Object: 8000xxxx in ZoneAlarm Pro.

[engel59]

I'm running Windows XP, Ad-aware Plus 5.83, Norton AntiVirus 2003, and ZoneAlarm Pro 3.5.

I have a program somewhere that is trying to access my local internet. Since I don't know what it is, I just say block it in ZoneAlarm. Another window in ZoneAlarm pops up and asks if I want to allow it to be a server. Again I say block it. A few days later I get the same file again but the name is slightly different. This keeps happening and I don't know what parent program is doing this.

Here are the file names in ZoneAlarm under Program Controls:

Object:80000e17
Object:8000185c
Object:800018bd
Object:80004e46

When you click on one of them and look in the "Entry Detail", all you see is this:
Product name =
File name = Object: 80000e17
Version =
Created date = [invalid date]
File size = 0 KB

If you right mouse click on it a choose Properties, all I get is "The parameter is incorrect".
There is no path to any of these files.

I've search my computer but I can't find a match.
I've done a Google Search.
I even tried contacting ZoneAlarm. They said "do a Google Search".

Is this spyware?
I am running Kazaa Lite, Office XP, Easy CD Creator 5, and other Adobe products as well.
How do I figure out which of the many program is doing this?

Thanks for any help given.

 

[engel59]

Just after I wrote my above post another attempt was made.

Here is what I see when I click on the More Info button when a new program is detected:

Object: 8000547d is trying to connect to the Internet or your local network 

ZoneAlarm Pro is asking you whether to allow the connection. No breach in your security has occurred. Your computer is safe.   Inside the program alert   


 
Alert property		Alert property value			Technical explanation  
Program name		Object: 8000547d			A program running on your computer, which either attempted to send an IP packet over the Internet or is waiting for an incoming packet.  
Filename		Object: 8000547d			The filename of the program that ZoneAlarm Pro found on your computer.  
Program size		0					The size of the program executable file in bytes.  
Program MD5		00000000000000000000000000000000	The MD5 hash, or number, that uniquely identifies the executable.  
Date modified		ff7d8000				The date when Object: 8000547d was most recently modified.  
Connect type		Access					This value can be either Access, which is an Internet connection attempt by Object: 8000547d or Listening (server activity) which indicates that Object: 8000547d is waiting for connections coming in from the Internet.  
Remote Port		1900					The port Object: 8000547d is using on the remote computer.  
Remote IP Address	192.168.1.1				The IP address of the remote computer that caused the alert.  
Alert date		Jan-19-2003 06:16:15 AM GMT		The time when ZoneAlarm Pro detected the alert on your computer.  
  
  

 ZoneAlarm Pro Security enforcement at time of alert   


Program status		New Program				Object: 8000547d is requesting access the Internet or to the local network for the first time.  
Zone			Internet Zone				This ZoneAlarm Pro zone contains all the computers and networks in the world that are connected to the Internet, until you explicitly define them as members of another zone.

 

[engel59]

I finally got another responce from ZoneAlarm after I responded back and said I still have a problem.

This is what they said:

Thank you for contacting Zone Labs. The issue which you reported is
currently a known issue to us. Our engineers are working toward
resolving this. Currently, we plan on this being resolved in our
next release of ZoneAlarm Pro.

In some of the cases, a program may stop working if you deny access
to the "unknown process" and Or Objects XXXXXXX (these usually show the process as trying
to access DNS via port 53). If you deny access and a program stops
working, you may need to shut down and restart that program - then
you will need to allow the access. However, you should NOT check the
box to remember that choice.

Best Regards,

Zone Labs Technical Support