«

ZoneAlarm gets high praise for being a great firewall--but, it has one
glaring weakness. It relies on the user to make choices!!! One wrong
choice and the PC is vulnerable. For example, ZA says Windows Explorer
is trying to access the internet, do you want to allow it? Do you know
why WE is trying to access the internet? Like Internet Explorer, Windows
Explorer is programmable--that's how apps are able to extend its menus
with their own choices. i.e. WinZip adds archiving options on the right
click shortcut menus. The app that is causing ZA to ask the user
permission for Windows Explorer to access the internet may or may not be
legitimate. How does the user make an intelligent decision based on such
a general question?

XP's firewall, on the other hand, works on packets, and as such,
requires much less user involvement.

There was a good review of firewalls within the past year that rated
Windows XP firewall and Trend Micro's PC-cillin as the best of the
bunch. BOTH of these firewalls employ packet filtering techniques,
whereas all the other firewalls tested (ZoneAlarm, Norton, etc.) used
other techniques.

smackedass wrote:
>> First, I ***NEVER*** install Zone-Alarm, Norton's Firewall or Security
>> software (beyond AV) or any other such software. I find that this stuff
>> causes FAR more problems than it is worth.
>
>> The only firewall that I use is the one built into SP2.
>
> Barry,
>
> That's very interesting, and counters what I usually hear. Apart from the
> average user having trouble downloading "forbidden" (but ok) files, knowing
> how to create "exceptions", and, in general, having a working understanding
> of how to manage their own firewall, would you be able to outline your
> thoughts about this matter? Obviously, you have your reasons...
>
> Thanks,
>
> smackedass
>
>

Thanks for that great explanation, Barry!

Barry Watzman wrote:
> The BIOS for Intel processor motherboards contains [or may (usually
> does) contain], for any recognized CPU supported by that motherboard and
> bios, an update / bug fix for the CPU microcode that is loaded on a
> processor / motherboard reset.
>
> In the case of Prescott, there was a bug in the initial microcode which
> Intel gave to the motherboard manufacturers to incorporate into their
> BIOS'. The bug was innocuous until Windows XP SP2 came out, but with
> SP2 it was fairly catastrophic (most systems with that microcode and SP2
> wouldn't boot, or if they did they would be subject to frequent
> lockups). There were a huge number of motherboards made with the bad
> microcode, it was still shipping in new motherboards even when SP2 was
> officially released, and at that point it had been shipping for almost a
> year.
>
> The only way to correct that problem is to update the BIOS with a later
> BIOS that contains the later, corrected microcode. So if you are going
> to use a Prescott CPU with Windows XP SP2, it is fairly important to
> upgrade the BIOS before installing Windows.
>
>
> PPP Does NOT Equal Ping Pong Paddle wrote:
>> Great advice, Barry! I couldn't agree more.
>>
>> I was curious about one thing you said was very important--updating
>> the BIOS for Prescott processors. Can you shed more light on this, or
>> any links to more info?
>>
>> Thanks!
>> John
>>
>>
>> Barry Watzman wrote:
>>
>>> That is not the way I would have proceeded.
>>>
>>> First, I ***NEVER*** install Zone-Alarm, Norton's Firewall or
>>> Security software (beyond AV) or any other such software. I find
>>> that this stuff causes FAR more problems than it is worth.
>>>
>>> How I would have proceeded in your case:
>>>
>>> -Update the BIOS to the latest available. This is VERY important if
>>> you have a Prescott processor.
>>>
>>> -Disconnected from the Internet, install Windws XP SP2 (or an earlier
>>> version and the upgrade to SP2).
>>>
>>> -Connect to the Internet, use Windows Update to fully update the system
>>>
>>> -Install your choice of antivirus software.
>>>
>>> -Install the Microsoft Antispyware software (free, technically still
>>> listed as "beta" software).
>>>
>>> Always operate any computer with a broadband connection behind a
>>> router even if you are not sharing the broadband connection and don't
>>> otherwise need a router.
>>>
>>> The only firewall that I use is the one built into SP2.
>>>
>>>
>>> plazticsoul wrote:
>>>
>>>> Well, Barry, since it seems you know your stuff, maybe you could
>>>> provide
>>>> furthur guidance on a vague conversation I had with my brother after
>>>> returning his PC.
>>>>
>>>> What I ended up doing was installing that critical update followed
>>>> by SP1a,
>>>> rather than 2, as I wanted to simply call it a weekend and wash my
>>>> hands of
>>>> any more SP2 related problems. I informed him that if desired he may
>>>> want
>>>> firewall protection. So he installed ZoneAlarm and it asked to
>>>> reboot. He
>>>> claimed that once it rebooted Windows would not start correctly and
>>>> after a
>>>> few times, he gave up and shut it off. Then later his wife got on
>>>> and was
>>>> able to load XP like normal and now there seems to be no internet
>>>> access. I
>>>> had him first disable and even uninstall the firewall app, restart the
>>>> computer, and still no connection. He indicated that there were those
>>>> blinking monitors on the bottom right of the task bar. I asked him to
>>>> right-click and select "repair". It indicated that it completed
>>>> successfully. Then I asked to go to command prompt and type "ipconfig
>>>> /renew" and it was able to renew the IP address ok. I had him ping
>>>> localhost, and no packets were lost. I then had him ping the default
>>>> gateway, and this was not successful. So I had him release the IP
>>>> configuration and renew it yet again, ending up with the same
>>>> addresses from
>>>> what I understand. Still could not ping the router. Tracert command
>>>> cannot
>>>> resolve anything either. A laptop is also connected to this router
>>>> and the
>>>> internet works. He claims he has reset the router.
>>>>
>>>> Why no internet access? Onboard LAN..... A faulty motherboard could
>>>> explain
>>>> a lot of other "ghosts in the machine" he's had.
>>>>
>>>> If it can successfully renew the IP configuration and if you could
>>>> ping the
>>>> localhost but not the router, and the router is working, then what
>>>> is going
>>>> on?
>>>>
>>>> Jason
>>>> A+, Network+
>>>>
>>>>

Thanks, Adam!

I almost took Barry's advice and installed Microsoft Defender, till I
read your remarks that Defender is constantly scanning the Registry. The
last thing I want is another app grabbing constant processor cycles when
there are better methods of preventing spyware.

If anyone's interested, my approach to blocking/avoiding spyware is:

1. Use Mozilla Firefox and the extensions, NoScript and Ad Block Plus.

2. Use the Spam button in Yahoo, MSN, and other Webmails to help them
create spam filters.

3. Use the Junk button in Mozilla Thunderbird to mark email as junk to
help it build filters.

4. Periodically scan PC with Ad-Aware and SpyBot Search and Destroy to
see what the latest spyware/adware is and how it's being deployed onto
our PCs. (And to see if something slipped on and research how I could
have allowed it on and how I could block it in the future.)

5. I do NOT install 3rd party toolbars, as I've found that most (if not
all) are an excuse to get software on your machine without your explicit
knowledge. In otherwords, they install more than JUST a toolbar--usually
some web tracking and reporting software that violates your privacy.

6. I'm careful what sites I visit and, if in doubt, allow only temporary
javascript execution.

7. I'm careful what cookies I allow (blocking Javascript helps keep
unknown cookies from being placed on PC).

8. Use common sense. Take all warnings with a grain of salt and use the
Hoax sites. I don't pass on those bogus virus warnings and scare tactics
that yahoo's gonna shut off your service if you don't waste bandwidth
and flood everyone on your list with the nonsense warning. LOL
I used to hit, Reply to ALL, when I received hoax emails and sent out a
URL to Symantec and some hoax site to show ppl they've been had, but I
gave up on trying to educate the general public. Now I charge them to
clean the spyware and viruses off of their PCs.

John

==========


Adam Leinss wrote:
> Barry Watzman <> wrote in
> news::
>
>> At this point, you will have a very secure machine that will be
>> quite resistant to infection even if the user engages in "stupid
>> computer tricks". The SP2 built-in firewall + the hardware router
>> will keep out totally unsolicited attacks, while the Antivirus +
>> Antispyware will detect and prevent almost all infections from
>> unsolicited infected E-Mail and visits to malicious web sites.
>
> I would argue that if you are behind a router, the router is acting as
> a firewall and you really do not need a software firewall. That's the
> way I roll any ways (I always turn off the SP2 firewall).
>
> Also...I have problems with Microsoft Defender. I found the Spyware
> Blaster approach of loading the GUIDs of bad ActiveX controls and sites
> into the registry much less resource intensive then Defender (since
> Defender is just another product from GIANT software that MS bought
> out). If you load Regmon, you'll see Defender constantly checking
> certain registry keys for changes instead of using registry
> notification functions which are much less resource intensive.
>
> Finally, in the corporate environment, Defender really don't work.
> When I try to deploy VNC remotely to workstations via WSH, Microsoft
> Defender blocks this. Seems to do more harm then good.
>
> Adam

Mark Mandell wrote:
> "Barry Watzman" <> wrote in message
> news:Id4If.79856$. ..
>
>>That is not the way I would have proceeded.
>>
>>First, I ***NEVER*** install Zone-Alarm, Norton's Firewall or Security
>>software (beyond AV) or any other such software. I find that this stuff
>>causes FAR more problems than it is worth.
>
>
> This might be true for the items you mention but some time back when I had
> another computer I had both the SP2 and Sygate firewall with no problems at
> all. But now I have Zonealarm on Win98 on a dual boot which is not at all
> problematic since there's no SP2 with that.
>
>>How I would have proceeded in your case:
>>
>>-Update the BIOS to the latest available. This is VERY important if you
>>have a Prescott processor.
>>
>>-Disconnected from the Internet, install Windws XP SP2 (or an earlier
>>version and the upgrade to SP2).
>>
>>-Connect to the Internet, use Windows Update to fully update the system
>>
>>-Install your choice of antivirus software.
>>
>>-Install the Microsoft Antispyware software (free, technically still
>>listed as "beta" software).
>>
>>Always operate any computer with a broadband connection behind a router
>>even if you are not sharing the broadband connection and don't otherwise
>>need a router.
>>
>>The only firewall that I use is the one built into SP2.
>>
>>
>>plazticsoul wrote:
>>
>>
>>>Well, Barry, since it seems you know your stuff, maybe you could provide
>>>furthur guidance on a vague conversation I had with my brother after
>>>returning his PC.
>>>
>>>What I ended up doing was installing that critical update followed by
>>>SP1a,
>>>rather than 2, as I wanted to simply call it a weekend and wash my hands
>>>of
>>>any more SP2 related problems. I informed him that if desired he may want
>>>firewall protection. So he installed ZoneAlarm and it asked to reboot. He
>>>claimed that once it rebooted Windows would not start correctly and after
>>>a
>>>few times, he gave up and shut it off. Then later his wife got on and was
>>>able to load XP like normal and now there seems to be no internet access.
>>>I
>>>had him first disable and even uninstall the firewall app, restart the
>>>computer, and still no connection. He indicated that there were those
>>>blinking monitors on the bottom right of the task bar. I asked him to
>>>right-click and select "repair". It indicated that it completed
>>>successfully. Then I asked to go to command prompt and type "ipconfig
>>>/renew" and it was able to renew the IP address ok. I had him ping
>>>localhost, and no packets were lost. I then had him ping the default
>>>gateway, and this was not successful. So I had him release the IP
>>>configuration and renew it yet again, ending up with the same addresses
>>>from
>>>what I understand. Still could not ping the router. Tracert command
>>>cannot
>>>resolve anything either. A laptop is also connected to this router and
>>>the
>>>internet works. He claims he has reset the router.
>>>
>>>Why no internet access? Onboard LAN..... A faulty motherboard could
>>>explain
>>>a lot of other "ghosts in the machine" he's had.
>>>
>>>If it can successfully renew the IP configuration and if you could ping
>>>the
>>>localhost but not the router, and the router is working, then what is
>>>going
>>>on?
>>>
>>>Jason
>>>A+, Network+
>>>
>
>

From my experience, the router acts as a hardware firewall to outside
traffic but not between the computers connected to it. Within that small
workgroup of PCs all connected to the same router, the software firewall
keeps the computers from freely accessing each other.

I use a software firewall on the home office PC to keep my business
records safe from intrusion via a recreational computer in the house (on
the same router).

Put a Windows PC and a Linux PC on the same router. Try to connect to
the Windows PC via SAMBA and you most likely won't be able to. But
disable the firewall on the Linux PC and BINGO!, there's the Windows PC.
Both are behind the same router and both test as stealth by Steve
Gibson's ShieldsUP tests.