ZoneAlarm 3.1.395 Alerts!!

Can anyone Explain to me Please as to Why this Version of ZoneAlarm is giveing me so many Alerts its Ruddy Rediculus.....
Especially tonight! I got 20 Alerts for same thing which I,ve never had before.....
"High - UDP - Incoming - Blocked - Destination - DNS - DENNISR"...
DENNISR being me, and it refers to my pbase.com/dennisr (photo forum).. Why are peeps trying to get into my comp here at home from all over the ruddy world to get access to my photos when they can do that on pbase.com ....of course access is denied by zoney.....Never had this before folks, so why now.......???!!!!
Protocol is mostly UDP but 4 are TCP (flag:S) Please explain this too me someone before I go Boom Boom...
regards, Dennis

HELLO!! Does anyone know the answer Please.......
Its doing my head in...Me thinks this ZoneAlarm is Buggy....

So for Once The Brains of VirtualDR are Stumped....That makes a change I suppose.....

Hi.. I'm a little confused about what zonealarm is showing you.

From what I gather you have a website with some photos at pbase.com. But how exactly is that referenced in the probes on your computer? What is the exact message?

You say that DENNISR is part your website page address but is it also your home computer name?

Are you by any chance running a hosts file? If so,could be it's blocking your site url and ZA thinks it's a ping...

It is possible that before Zone Alarm was blocking what it was supposed to but that you did not know that if you had notification turned off.

Go into the ZA control panel and turn off the notify feature.

Doc

http://forums.zonelabs.com/zonelabs

Thanks All for your replies...It's nothing that i've changed, it's been doing it since i upgraded...I geuss I should stick to my own policies, 'don't upgrade if all is working ok in first place'....
I'll plod on till I find the solution....Thanks All..

For the life of me I am Stumped......Are You Stumped on this one??
"Source DNS" are from all over the world,even from places i never new existed...."Destination DNS" should be my ISP >>>>
pc2-cwma1-3-cust, BUT on occassions its this "Destination DNS" DENNISR...<thats my name, why should ZoneAlarm be putting my name in capital letters in the "DESTINATION DNS"
Any Answers ANYONE!!!!.......2000 alerts stoped incomeing n outgoing..Incoming mostly...Is this New ZoneAlarm Crap??

Is your computer name DENNISR? Is that the name you have to type in when you boot your computer?

If so then that's merely being substituted for your local IP address. (It wouldn't be your ISP's address but a variation of it that makes it your unique net address) Is the alarm alert level set the same as it was with your previous version of ZA?

Are you connected via dial up/ADLS/static IP/Dynamic IP etc ?

Have you done a check to see what applications you have connecting to the internet at the time?

Are you running P2P file sharing software as it could be several people who still have your IP in there address stack?

Are you running any communications software ?

I'm connected via NTL Cable...Was useing Winmx before xmas, not useing any shareing progys at moment......Then there was NO reference to DENNISR.....Computer is called something else. wont say here......!!!
Printer shareing is Dissabled.....I am a member of a few Photo groups within MSN...Webshots, pbase.com, dpreview.com...
On two of them I am known as DennisR...
Got DENNISR.ldb in my Internet log, and DENNISRU.PWL in Windows, stumped on them two unless they are to do with the Photo groups i'm in..Anyone know if thats correct?
This is the 5th problem i have had this year, solved 3 thanks to the Good Peeps in virtualdr, but this Zoney and my Printer is doing my head in....Still learning, got lots more learning to do....
Over to you Brainy Lot...................regards, Dennis...

It's Zonealarm that's identifying your computer in its logs/alerts as DENNISR not anyone that's probing you. Why exactly I'm not sure. Usually, as I said, it would be identified as your IP address or official computer name. Since your PWlist is called DENNISR then that would indicate that something in your PC is identified with that user name. Maybe you have your PC setup to run under more than one identity? Can you login with the name DENNISR?

Have a look and see what your computer (and workgroup) is called in your cable networking setup... control panel>networking

Hi fink, SILLY ME......just rechecked Computer name..It IS DENNISR
I must of changed it without thinking.
But Zony has never put my Computer name in before, so why would "DENNISR" be in the "Destination DNS" of ZoneAlarm..
Plus I've had 1982 HighRated Intrusions, ALL Incoming...This is a few of many tonight........FWIN,2003/01/23,22:09:52 +0:00 GMT,200.71.206.114:5040,my ip,UDP
FWIN,2003/01/23,22:17:10 +0:00 GMT,200.34.165.148:4096,my ip,UDP
FWIN,2003/01/23,22:23:18 +0:00 GMT,216.26.155.212:1028,my ip,UDP
What is FWIN!!??
Thanks Dennis...

In your first post you say "this version" do I take it you just upgraded to a newer ver?

I would assume, since I've seen other firewalls do it, that it's just a customization to the new one that tells it to refer to your PC by its name rather than your IP.. There really is no difference.

Does ZA allow you to print or copy the full alert? If so copy out a couple of them in entirety and post them here.


FWIN- "FWIN indicates that the firewall blocked an incoming request to connect to your computer."

presumeabley short for FireWall IN

from- http://www.fantookh.com/beginner/Zon...LogSamples.htm

Also.. is it possible that the default alert level changed when you upgraded? You may have been getting these hits all along, which wouldn't surprise me at all, but they weren't being reported.

Bottom line for now is that ZA is blocking them. Network traffic and probes are very common on the internet especially cable. I used to get hundreds of hits a day but realized after a short while that it's just part of life on the internet and turned off the warnings on my firewall. Outgoing alarms would be another story.. they would be more worrying since something on your computer is trying to send out a message... often an indication of a trojan or worm.

You may also want to have a look at this little program.. it analyzes zonealarm logs and tries to separate noise from attacks..

http://zonelog.co.uk/

It says it's $10 us but I'm not sure if it has a trial period or not.

Thanks fink, for your kind Help and Explanation...Things are a bit more clearer after that...Gona redo this comp over weekend, WinME is gona have its last chance n Zony is gona be set properly...If WinME gos Loopy just once, it'll be Bye Bye n Hello XP Pro...
Catch ya Soon when I get next Problem...LOL....
regards, Dennis...

You mention that you have broadband. Did you get it recently?
Are you using a router by chance?
I had a similar problem when I first went to cable with zone alarm. It actually was not zone alarms fault. I had my Linksys router set to use Nat. I also had logging set up so that it kept sending all inbound info to SMTP trap and zone alarm would show it in its alert file. I turned ogg logging in the router and zone alarm was happy. By the way all those alerts sent from the router were port scans and the like from the internet. I would get around
2000 in a six hour period. Both the router and zone alarm were doing there job, I just had to set things up a bit different.

NODULAR

Shot in the dark here...

I just visited your site and NONE of the images come up for me; I just see all those little red "x"s all over the page. Looking at the properties for those images, and at the source code of your site, I see all sorts of subdomains and such referring to the location of these images. Is there any way, with the huge number of images, thumbnails, etc that you have on the site, plus all the different domains you're pointing to, that somehow, somewhere, you managed to have something call back to your development machine?

Like I said, shot in the dark.