select Anti-virus / Anti-spyware | Main, then click Advanced Options. 2. Under Virus Management, select Exceptions. 3. In the Virus Treatment Exceptions area, select the virus you want to remove, then click Remove from List. 4. Click OK. User Guide for ZoneAlarm security software 102
Slide 121: Chapter 6: Spyware and Virus protection Customizing spyware protection options Customizing spyware protection options In addition to choosing the type of scan you want to perform, you can specify the method used to detect spyware, set treatment methods, and view suspected spy sites that ZoneAlarm security software has blocked. Enabling automatic spyware treatment When spyware is detected, the Scan Results dialog offers the available treatment options, such as Quarantine, or Delete. The Scan Results dialog will display the suggested treatment of spyware so that you can take the appropriate action. To enable automatic virus treatment: 1. Select Anti-virus / Anti-spyware | Main, then click Advanced Options. 2. Under Spyware Management, select Auto Treatment. 3. Select the Enable automatic spyware treatment check box, then click OK. Specifying spyware detection methods In addition to default detection that searches your computer’s registry for active spyware, there are methods to detect latent spyware and hard-to-find spyware. To specify spyware detection methods: 1. Select Anti-virus / Anti-spyware | Main, then click Advanced Options. 2. Under Spyware Management, select Detection. 3. Select the Scan for tracking cookies check box. 4. Under Maximum strength detection, select the desired option: Intelligent quick scan Full system scan This option is selected by default. Scans the local file system. This option can slow down scan performance. Select this option only if you suspect undetected spyware is present on your computer. Scans every byte of data on your computer. This option can slow down scan performance. Select this option only if you suspect undetected spyware is present on your computer. Deep-inspection scan. 5. Click OK. Excluding spyware from scans Although some spyware programs have the potential to harm your computer or to make your data vulnerable to hackers, there are many benign applications that still will be User Guide for ZoneAlarm security software 103
Slide 122: Chapter 6: Spyware and Virus protection Spy Site Blocking detected as spyware during a scan. If you are using one of these applications, for example, voice recognition software, you can exclude it from spyware scans by adding it to the exceptions list. You can add spyware to the exceptions list by right-clicking the item in the Scan Results list and choosing Ignore Always from the menu. Once spyware is on the exceptions list, it no longer will be detected during spyware scans. If spyware was added to the exceptions list accidentally, you can remove it manually. To remove spyware from the exceptions list: 1. Select Anti-virus / Anti-spyware | Main, then click Advanced Options. 2. Under Spyware Management, select Exceptions. 3. In the Spyware Treatment Exceptions area, select the spyware application you want to remove, then click Remove from List. 4. Click OK. Spy Site Blocking Spy Site Blocking prevents you from accessing Web sites suspected of transmitting spyware. Activated by default, Spy Site Blocking builds up a list of blocked sites, adding suspected spyware sites as you try to access them. If you attempt to access a suspected spyware site, ZoneAlarm security software blocks the site, displays a warning pop-up, and adds the site to the Blocked Sites list. The warning pop-up includes a link that leads to the Spy Site Blocking tab, where you can turn the feature on or off, review the Blocked Sites list, and change permissions for sites in the list. The Blocked Sites list contains only those sites you have tried to access since last starting ZoneAlarm security software plus any sites for which you have set access permission to Allow. To configure Spy Site Blocking: 1. Select Anti-virus / Anti-spyware | Spy Site Blocking. 2. In the Spy Site Blocking area, select On or Off as desired. 3. If you wish to change access permissions for any sites in the Blocked Sites list, click on the Access field for the relevant site and choose Allow or Block as appropriate. Preventing spyware attacks Spy Site Blocking and the Operating System Firewall (OSFirewall) help to prevent spyware from installing itself on your computer. Spy Site Blocking prevents you from accessing Web sites suspected of transmitting spyware. To see controls for this feature, go to the Spy Site Blocking tab; to read about the feature, see “Spy Site Blocking,” on page 104. The Operating System Firewall (OSFirewall) prevents spyware from installing itself on your computer. For details about OSFirewall, see “Configuring OSFirewall protection,” on page 72. User Guide for ZoneAlarm security software 104
Slide 123: Chapter 6: Spyware and Virus protection Performing a virus scan Performing a virus scan There are several ways you can initiate a virus scan on your computer. You can click Scan for Viruses in the Anti-virus area on the Main tab of the Antivirus / Anti-spyware panel. You can right-click a file on your computer, then choose Scan with ZoneAlarm Anti-virus. You can schedule a system scan to run once or at regular intervals. You can open a file (if on-access scanning is enabled). You may run up to five scans simultaneously. Scans are performed in the order in which they are initiated. System scans provide another level of protection by allowing you to scan the entire contents of your computer at one time. System scans detect viruses that may be dormant on your computer’s hard drive, and if run frequently, can ensure that your anti-virus signature files are up to date. Because of the thorough nature of full-system scans, they can take a while to perform. As a result, your system’s performance may be slowed down while a full-system scan is in progress. To avoid any impact on your workflow, you can schedule system scans to run at a time when you are least likely to be using your computer. During scans, ZoneAlarm security software displays a special system tray icon ( ) and provides a system tray menu option for viewing scan status. Right-click the system tray icon and choose View Scan to check on scan status. Clicking Pause in the Scan dialog while a scan is being performed will stop the current scan only. On-access scanning will not be disabled. Click Pause again to resume the current scan. User Guide for ZoneAlarm security software 105
Slide 124: Chapter 6: Spyware and Virus protection Understanding virus scan results Understanding virus scan results Regardless of the method used to initiate the scan, the results of the scan are displayed in the Scan Results dialog box as shown in the figure below. Click here to send virus to SmartDefense Advisor for more information Figure 6-3: Virus scan results dialog The Active Items area of the Scan details dialog lists infections found during the scan that could not be treated automatically. To accept the suggested treatments in the Treatment column, click Apply. The items listed under Auto Treatment have already been treated, you do not need to take further action. Name The name of the virus that caused the infection. Treatment Specifies the treatment applied to the infection. Possible values are Quarantined or Deleted. Security Risk Indicates the risk level of the infection. All viruses are considered High risk. Path The location of the virus that caused the infection. User Guide for ZoneAlarm security software 106
Slide 125: Chapter 6: Spyware and Virus protection Treating virus files manually Type Specifies whether the infection was caused by a virus, worm, or trojan. Status Tells you whether the file has been repaired, deleted, or remains infected. If ZoneAlarm security software was unable to treat the item, a What to do next link may appear here. This link will direct you to further information and instructions. Information Provides more detail about the infection. To get more information about a virus or spyware, click the Learn more link. Detail This field remains empty for virus scans. For information about its use in spyware scans, see “Understanding spyware scan results,” on page 111. Treating virus files manually If you do not have automatic treatment enabled, or if a file could not be repaired automatically, you can attempt to treat it manually from the Scan Results dialog. To treat a file manually: 1. In the Scan Results dialog, select the item you want to treat. 2. In the Treatment column, choose the treatment option you want: Repair Delete Quarantine Tries to repair the selected file. Deletes the selected file. Appends the extension .zl6 to the infected file to render it harmless. The file is placed in Quarantine. 3. When you have finished treating files, click Close. If the results of a virus scan contain Error, No treatment available, or Treatment failed, it means that there is not yet a way to automatically remove the virus without risking the integrity of your computer or other files. In some cases, there may be manual treatments available to you. To find out, enter the name of the virus along with the word “removal” into a search engine, such as Google or Yahoo, to locate removal instructions. Otherwise, know that we’re constantly researching viruses and developing safe ways to remove them. Repairing files in an archive If the infected file is located in an archive file (such as a .zip file), ZoneAlarm security software will not be able to treat it (either by repairing, deleting, or placing it in Quarantine) while the file is still included in the archive. User Guide for ZoneAlarm security software 107
Slide 126: Chapter 6: Spyware and Virus protection Submitting viruses and spyware to ZoneAlarm for re- To repair a file in an archive: 1. Select Anti-virus / Anti-spyware|Main, then click Advanced Options. 2. Select On-Access Scanning, then select the Enable On-Access Scanning check box. 3. Click Apply, then click OK. 4. Open the file that was specified in the Scan Results dialog from within an archival utility, such as WinZip. On-access scanning will scan the file for infections. The Scan Results dialog will appear with the results of the scan. If the file still cannot be repaired, see “Treating virus files manually,” on page 107. Submitting viruses and spyware to ZoneAlarm for review Reporting and submitting suspected malware to Zone Labs, LLC. helps to improve the security and protection of all Internet users. The ZoneAlarm Security Team monitors all incoming submissions for new files. The ZoneAlarm Security Team will act on your submission as appropriate and may contact you for more information or to provide details about the files you submit. Due to the volume of malware released each day, our researchers cannot respond to each file you submit. However, we appreciate the assistance of our users and thank you for taking the time to help secure the Internet. Please address any questions or concerns to: security@zonelabs.com To submit malware to ZoneAlarm for review: 1. Place the malware file in a password-protected .zip archive with the password set to infected. For help with creating a password protected archive, refer to the Help for WinZip. 2. Send the .zip file to malware@zonelabs.com Use this e-mail address only for sending malware to the ZoneAlarm Security Team. Please do not send malware files if you feel you cannot do so safely or if it would increase the risk of infection or damage to your system. Do not e-mail suspected malware files to others as they could be malicious. Viewing logged virus events By default, all Virus events are recorded in the Log Viewer. To view logged Virus events: 1. Select Alerts & Logs|Log Viewer. User Guide for ZoneAlarm security software 108
Slide 127: Chapter 6: Spyware and Virus protection Viewing logged virus events 2. Select Virus, from the Alert Type drop-down list. Table 6-3 provides an explanation of the log viewer fields available for Virus events. Field Date Information The date of the infection. Type The type of event that occurred. Possible values for this field include: • Update • Scan • Treatment • E-mail Virus name Filename The common name of the virus. For example, iloveyou.exe. The name of the infected file, the name of files being scanned, or the name and version number of update and/or engine. How the traffic was handled by ZoneAlarm security software. Possible values include: • Updated, Update cancelled, Update Failed • Scanned, Scan cancelled, Scan Failed • File Repaired, File Repair Failed • Quarantined, Quarantine Failed • Deleted, Delete Failed • Restored, Restore Failed • Renamed, Rename Failed Actor E-mail Whether the action was manual or auto. If the virus was detected in e-mail, the email address of sender of the infected message. Action Taken Table 6-3: Virus event log fields User Guide for ZoneAlarm security software 109
Slide 128: Chapter 6: Spyware and Virus protection Performing a spyware scan Performing a spyware scan There are a couple of ways to initiate a spyware scan on your computer. You can click Scan for Spyware in the Anti-spyware area on the Main tab of the Anti-virus / Anti-spyware panel. You can schedule a system scan to run once or at regular intervals. You may run up to five scans simultaneously. Scans are performed in the order in which they are initiated. System scans provide another level of protection by allowing you to scan the entire contents of your computer at one time. System scans detect spyware that may be dormant on your computer’s hard drive, and if run frequently, can ensure that your anti-spyware signature files are up to date. Because of the thorough nature of full-system scans, they can take some time to perform. As a result, your system’s performance may be slowed down while a fullsystem scan is in progress. To avoid any impact on your workflow, you can schedule system scans to run at a time when you are least likely to be using your computer. During scans, ZoneAlarm security software displays a special system tray icon ( ) and provides a system tray menu option for viewing scan status. Right-click the system tray icon and choose View Scan to check on scan status. Clicking Pause in the Scan dialog while a scan is being performed will stop the current scan. Click Pause again to resume the current scan. User Guide for ZoneAlarm security software 110
Slide 129: Chapter 6: Spyware and Virus protection Understanding spyware scan results Understanding spyware scan results The results of a spyware scan are displayed in the Scan Results dialog box as shown in the figure below. Choose treatment from drop-down list, then click Apply. Figure 6-4: Spyware scan results dialog The Active Items area of the Scan Results dialog lists infections found during the scan that could not be treated automatically. To accept the suggested treatments in the Treatment column, click Apply. The items listed under Auto Treatment have already been treated, you do not need to take further action. Name The spyware name. Treatment Specifies the treatment applied to the infection. Possible values are Quarantined or Deleted. Security Risk Indicates the risk level of the infection. Possible values for this column include: Low - Adware or other annoying but benign software. User Guide for ZoneAlarm security software 111
Slide 130: Chapter 6: Spyware and Virus protection Errors in spyware scan results Med -Potential privacy breach. High - Poses a security threat. Path The location of the virus or spyware that caused the infection. You can expand the field and scroll right to see the complete path. Type The category of spyware detected. Possible values for this field include keylogging software and tracking cookie. Status Tells you whether the file has been repaired, deleted, or remains infected. If ZoneAlarm security software was unable to treat the item, a What to do next link may appear here. This link will direct you to further information and instructions. Information Provides more detail about the infection. To get more information about a virus or spyware, click the Learn more link. Detail Lists the full paths of all spyware traces (such as registry keys, cookies, and so on). Advanced users may find this information useful for tracking down spyware programs that cannot be treated automatically. Errors in spyware scan results If the results of a spyware scan contain Error, No treatment available, or Treatment failed, it means that there is not yet a way to automatically remove the spyware without risking the integrity of your computer or other files. This is not uncommon, as spyware writers often employ heavy-handed tactics to keep their spyware on your computer with no regard to the damage they could cause. In most cases, there are manual treatments available to you. To find out, enter the name of the spyware along with the word “removal” into a search engine, such as Google or Yahoo, and see if you can find removal instructions. Otherwise, know that we’re constantly researching spyware such as this and developing safe ways to remove it. Chances are we’ll have a treatment available soon. Viewing items in quarantine In some cases, items detected during a virus or spyware scan cannot be treated or removed automatically. These items are usually placed into quarantine so that they are rendered harmless but preserved so that they may be treated in the future after an update to your virus and spyware signature files. To view viruses in quarantine: 1. Select Anti-virus / Anti-spyware. User Guide for ZoneAlarm security software 112
Slide 131: Chapter 6: Spyware and Virus protection Viewing logged spyware events 2. Select the Quarantine tab. 3. Choose Viruses from the Quarantined View drop-down list. 4. Optionally, select a virus entry in the list and click Delete (to delete it from your computer), Restore (to restore it to your computer), or More Info (to consult SmartDefense Advisor for more information about it). The virus view in quarantine contains the following columns of information: Infection The name of the virus that caused the infection. Days in Quarantine The number of days the virus has been in quarantine. Path The location of the virus on your computer. To view spyware in quarantine: 1. Select Anti-virus / Anti-spyware. 2. Select the Quarantine tab. 3. Choose Spyware from the Quarantined View drop-down list. 4. Optionally, select a spyware entry in the list and click Delete (to delete it from your computer), Restore (to restore it to your computer), or More Info (to consult SmartDefense Advisor for more information about it). The spyware view in quarantine contains the following columns of information: Type The name of the virus that caused the infection. Name The name of the spyware that was detected. Risk The risk level of the infection. Indicates whether the spyware is benign like adware, or a serious threat like keylogging software. Days in Quarantine The number of days the spyware has been in quarantine. Viewing logged spyware events By default, all Spyware events are recorded in the Log Viewer. To view logged spyware events: 1. Select Alerts & Logs|Log Viewer. User Guide for ZoneAlarm security software 113
Slide 132: Chapter 6: Spyware and Virus protection Viewing logged spyware events 2. Select Spyware, from the Alert Type drop-down list. Table 6-3 provides an explanation the log viewer fields available for spyware events. Field Date Information The date of the infection. Type The type of spyware detected. Possible values for this field include: • Adware • Browser Helper Object • Dialer • Keylogger • Screenlogger • Trojan • Worm • Spy Cookie Spyware name Filename Action Actor The common name of the spyware. For example, NavExcel. The name of the spyware file, for example gmt.exe. How the spyware was handled by ZoneAlarm security software. Whether the action was performed by you (manual) or by ZoneAlarm security software (auto) Table 6-4: Spyware event log fields User Guide for ZoneAlarm security software 114
Slide 133: Chapter 6: Spyware and Virus protection Viewing virus and spyware protection status Viewing virus and spyware protection status There are two places you can view the status of your virus and spyware protection. One is on the Overview|Status page, and the other is on the Anti-virus / Antispyware|Main tab. The Main tab of the Anti-virus / Anti-spyware panel displays the status of your virus and spyware protection. From this area you can: Verify that virus and spyware protection is turned on. The dates and times of your last scan(s). Update definition files. Invoke a scan. View results of latest scan. Access advanced settings. For information on the status information found on the Overview panel, Chapter 2,“Using the Status tab,” starting on page 16. The section that follows describes the status information located on the Main tab of the Anti-virus / Anti-spyware panel. User Guide for ZoneAlarm security software 115
Slide 134: Chapter 6: Spyware and Virus protection Monitoring virus protection Monitoring virus protection One of the most important things you can do to protect your computer against viruses is to install an anti-virus software product. Once installed, however, the anti-virus software must be kept up to date to ensure protection against new viruses as they are created. No matter which anti-virus software product you use, if you find yourself in either of the following situations, you are putting your computer at risk for virus attack: Your trial or subscription period has expired. Your virus signature files are out of date. Anti-virus Monitoring is available in ZoneAlarm, ZoneAlarm Anti-virus, ZoneAlarm Anti-Spyware, ZoneAlarm Pro, and ZoneAlarm Security Suite. Anti-virus Monitoring is a secondary defense system that tracks anti-virus software you have installed on your computer and lets you know when that anti-virus software is outof-date or turned off. This secondary alerting system works as a back-up to your antivirus software’s built-in warning and update system. Most anti-virus products include automatic updating, and alert you when your virus definition files become outdated. Note that not all anti-virus products are supported by this feature. Monitoring Coverage Anti-virus Monitoring currently detects anti-virus software from these popular manufacturers: Symantec McAfee Computer Associates Trend Micro If you use a different anti-virus product, Anti-virus Monitoring will not recognize it at this time. This does not mean that your ZoneAlarm product is malfunctioning; your security remains as strong as ever. ZoneAlarm security software will be adding the ability to recognize more products over time. If your anti-virus product is not currently supported, you may simply turn off the Anti-virus Monitoring feature. Do not worry-Anti-virus Monitoring is monitoring only and has no affect on the firewall and no direct affect on security. Monitoring in ZoneAlarm, ZoneAlarm Pro, and ZoneAlarm Anti-Spyware In these products, you will see an Anti-virus Monitoring panel. From this panel you can view the status of your anti-virus product. You can also turn monitoring on or off, or you can turn on or off just the monitoring alerts. User Guide for ZoneAlarm security software 116
Slide 135: Chapter 6: Spyware and Virus protection Monitoring in ZoneAlarm Anti-virus and ZoneAlarm To turn off Monitoring and Monitoring alerts: 1. Select Anti-virus Monitoring|Main. 2. In the Monitoring area, select Off. 3. Clear the check box Notify me of anti-virus security lapses. Monitoring in ZoneAlarm Anti-virus and ZoneAlarm Security Suite In these products, there is no Anti-virus Monitoring panel because the products are equipped with ZoneAlarm Anti-virus. Instead, there are monitoring alerts. When ZoneAlarm Anti-virus is turned off, the Anti-virus Monitoring feature is activated. Monitoring can be turned off from any monitoring alert, or from the Advanced Options dialog. To turn off Monitoring 1. Select Alerts & Logs, then click Advanced. 2. Select the Alerts Events tab. 3. Clear the following check boxes: Anti-virus protection not found Anti-virus Monitoring events 4. Click OK. Enabling and disabling Anti-virus Monitoring If you do not have ZoneAlarm Anti-virus installed and are using another anti-virus software product, Anti-virus Monitoring will be enabled by default. In addition, you can choose to enable Monitoring alerts, which will appear whenever a lapse in protection is detected. To enable or disable Anti-virus Monitoring: 1. Select Anti-virus Monitoring|Main. 2. In the Anti-virus Monitoring area, select On. User Guide for ZoneAlarm security software 117
Slide 136: Chapter 6: Spyware and Virus protection Viewing Status Messages in the Anti-virus Monitoring Viewing Status Messages in the Anti-virus Monitoring panel The Status area of the Anti-virus Monitoring panel displays the current state of your installed Anti-virus products, as well as the state of Anti-virus Monitoring. Figure 6-5: Anti-virus Monitoring Status area in ZoneAlarm Monitoring Anti-virus Product ZoneAlarm security software is able to detected most major anti-virus software products. This area includes a drop-down list that displays the anti-virus software products that were detected. Protection Displays whether your anti-virus products are active and protecting you. Anti-virus Update Displays whether your anti-virus products are up to date, or whether your subscription is current. Viewing Anti-virus Monitoring alerts If your anti-virus vendor hasn’t sent you the latest virus definitions, if your anti-virus product’s notification feature has been disabled, or if you’re running an anti-virus product that we have not detected (see “Monitoring Coverage,” on page 116) then Antivirus Monitoring provides you with a warning as a second line of defense. When a lapse in protection occurs, you will see a Monitoring alert. This alert appears on a slight delay to allow your Anti-virus product to alert you first. When the alert does User Guide for ZoneAlarm security software 118
Slide 137: Chapter 6: Spyware and Virus protection Viewing Anti-virus Monitoring alerts appear, it will provide information and instructions for making your Anti-virus product secure. When running Windows 98, the Anti-virus E-mail scanning feature renames MailSafe to isafe.exe rather than the name of the computer’s e-mail program. User Guide for ZoneAlarm security software 119
Slide 138: Spyware and Virus protection Viewing Anti-virus Monitoring alerts User Guide for ZoneAlarm security software 120
Slide 139: Spyware and Virus protection Viewing Anti-virus Monitoring alerts User Guide for ZoneAlarm security software 121
Slide 140: Spyware and Virus protection Viewing Anti-virus Monitoring alerts User Guide for ZoneAlarm security software 122
Slide 141: Chapter E-mail protection Worms, viruses, and other threats often use e-mail to spread from computer to computer. MailSafe guards your own computer against e-mail-borne threats, while also protecting your friends, co-workers, and others in your e-mail address book. Topics: “Understanding e-mail protection,” on page 124 “Enabling Inbound MailSafe protection,” on page 125 “Enabling Outbound MailSafe protection,” on page 125 “Customizing Inbound MailSafe protection,” on page 126 “Customizing Outbound MailSafe protection,” on page 129 “Filtering junk e-mail,” on page 131 “Anti-virus protection for e-mail,” on page 141 7 123
Slide 142: Chapter 7: E-mail protection Understanding e-mail protection Understanding e-mail protection Attaching files to e-mail messages is a convenient way of exchanging information. However, it also provides hackers with an easy way of spreading viruses, worms, Trojan horse programs, and other malware. The inbound and outbound MailSafe features keep suspect attachments quarantined so that they can’t infect your computer, and stops worms from mass-mailing themselves to everyone you know. Inbound MailSafe protection Potentially dangerous attachments can be identified by their file name extensions—the characters that appear after the “dot” in a file name. They identify the file type so that the appropriate program or system component can open it. For example: .exe (an executable file) .js (a JavaScript file) .bat (a batch process file) When an e-mail message with an attachment arrives in your Inbox, MailSafe examines the attachment’s file name extension and compares it to the extensions on the attachments list. If the attachment type appears on the list and if attachments of that type are set to quarantine, ZoneAlarm security software changes the file name extension to “.zl*” (where * is a number or letter). Changing the filename extension quarantines the attachment by keeping it from running automatically. When you open the e-mail containing the attachment, ZoneAlarm security software displays a MailSafe alert to let you know that it has quarantined the attachment. If you try to open the attachment, an alert warns you of the potential risk involved. However, you are still able to open the attachment if you are sure that it is safe. In addition to verifying messages by their file extension, ZoneAlarm security software scans incoming attachments for potential viruses. If a virus is found, it is removed from the message before it can do damage. For more information about Anti-virus protection and e-mail messages, see “E-mail Scanning,” on page 101. Inbound MailSafe protection works with any e-mail application that uses POP3 or IMAP protocols. Inbound MailSafe protection is designed for local access only. If you have configured your POP3 client for remote access, inbound MailSafe protection may not be available. User Guide for ZoneAlarm security software 124
Slide 143: Chapter 7: E-mail protection Outbound MailSafe protection Outbound MailSafe protection Outbound MailSafe protection alerts you if your e-mail program tries to send an unusually large number of messages, or tries to send a message to an unusually large number of recipients. This prevents your computer from being used without your knowledge to send infected attachments to other people. In addition, Outbound MailSafe protection verifies that the program attempting to send the e-mail has permission to send e-mail messages. Outbound MailSafe protection works with any e-mail application that uses SMTP. The Outbound MailSafe protection feature is only available in ZoneAlarm Anti-virus, ZoneAlarm Anti-Spyware, ZoneAlarm Pro, and ZoneAlarm Security Suite. Enabling Inbound MailSafe protection Inbound MailSafe protection is enabled by default. When enabled, Inbound MailSafe quarantines attachment types listed on the Attachments tab. To enable or disable Inbound MailSafe: 1. Select E-mail Protection|Main. 2. Select On or Off. On Off MailSafe quarantines attachment types specified in the attachments tab. MailSafe allows all attachment types. Enabling Outbound MailSafe protection For your security, Outbound MailSafe Protection is enabled by default. When Outbound protection is enabled, Outbound MailSafe settings apply to all programs with send mail privileges. To enable or disable Outbound MailSafe Protection 1. Select E-mail Protection|Main. 2. In the Outbound MailSafe Protection area, select On or Off. User Guide for ZoneAlarm security software 125
Slide 144: Chapter 7: E-mail protection Customizing Inbound MailSafe protection Customizing Inbound MailSafe protection All of the attachment types supported by Inbound MailSafe protection are set to quarantine by default. You can customize Inbound MailSafe protection by changing setting of attachment types to Allow, or by adding new attachment types. The ability to customize Inbound MailSafe protection settings is not available in ZoneAlarm. Viewing the Attachments list Attachment types are listed in alphabetical order. You can sort the list by clicking the column header. The arrow (^) next to the header name indicates the sort order. Click the same header again to reverse the sort order. To access the attachments list: Select E-mail Protection, then select Attachments. Figure 7-1: Attachments list Changing the quarantine setting for an attachment type ZoneAlarm security software comes configured with more than 45 attachment types that are capable of carrying worms or other harmful code. By default, ZoneAlarm security software quarantines all of these attachment types. These attachment types are displayed in the attachments list. User Guide for ZoneAlarm security software 126
Slide 145: Chapter 7: E-mail protection Adding and removing attachment types To change the quarantine setting for a specific attachment type: 1. Select E-mail Protection|Attachments. 2. In the Quarantine column, click an extension type. 3. Select Quarantine or Allow, then click Apply. Adding and removing attachment types If you want to quarantine attachments of a type that does not appear on the attachments list, you can add to the list as many unique attachment types as you like. For your protection, ZoneAlarm security software prevents you from removing the default attachment types. However, you can remove any attachment types you may have added. To add an attachment type to the list: 1. Select E-mail Protection|Attachments. 2. Click Add. 3. Type a description and filename extension (with or without the “.” character), then click OK. 4. Click Apply to save your changes. To remove an attachment type from the list: 1. Select E-mail Protection|Attachments. 2. In the Extensions column, right-click an attachment type. 3. Select Remove. User Guide for ZoneAlarm security software 127
Slide 146: Chapter 7: E-mail protection Opening a quarantined attachment Opening a quarantined attachment To view the code of the attachment itself, you can open the attachment in Notepad. For best security, you should never open an e-mail attachment that ZoneAlarm security software has quarantined unless the sender is someone you know and trust, and you have confirmed the sender sent the message intentionally and the sender is sure that the attachment is harmless. To open a quarantined attachment: 1. In Windows Explorer, browse to the file you want to open. 2. Double-click the attachment to open it. 3. When you attempt to open an attachment that has been quarantined, ZoneAlarm security software warns you of the potential risk in opening the attachment. . 4. Click Inspect with Notepad. User Guide for ZoneAlarm security software 128
Slide 147: Chapter 7: E-mail protection Customizing Outbound MailSafe protection Customizing Outbound MailSafe protection By default, an Outbound MailSafe protection alert is displayed when your e-mail application attempts to send more than five e-mail messages within two seconds, or if an e-mail message has more than fifty recipients. You can customize these settings to extend the time interval, increase the number of messages and recipients allowed, or specify the e-mail addresses that are allowed to send e-mail from your computer. Enabling Outbound MailSafe protection by program When Outbound MailSafe protection is set to On, protection is enabled for all programs that have been granted permission to send e-mail. You can customize Outbound MailSafe protection by enabling or disabling it for particular programs. For information on setting permissions for a program, see “Setting permissions for specific programs,” on page 80. To enable or disable Outbound MailSafe protection for a program: 1. Select Program Control|Programs. 2. In the Programs column, right-click a program name, then select Options. 3. Select the Security tab. 4. In the Outbound MailSafe Protection area, select the check box labeled Enable Outbound MailSafe Protection for this program. To disable Outbound MailSafe protection, clear this check box. 5. Click OK. Setting Outbound MailSafe protection options By default, Outbound MailSafe Protection is activated when your computer attempts to send more than five e-mail messages within two seconds, or an e-mail message with more than 50 recipients. Because even legitimate e-mail messages may have one or both of these characteristics, you may want to customize Outbound MailSafe protection settings to better meet your individual needs. To customize Outbound MailSafe protection settings: 1. Select E-mail Protection|Main, then click Advanced. The Advanced E-mail Protection dialog appears. User Guide for ZoneAlarm security software 129
Slide 148: Chapter 7: E-mail protection Setting Outbound MailSafe protection options 2. In the Display Outbound MailSafe Protection Alerts When area, choose your settings. Too many emails are sent at once An Outbound MailSafe protection alert appears when your computer attempts to send more than the specified number of e-mails within the specified time interval. A message has An Outbound MailSafe protection alert appears when your computer too many attempts to send an e-mail message with more than the specified numrecipients ber of recipients. If the sender’s address is not in this list An Outbound MailSafe protection alert appears when your computer attempts to send an e-mail whose originating address (i.e., the address in the From: field) does not appear on the list. To prevent ZoneAlarm security software from blocking all outgoing e-mail, make sure that your valid e-mail address appears on this list. 3. Click OK. User Guide for ZoneAlarm security software 130
Slide 149: Chapter 7: E-mail protection Filtering junk e-mail Filtering junk e-mail The Junk E-mail Filter is available in ZoneAlarm Security Suite. Use the junk e-mail filter to prevent unsolicited junk e-mail (commonly referred to as spam) from cluttering your Inbox. The Junk E-mail filter supports Microsoft Outlook and Outlook Express (both referred to in this document simply as “Outlook”). During installation, ZoneAlarm security software adds the junk e-mail filter toolbar to your Outlook e-mail program’s toolbar. Figure 7-2: The junk e-mail filter toolbar If you have installed ZoneAlarm security software but the junk e-mail filter toolbar does not appear in your Outlook toolbar, right-click in your Outlook toolbar and choose ZoneAlarmOutlookAddin. The junk e-mail filter also adds three special folders to your Outlook folder list: ZoneAlarm Challenged Mail, ZoneAlarm Junk Mail, and ZoneAlarm Fraudulent Mail. When Zone Labs security software identifies an e-mail message as junk, fraudulent, or challenged, it puts the message in one of these folders. If you are using Outlook to access Hotmail, you must use the junk e-mail filter’s spam blocking features and special folders instead of Hotmail’s. Allowing or blocking e-mail from specific senders Each time you send an e-mail to a new person, the junk e-mail filter automatically adds to the Allowed list, the address in the To field. Messages sent to you from those addresses will be put in your Inbox. When you receive an e-mail from a sender on the Blocked list, the junk e-mail filter automatically moves the message to the Outlook folder named ZoneAlarm Junk Mail. If an unwanted e-mail arrives in your Outlook Inbox, you can easily add the sender of that message to your Blocked People list. To add e-mail addresses to your Allowed or Blocked list: 1. In your Outlook or Outlook Express e-mail program, select an e-mail. 2. In the junk e-mail filter toolbar, click ZoneAlarm Options, then choose Allow Sender or Block Sender. User Guide for ZoneAlarm security software 131
Slide 150: Chapter 7: E-mail protection Allowing or blocking e-mail from specific companies Allowing or blocking e-mail from specific companies The junk e-mail filter allows you to add all e-mail addresses originating from a particular company or network domain to your Companies Allowed or Blocked lists. To add companies to your Allowed or Blocked list: 1. In your Outlook or Outlook Express e-mail program, select an e-mail. 2. In the junk e-mail filter toolbar, click ZoneAlarm Options, then choose Allow Sender’s Company or Block Sender’s Company. The junk e-mail filter adds the domain portion of the sender's address (for example, example.com) to the list of allowed or blocked addresses. Adding contacts to the Allowed List You can scan the default contacts folder in your e-mail program to add contacts to the list of senders from whom you wish to receive e-mail. To add contacts to the Allowed List: 1. Open your Outlook or Outlook Express e-mail program. 2. In the junk e-mail filter toolbar, click ZoneAlarm Options, then choose Populate Allowed List. Scanning your Inbox You can scan the contents of your Inbox for fraudulent e-mail and spam. You can use the Scan Inbox option to scan IMAP, POP3, and Hotmail accounts created in Outlook Express, and IMAP, POP3 and Exchange server accounts in Outlook. To scan your Inbox: 1. Open your Outlook or Outlook Express e-mail program. 2. Select the Inbox you want to scan. 3. In the junk e-mail filter toolbar, click ZoneAlarm Options, then choose Scan selected Inbox. Allowing e-mail from distribution lists If you receive or send e-mail to multiple addressees contained in a distribution list, the junk e-mail filter may block that list name unless it has been added to the Lists tab. To allow e-mail from mailing lists: 1. Start your Outlook or Outlook Express e-mail program. 2. In the junk e-mail filter toolbar, click ZoneAlarm Options | Configure Preferences | Lists. 3. Click Add. User Guide for ZoneAlarm security software 132