BleepingComputer.com: Zonealarm Question

carried out a system restore in safe mode to fix not being able to access My computer, Windows explorer, etc. This seemed to work, however upon restarting in normal mode noticed that Zonealarm security suite was not launching at start-up like it normally does. Tried to launch it from the 'all programs' menu but no go. I think it is trying to launch itself at start-up cos after the desktop & icons appear the the egg-timer icon next to the arrow cursor keeps blinks on & off. So, i thought i would just reinstall the Zonealarm program, don't have it on cd but do have the latest up-date in a download folder. When i tried to install it the install box came up and started to run, then i got a fault box appearing that stated 'Setup is unable to log into the TrueVector service. Install cannot continue without logging into the TrueVector service. Please use the service manager to shut down the TrueVector service and then restart the installer program' TrueVector is the main conmponent of security feature of Zonealarm, according to the Help section. As Zonealarm is not open so i can't get into it to close down the TrueVector service.

Any advice on how to fix this?

It appears that vsmon is running, but the client is not. To reinstall, ZA needs to shut down the the TV service.
TrueVector aka vsmon.exe is indeed part of ZA and it runs as a service. Obviously it got disconnected from ZA client for some reason and if you can't run ZA, you can't shut it down properly from GUI.

Have you tried clean install by first doing uninstall precisely as described here
http://www.nohold.net/noHoldCust25/Prod_1/...an_install.html
It really is absolutely the best method, the official one, and it works.

Now, considering that this is the message you got

"mskdownload" said:

While I'm not 100% sure what they mean by "service manager", the way I would go at stopping the service, and reinstallation is:
Download the current version, save it.
Disconnect from the internet.
Start > Settings > Control Panel > Admin tools > Services
Now be careful.
Click on the Name column to get it in alphabetical order. Find True Vector Internet Monitor service.
Select it and then Right click to get to Properties. make sure you're on the right service.
Is the Stop button enabled? If it is, press it to Stop the service. Check Task Manager to see is vsmon.exe is still running. Give it time to stop, it needs time to write files.
Now I'm guessing:
If the Stop button is not enabled, try to change Startup type to perhaps Disabled - and I guess reboot, so it stays disabled. Manual followed by Stop might work too. Reinstallation should correct all that.
Install new version.

Can you try system restore to some other previous point? That might put things together again, as your ZA got clobbered. If System Restore save point is from Normal mode and you restored it in safe mode, I wonder if that can cause such problems, but I don't know.

If above fails, if ZA is really in a big trouble, read EVERY word and follow EVERY step from these instructions posted by the Zone Labs Forum moderator
http://forum.zonelabs.org/zonelabs/board/m...;message.id=103

He even mentions there a situation where you lost the icon - as seems to be the case here.

many thanks for your advice, tos 226, will try it tonight.

re vsmon running, i forgot to mention i opened Windows task manager to see if i could close TrueVector there. Under the applications tab no sign of Zonealarm. However under the Processes tab i could see vsmon.exc appearing & disappearing every few seconds and if i switched to the Performance tab there was a flucuating CPU & PF usage from 0 to 60 - 80%. Tried to hi-light it to end the process but couldn't succeed.

btw under the Processes tab i could also see mm-tray.exc blinking on & off every few seconds. Is this anything to do with TrueVector/zonealarm?

when I attemp to reinstall Zonealarm tonight, does this set-up need to connect to the internet? i mention this cos i have exceeded my monthly download limit and have the speed greatly reduced till the end of the month.

mskdownload, on Sep 24 2006, 11:50 PM, said:

Does not sound good at all.

Quote

You SHOULD NOT attempt to CLOSE (end) True Vector service in Task Manager. The message you got, clearly, said to shut down the SERVICE. Close the SERVICE through control panel (see the steps I listed earlier). Use Task Manager to look that it has shut down.

Quote

NO.
I googled. It's some sort of music jukebox component. It could be trying to kill ZA. I don't know.

Quote

Internet connection - as the help links I showed you point out, and if they don't I did - you should disconnect from the internet for the installation time especially if you do not now have a router to protect you. Once ZA is installed and running propertly, connect the internet, and immediately run the updates for the virus definitions.

Since you were trying to reinstall once, I'm assuming you already have some recent (6.1, 6.5) version on your computer. If you got it from the Zone Labs site, it should be intact and OK. If it's clobbered in some way, well, then it's a whole different story.

Are you using dial-up? Do you have a router?

Good luck. But if what I gave you so far fails, I think you will need Expert help here, likely of the malware removal sort. I hope someone will jump in.

tos226, on Sep 25 2006, 02:50 PM, said:

I suspect you have a Dell computer and that usually you have a purple colored long slightly curved icon in your system tray which is the icon for mm-tray which has no affect on ZoneAlarm, but it doesn't need to load at start-up either. It sounds as though something is affecting both ZoneAlarm and the Jukebox thingy. Since both mm-tray and ZoneAlarm are related to start-up, it sounds as if something is affecting your computer's start-up programs or that both programs have been corrupted in some way.

The fluctuating CPU is probably linked to the fact that the computer is trying to load these programs - high CPU then quits trying or thinks is loaded - low CPU, then tries again to load it again- high CPU usage and on in a never-ending loop. This phenonemon is related to the flickering processes you see in taskmanager.

last night i carried out a system restore in normal mode as you suggested, Tos 226. It worked! Zonealarm loads as before at start up, its the 6.5 upgrade, all my previous settings are intact, very happy & relieved. Hope it stays that way.

I have a generic computer, not a brand, my internet connection is broadband cable. Re the mm_tray i think it is a music jukebox thingy, probably downloaded by my teenage daughter. Will have try & find it via Windows add or remove program and take it out.

Many thanks to you both for your advice & insights. I pretty sure there is malware affecting my computer (thanks teenage daughter) so I will do a post in the Hijack this section of the forum. Will have to wait until i return from a trip to the States, my first time visit, in mid October.