Firewall testing [Avast Hijacking]?

General Topics
1

I have been testing out the Sygate Personal Firewall 5.6 today and I have a question about one thing found in a report.

In the Sygate Security Log is this message:
Application Hijacking has been detected
The application: C:\Program Files\Alwil Software\Avast4\ashServ.exe try to launch another application: C:\Program Files\Alwil Software\Avast4\Setup\avast.setup to go to remote host download2.avast.com

Is http://download2.avast.com/ legit? I thought the Avast site is http://www.avast.com/

a61

2

download2 is just one of the servers used by Avast to get updates from. (as you can see in servers.def)

3

OK, Thanks Eddy :slight_smile:
a61

PS: I see 14 of them buggers in the list!

4

You can find the valid set of download avast servers in the servers.def file in avast4\Setup directory :wink:

Pavel

5

a61
That’s a pretty scary message from Sygate. What do they use when there’s a real problem???

6

I don’t know about scary, but it made me wonder :slight_smile:

Before I had SP2 I was using Outpost and loved it. Since the free version doesn’t work with SP2 I’ve been just using the router and the XP firewall. I guess ZA free doesn’t work with avast, or at least people are having problems with it, so I decided to try the Sygate Personal Firewall. So far it’s pretty good, just have to spend some time with the help files to learn more. I took it for a spin at the different scanning sites and it passes, but then I have to figure the router is on to.

a61

7

a61:

I guess ZA free doesn't work with avast, or at least people are having problems with it
Not that I know of. I use ZA Pro and love it and as far as I know the engine is the same in both versions.
8

From the post I have read in the Avast forum there is a problem with ZA and Avast. Maybe the Pro version is ok.

a61

9

a61
If what you have is working for you, keep it but, don’t believe everything you read in the funny papers. ;D ;D

10

I was trying to find the post made by VLK where he said there seems to be a problem with Avast and ZA and they would be checking on it , or someting on that order. I don’t remember when I read it.

I have used ZA about 3 years ago and had problems with it…but that was 3 years ago so it doesn’t mean much. I know ZA is recommended by many people, but I really did like Outpost the best of all the ones I tried, but the free version just doesn’t work with SP2. So now I’m just trying Sygate out to see if it’s going to work for me without causing problems (I’m still leary of ZA). So far it seems simple to setup and use. If it causes my problems then it’s gonna go bye bye ;D

a61

11

Odd, I never saw sygate telling me that they’ve upgraded to version 5.6 :frowning:

12

Running ZA and Avast for years on one of my systems, no problem at all.

13

Sygate gives the Application Hijacking message whenever an application is launched by another application without the direct request of the user (if the launches application tries to access the net). In almost every circumstance there is a legitimate reason for the situation as in this case, but I’d rather put up with these false warning messages than miss a real security risk.

14

a61
The only problem With ZA occurred when they first
came out with V5.0. But that was resolved and there’s
never been a problem since.

15

But it’s still hugest system hog of all software firewalls… like Norton is in antivirus world :slight_smile:

16

ZA (pro) is not slowing down anything at all on my system. In the past I have tried Kerio and Outpost on the same system with the same things installed/running. No difference in speed at all. Not noticibly nor measured.

17

Sorry Sasha
I have to disagree with you on that statement.
Just take a look:

18

But Bob, I still don’t believe that’s the only one service ran by ZoneAlarm in your task manager. There must be few others in there. I’ve heard some vsmon.exe process is taking up a whopping 90% of processor usage sometime, and that process comes from ZoneAlarm, not from some other firewall…

19

Only zapro.exe and vsmon.exe running with my version of ZA. Both 0% cpu usage with vsmon.exe some times going to 2% when there is much traffic.

zapro.exe 3372Kb
vsmon.exe 5916Kb

20

Well, let’s count:

  • 3916 Kb by zlclient.exe
  • 3372 Kb by zapro.exe
  • 5916 Kb by vsmon.exe

Total: 13204 Kb

Much more than initial 3916 by zlclient.exe that Bob mentioned…