Greetings All,

This is not so much a problem … just something I'm puzzled about.

Last week, I was asked by a friend to set up a wireless home network for her.
She has a newish Windows XP Pro desktop computer that she exclusively used, plus 2 older, unused desktop computers with XP Home that were well out-of-date and also had a variety of malware on both of them.

I cleaned her 2 older PCs (2 & 3) and installed SP3 plus all the Windows Updates, .NET Frameworks, upgrades to IE8, Firefox and various other programs.
I updated her AVG Free antivirus and installed the latest version of ZoneAlarm Pro
I also installed ZoneAlarm Pro on PC1
All 3 desktop computers and a Laptop, are now operating very well (and fast) on the network, and are now all free of malware
I've also set up the facility for sharing files, folders and various printers on the network

I installed the network using a Netgear router plus 2 USB wireless adapters for PC2 and PC3.
The external modem was supplied by Virgin Media via cable.

PC1 … adjacent to the router, and hard wired from the router to an internal Ethernet card … Avast Free plus ZA Pro
PCs 2 and 3 … fitted with USB wireless adapters…. AVG Free 8.5 plus ZA Pro.

When only PC1 is switched on and no programs running, the ZoneAlarm icon in the Notification Area shows continuous activity, except for very brief occasions when the letter Z flashes on and off.
This doesn't happen on any other PC on the network.
Task Manager >> System Idle Process at 99 and all others at 00.
Other than Avast, AVG & ZA, the only "real time" programs used on all PCs are SpywareBlaster and WinPatrol.
This flashing ZA icon on PC1 has only showed continuous activity since I installed the wireless network.
Is it the activity between the Virgin modem and the router ?

Any theories about this ? My ungrateful friend is complaining that the continuous flashing icon is irritating her. When you hover on it, it says "Traffic".
She doesn't want to hide her Taskbar, nor her ZA icon in the NA.

Spit

Hi Spit

well you have been a very busy chap! ... I hope your friend realises the work, time and effort such a task is.

The traffic indicator, as I remember it, shows you when traffic leaves (red) or enters (green) your computer. .. is this still the case in the latest version?

Any idea if the flashing "Z" is showing enter/leaving traffic

As you have set up file and printer sharing it could well be to do with detection of the others on the network and the router.

EDIT, seems I was right about detecting others and the router on the network, I found this amongst a .pdf file of Zone Alarm's

The system tray icon is not removable.
You might see red and green lights in the system tray icon when you are not
connected to the Internet. This is due to broadcast messages being sent to all
computers that are part of a specific network. This can include something as basic
as a home network configuration, an office network or even a standalone
computer using cable or DSL.
A computer's network adapter filters traffic on the hardware level. Any traffic that
does not have the hardware address of your Network Interface Card (NIC) is
automatically discarded so therefore, it is not being transmitted to the Internet.
Similarly, there may be times when you are not logged into the Internet yet you
see activity lights on your DSL/Cable Modem

Good Morning Anne and Mike,

Thanks for your replies.

I'll check out the ZoneAlarm Pro PDF manual tomorrow when I have time.

I'll visit my friend early next week and perhaps check out the ZA permissions.

Quote
The actual traffic shown by Zone Alarm must be over its own network connection, i.e. between PC and Router.

Agreed ... It can't be anything else. This is the only PC that is hard-wired to the router, although I don't think that this is significant.

I'll let you know how I get on in due course.

Spit

Greetings To My Great Pals ... Sunshine Anne & Mighty Mike.

I received the response below on another forum I occasionally visit.
I'd be grateful if you could have a look at it, and comment on how accurate the info is.

I hope you are both behaving yourselves.
Anne ... beware of the bounder Sir Prancealot.

I suspect it's just the adapters talking to one another.
Each is likely asking "who is out there, please talk to me" to the others, and they all respond, or don't if not powered on.
Probably at 12 or 20 sec. intervals.

You could set alerts and logging to show everything for a while, then read the logs and read off what IPs are involved and what ports. Most likely just a whole mess of broadcasts (last 3 digits of IP being .255) within your LAN range, but could be others, external to watch out for.

With file and printer sharing, there is NetBIOS broadcasts, Browser announcements and other such going on - these are on ports 135, 137,138 and possibly 445. 135 and 445 are used by System, the others just sharing. These should be only allowed within your LAN, never internet.

No programs running is your impression. but services run background programs all the time.

I'm not familiar with the USB adapters, so it could still be something else.

SpywareBlaster isn't running. Ever. It sets killbits in the registry for malicious ActiveX and then is quiet.
Not familiar with WinPatrol - if it's a firewall or runs all the time for spyware, you shouldn't run it since ZA already is a firewall+spyware watch.

Spit

Hi Sir Spit

Mike's a lot more clued up when it comes to this sort of stuff but I'd say the info is spot on and looking at the logs for a bit would be a good idea if you feel something is not right.

You could checkout msconfig too, if you think the security scans could have missed something ... maybe run a couple of extra online scanners to show your friend the pc is totally clean and the activity is normal.

Anne

"I suspect it's just the adapters talking to one another."

If PC1 is connected by ethernet cable to the Router, and displaying network traffic in Z.A. while the PCs with WiFi adapters are off, it cannot be due to the wireless adapters blethering away like old fishwives.

I'd actually be inclined to try connecting PC1 directly by ethernet cable to Virgin's Cable Modem (leaving out the Router) and see if there is still as much network traffic.

You could always take zone alarm out and replace it with something else.
I fell out with Zone alarm a few years ago.
It never seemed to update properly for me.
Now I'm run Comodo internet suite.I used to run just the firewall with
Avast home anti virus.But I thought I'd try the whole thing(anti virus and firewall) both together.
I've only had it on a week,but it seems to be running fine.
No flashing lights

---------------- Now playing: Morrissey - There Is a Light That Never Goes Out (Live at Earls Court) via FoxyTunes

Thanks for your reply malvachat.

Interesting about Comodo ... It's very popular now.

I've used the Pro version of ZoneAlarm for years now, and am very happy with its extra features.

As I said, this anomaly is only showing on PC1, so I'll try and work it out by a process of elimination when I visit my wife's mate again.

The bad news is that she specialises in scrambled eggs with mushrooms.
On a previous visit, this is what she made for me ... she adds secret ingredients that don't work.
I managed to finish this funny-tasting concoction, but made the mistake of saying that it was very nice when she asked me.
Now she makes this for me when I visit her.
If I stop posting suddenly ... assume the worst.

Cheers, Spit

Tell her you've developed an allergy to eggs..............