Internet, Web, E-mail security update.
Regular readers will know that we take Internet, web and e-mail
security seriously and have always used ZoneAlarm, Norton
Anti-virus and AdSubtract. This way in the past we have been able
to stop our computers from being attacked and infected. BUT.
Things change.
The other day we were going over one of our computers and found in
the Windows Internet Logs folder a file that we had never seen
before and was growing at an alarming rate. We used all our skills
and knowledge to delete it and stop it from working. We eventually
tracked this growing file down to belonging to ZoneAlarm. If you
use ZoneAlarm then look at the 'IAMDB.RDB' and there is even a back
up for it there as well. Wonderful we say.
After browsing the web to see if anybody else knew anything about
this file we found this:
"It seems that ZA comes with two spy dlls that according to the
their manufacturer "utilizes its patented metering methodology to
measure actual Internet and digital media audience user behaviour
in real-time - click-by-click, page-by-page,
second-by-second."
I found these two:
C:\WINDOWS\SYSTEM\VSMONAPI.DLL
C:\WINDOWS\SYSTEM\VSUTIL.DLL
Had been left on my system after uninstalling ZA. It seems that
your system configuration and maybe the activity is logged to the
file Iamdb.rbd, then transmitted. This discussion also implicates
Steve Gibson of Grc/ShieldsUp/Opout in this as well."
These were new to us but we knew that some program or other was
continually accessing the web while our computers were on but as
ZoneAlarm did not say it was anything suspicious and we just
assumed it was one of our security programs checking for a new
version or whatever we did not worry much, as one would.
But it did annoy us that it seemed to be going on continually and
should not. Thus we started searching to find out what was
happening and why which is why we found the IAMDB.RDB file and that
it was growing at an alarming rate. There always was a ZoneAlarm
file in the past that grew but that was easy to replace
every-so-often with a blank file. But not this.
Bear in mind that we use the paid for Pro version and not the free
version that one might expect some checking which would be
reasonable, but not if you have been a loyal paying customer for
years.
Thus we have e-mailed ZoneAlarm twice now and eventually got an
automated reply back saying they will get in touch with us in a
couple of days. We have told them in no uncertain words that we
will publish our findings as this policy of ZoneAlarm spying on
peoples computers is totally unacceptable.
We have now tried using another firewall software called Sygate
Personal Firewall which is free. There is a paid for version but as
you can appreciate at first we are trying the free version to see
what we think of it and to see if it works.
Well. Now we have a free firewall blocking the spying activities of
a paid for firewall. Can you believe that. We can also say that the
Sygate Firewall is working and stopping ZoneAlarm from phoning home
all the time with our private and confidential computer use
data.
WTF, It's true after I uninstall ZoneAlarm I found the files were
left behind, and I deleted them.
So, be sure to delete these files
