[Alex Ethridge]

I installed ZoneAlarm free version several days back and got this alert from ZoneAlarm a few days later:

ZoneAlarm Security Alert
Protected
The firewall has blocked Internet access to Carol.netgear.com (63.251.179.56) (TCP Port 445) from your computer [TCP Flags: S]

All local IPs are in the 192.168.xxx.xxx range, including the "Carol" computer.

I did a little research via Google and came up with the following text on a web page. I used those instructions and the alert came back today with the same IP number. The first alert was several days ago. By the way, Windows Updates is disabled and I have manually done none since following the below instructions:

Symptom:
You receive an alert from ZoneAlarm SiteAdvisor as follows:

The firewall has blocked Internet access to whatever.com (xxx.xxx.xxx.xxx) (HTTP) from your computer (TCP Flags: S)

Why this alert:

Windows Update has updated (changed) the files used for networking and internet access and ZA does not recognize the new files. The file names and locations may match; but, the new file sizes and checksums don't.

To solve this, just reset the ZA database:

- Boot your computer into the Safe Mode.
- Navigate to the c:\windows\internet logs folder.
- Delete backup.rdb, iamdb.rdb, *.ldb and the tvDebug files.
- Empty the Recycle Bin.
- Reboot to Normal Mode. You may see a 'new network found' alert. Set it to "Trusted". Then do as follows:

Put your DNS and DHCP server IP's in your ZA's Trusted zone.

How to find your DNS and DCHP servers, etc

1. Click Start> Run> type CMD and press the enter key. A command prompot window will open. In that window, type IPCONFIG /ALL (with a space between IPCONFIG and the /ALL) and press enter. DNS and DHCP Servers will be listed with the IP address(s) listed to the right.

2. In ZA on your machine on the Firewall, open the Zones tab, click Add and then select IP Address. Make sure the Zone is set to Trusted. Add the DNS IP(s).

3. Click OK and Apply. Then do the same for the DHCP server.

4. The localhost (127.0.0.1) must be listed as Trusted.

5. The Generic Host Process (svchost.exe) as seen in the Zone Alarm's Program's list must have server rights for the Trusted Zone.
Plus it must have both Trusted and Internet Access.

Generic Host Process for Win32 Services is set as follows:
Access Trusted OK
Access Internet OK
Server Trusted OK
Server Internet OK

I really would like to fix this problem; but, it is equally important for me to also understand the workings of what triggers this alert.

[AKAJohnDoe]

It has been some time since I used the free version of ZA, but as I read your post, it is just that ZA "registered" the network modules and Windows Update changed them, so ZA needs to "re-register" them.

[Alex Ethridge]

As stated earlier, I already reregistered them. Surely I'm not expected to reregister them every four- or five days.

[AKAJohnDoe]

As I said, it has been a very long time since I last ran the free ZA product. However, I do run the (non-free) ZA-AV and have no such problem. Although I also turned off NETBIOS on my PC.

In any case, all the message is really telling you is that two devices on your local LAN tried to talk via NETBIOS. Just a notice. No attack. And it was even blocked. Why worry?

[Alex Ethridge]

Well, I didn't think it was an attack; but, I am naturally afraid to put an IP of unknown origin into the listed of trusted IPs.

Physically, where is this 63.251.179.56 address that was blocked?

Considering all IPs on my LAN are in the 192.168.xxx.xxx range and the "Carol" computer is attempting to contact my computer, how does this 63.251.179.56 IP get into the mix?

[AKAJohnDoe]

My guess is that may be your IP address at your residence that your ISP assigned to you. Look and see?

[Alex Ethridge]

That was one of the first things I checked. I got it from my router and it matches what I got from WhatIsMyIP.com (xxx.113.114.xxx).

[AKAJohnDoe]

You probably do not want to publish your external IP address.

Also, it may be that your router is not as well secured as you might wish.

Finally, it is likely that CAROL is another computer in your local network and that your DNS PREFIX in your router is NETGEAR.COM, so that is where CAROL.NETGEAR.COM comes from.

[Alex Ethridge]

Good idea. I had that much sense when I did the initial post and slipped later.