RE:A Question (For Mac56)

Hi Mac,

I see you are having problems understanding Zone alarm and it's warning messages. Yes this can be a little of a pain for some users who don't fully understand or trust the warning messages if we get too many sometimes. We beggin to worry.

But here are a few tips for you about Zone Alarm...

I am asuming that you are using the latest Zone Alarm software,wich is Zone Alarm Pro 2.6.84

From what I saw in your post of the information of the IP address on the user you said that was scanning you I am not sure if they
have scanned you more than one to three times or even more.
this is the BIG TIP that the person is FULLY scanning you for open ports and/or trying to break into your computer.

A single scan from a host or IP address does not mean that they
are trying to get into your computer.Most web sites that you visit
will scan you to verify who you are, who your host is and to verify
your OWN IP address just as Zone Alarm scanned THEM to verify
their IP address and who they are...this is normal and is really nothing to fear.

However, It also depends WHAT web site you are visiting or are you using a CHAT program during the time you were scanned?
Were you using MSN Chat? or ICQ? and how do you have your Zone Alarm security settings configured. are the settings on high? Medeum or low? Do you have it set to block certain things such as
routers and CT/CP packets and so on ( click on the Zone Alarm help to get help on how to set up Zone Alarm and configure it to how you wish for it to work or what to block and not block and so on) I keep my Zone Alarm set to HIGH security at all times, but not everyone can do this for some reason. Setting things too high and you can block your local ISP and be unable to connect to the internet at all.However with Zone Alarm Pro it is supose to help you configure it so as not cause this problem


You also have to look at if the IP address that Zone Alarm has found belongs to that HOST, since we have what is called IP Spoofing or IPMaqurading ( we hide our REAL IP address and other users see a different IP Address than what it's supose to be),...

Err.. this is another subject...let's stick to configuring zone Alarm....LOL)


So all in all for your problem when Zone Alarm sends you a message that it has blocked access to your computer from another user or web site and you do not trust this scan,then open ZOne Alarm, Click on the word SECURITY, then look for the word--->ADVANCE and click on the word advance. IN the advance Options
look for the Options called -----> RESTRICTED ZONE

In the resticted Zone options look for the word----> ADD and click to add either IP address, host/site , IP Range , Subnet

I always use IP address.Because as I stated, alot of people HIDE their original address or host name and use a diffrent IP address.
I may have to add them over & over again if they change their IP address, but I also will avoid blocking users or another computer that I DO wish to connnect to my computer.

( If you want to Download a software from let's say Yahoo.com
or send me a file over MSN messenger and you set zone alarm to BLOCk my whole HOST or my IP address, then I can't get the file because I am restricted from connecting to your computer.Or you are blocking MSN messenger software from connecting.So it's a little best to just block that ONE IP address that you think is as threat.

Pick ------> IP address , and copy down the IP numbers that Zone Alarm showed you in the warning message box and then add it
in the two lines where a box should open for you after you click
on the word IP address to resict this address from your computer.

If the IP address was----> 108.99.266
then on first line add that IP address if you wish or after getting more information from zone Alarm on the IP address, add the HOST NAME in this box to let you remeber WHO this is.

In the second box add the IP numbers
You will notice that there are DOTS in this box and that when you add the IP numbers it will only allow you to add a certain amount of numbers to each box. If you do not add the numbers in the box correctly then you will not block the user that you wish blocked.

First Line:108.99.266
Second Line:108.99.266

OR
First Line:mIRC user/hacker
Second Line:108.99.266

Once you have added the IP address that you wished blocked,
Click the OK button and save your settings and you may resume doing what ever.

NOTE: Even though you have Blocked a restricted address, you will STILL get a warning notice from Zome Alarm stating that it has blocked such and such from your computer on port bla bla bla.
But the message will be a little Different this time.

This time the Alert message should also state that it has blocked
access to your computer from a RESTRICT SITE or RESTRICTED ADDRESS: ( this is how you can tell the same IP address scanned you again) you also know that you are SAFE , For Zone Alarm said-------> RESTRICTED , and you have successfully blocked
the IP address that you stated for Zone Alarm to block.

Just try to take note... Do not block everything just because Zone Alarm gave you a warning. Some scans are just routers or as I said earleir above, it is a web site scanning you to verify who YOU are. if your chatting at the time or using a chat software such as mIRC or MSN chat, then expect to be scanned by thier servers as well.

there are alot fo reasons for getting scan reports and why they are done. it is hard to at times. I just keep in mind these steps that I wrote above and also configure my firewall as best as I can and keep monitor of things. try to not let just any program pass through the firewall unless you know it is SAFE. If a hacker hacks into your MSN messenger somehow or through ICQ and you have ICQ set to bypass the Zone Alarm's Lock, then WHAM, they can get in your computer by using ICQ and thier ICQ hacking tool(s)

Well, all I can really say for now.. think I over did it here, but was just trying to help as much as I can.. feel free to contact me anytime.


P.S ( uh ohh.. there goes my firewall..LOL)