Re: ZoneAlarm 5.1.011 is trashing attachments in downloaded newsgroup postings

From: Gerrit Scholten (ggj.DIEscholten_at_SPAMMERworldonline.DIEnl)
Date: 08/22/04 

Date: Sun, 22 Aug 2004 18:10:15 +0200

Michael wrote:

> Gerrit Scholten wrote:
>
>> Hello,
>>
>> I've run into a problem with ZoneAlarm (version 5.1.011) and Netscape
>> 7.1 newsreader. When I download newsgroup postings, *all* attachments
>> in these postings are trashed by ZoneAlarm. When I look in a posting
>> that has e.g. a screenprint as attachment, I can read the postings
>> text, but the screenprint is replaced by the Netscape 'unavailable
>> image' icon. And when a posting has e.g. logfiles as attachments, I
>> can see the filenames in the newreader attachments list, but I can't
>> open or save the attachments.
>> When I look in the ZoneAlarm logfiles (Alerts & Logs|Log Viewer,
>> select 'Program' in the select box labelled 'Alert Type'), I find
>> scores of entries that read:
>> Description=Renamed e-mail attachment <old_name> to <new_name>.
>> Rating=medium
>> Type=MailSafe
>> Program=Netscp.exe
>> Direction=Incoming
>> Action Taken=Quarantined
>> Source DNS=news.worldonline.nl
>>
>> According to the ZoneAlarm helpfile, when quarantining an attachment
>> it only changes the extension of the attachment, see helpfile text:
>> <quote>
>> Changing the filename extension quarantines the attachment by keeping
>> it from running automatically. When you open the e-mail containing
>> the attachment, Zone Labs security software displays a MailSafe alert
>> to let you know that it has quarantined the attachment. If you try to
>> open the attachment, an alert warns you of the potential risk
>> involved. However, you are still able to open the attachment if you
>> are sure that it is safe.
>> </quote>
>>
>> When I open the newspost, I don't get the MailSafe alert, so I can't
>> open the attachments.
>>
>> I have set the option 'Basic MailSafe Settings' to 'Off', so ZA
>> shouldn't quarantine attachments at all.
>>
>>
>> Question: Does anybody know how to correct this unwanted behaviour
>> in ZoneAlarm 5.1.011 (reinstalling ZA 4.5 is workaround, not a
>> solution) ?
>>
>>
>> regards, Gerrit Scholten
>
>
> Hello Gerrit,
>
> In ZoneAlarm open the console and click on E-Mail Protection, then
> select the tab Attachments. Change the state of each mail attachment
> extension you want ZoneAlarm to pass to your e-mail client. Be
> advised that you will not be protected from those types of virus
> attachments when you change the state.
>
> Michael

Hello Michael,

thank you for your answer. Problem is, I had this problem with ZA free,
and the Attachments tab is only available in ZA Professional. I found
the reference to this attachments tab in the ZA helpfile, but the
helpfile didn't tell me about the Attachments tab being a ZAP feature.
I uninstalled ZA free, and reinstalled it. Problem still there.
Next trail & error action: I activated the ZAP 15-days trial. Now I've
access to this Attachments tab. I unchecked *all* extensions. Problem gone.

What I don't know (yet) is what will happen when the 15-days trial ends
and ZAP changes back to ZA free.

What this ZA feature does is changing the extensions of 'suspect'
attachments in different extensions, so the attachments don't launch
automatically and can only be opened when you and use ZA and indicate
(in the presented dialog) that you really really want to open / execute
the attachment.

One important note: I don't like programs to change the content of my
emails or newsgroup postings. When the content is changed, any
email/posting which has a digital signature will start of alerts because
the content has changed. Worse, you can only acces the attachments when
you continue to use ZA - talking about vendor lock-in. If I wanted to
use another firewall, or wanted to migrate to another OS (Linux ?), then
I couldn't access the attachments in old emails / newsgroup postings
anymore - suck suck suck. I do not dislike this ZA feature, I hate it.
Protecting users against malicious attachments should be done by
antivirus software, not by a firewall.

Gerrit

Relevant Pages

  • Re: OT: graphics in newsgroups
    ... attachments, that would be about 1Mb of data. ... You may only read a few newsgroup postings but an ISP may be storing posts for 60,000+ newsgroups. ... ISPs who still have news servers are spending fortunes attempting to keep pace with the exponential growth of newsgroup postings. ...
    (uk.tech.digital-tv)
  • Re: My Message To Mr. John Eddy
    ... the members exceed the limitations ... participating in the Group due to the limitations on the size of postings; ... attachments, but the OE Stationery Newsgroup seldom uses attachments. ... I even refer to myself as "Neophyte;" which I am. :-) ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress.stationery)
  • Re: My Message To Mr. John Eddy
    ... In response to the Adriana and Robbie postings relative to the issue of loss of members and the possible demise of this NG, ... technical questions relative to use of computers and Microsoft operating systems platforms. ... were being introduced into some News Groups via attachments, but the OE Stationery Newsgroup seldom uses attachments. ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress.stationery)
  • Re: Dateianlagen Speichern
    ... Newsgroup. ... wie man an die Binär Daten der Attachments ... Keine E-Mails auf Postings in NGs senden! ...
    (microsoft.public.de.access.clientserver)
  • Re: Attachments & inline images stripped off
    ... Since then I cannot receive attachments and in-line images. ... ZoneAlarm's purpose is to randomly cripple your network functionality. ... so ZoneAlarm actually protected you from using OE by chance? ... get to my email program. ...
    (comp.security.firewalls)