Beware of ZoneAlarm!

I began helping in on-line forums almost eight years ago. The most common advice provided was to install a firewall. The most commonly recommended firewall was ZoneAlarm. As a result, ZoneAlarm became a trusted and well known application, much of that reputation having been built by the free advertisement in those forum postings.

Well, folks, times have changed. The once highly trusted ZoneAlarm has betrayed that trust. Today, if you install ZoneAlarm Free, this is what you are presented with, a pre-checked option to install ZoneAlarm Spy Blocker.



So, what is the average computer user to think when (and if) they see this? They will be expecting a ZoneAlarm add-on that will provide their computer with additional security protection. After all, the wording specifically references ZoneAlarm Spy Blocker as a toolbar. This is a security feature, right? Of course they click the Next button.

The installation is completed and the computer user launches their browser and discovers


that the ZoneAlarm SpyBlocker comes in the form of the Ask Toolbar!

Read what noted researcher Ben Edelman had to say in his analysis of Ask Toolbars ine "Current Practices of IAC/Ask Toolbars".

Search the CastleCops CLSID list for {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} and you will see that ZoneAlarm SpyBlocker has the identical entry to that of the Ask Toolbar.

OBJECT NAME	GUID	STATUS	FILENAME
Ask Toolbar BHO*	{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}	O BHO	ASKSBAR.DLL
ZoneAlarm Spy Blocker BHO*	{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}	O BHO	SPYBLOCK.DLL

DESCRIPTION

Ask_Toolbar - see this_note

ZoneAlarm Spy Blocker Toolbar, now installed as an optional with Zonealarm. Uses the Ask.com searchengine. More info here - also see this_note

Ask yourself why ZoneAlarm hid the fact that it was the Ask Toolbar that was being installed. Here's the most likely answer -- pay per install. Yes, I suspect that ZoneAlarm is being paid by Ask or their affiliates for each and every install of their nefarious toolbar.

I have added a warning to the listing of Vista Compatible Firewalls in Windows Vista Bookmarks and I can no longer consider ZoneAlarm a recommended software. ZoneAlarm has followed down a similar rocky path as Webroot Spy Sweeper.

References:

• Certified Bug (Tashi): ZoneAlarm pre-checks toolbar
• Donna's Security Flash: Zone Labs added Spy Blocker toolbar on its ZoneAlarm Free firewall
• SunbeltBLOG: Another security company succumbs to temptation
• The SpyKiller (Derek): Beware of Zone Alarm Updates
• ZoneAlarm Change Log (See v7.0.462.000)

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...