Forums

Malwareteks :: Forums :: Help and Guidelines :: Knowledge Base		<< Previous thread \| Next thread >>
Removal of ZoneAlarm


Moderators: ShadowPuterDude, Greg, D3m3nt3d, Brandon, Vmarm, peterparker, siljaline, jholland1964, TurcoLoco, Windsor, JeanInMontana, KZ, RatHat, Jason Amison, MrCharlie	This thread is now closed

Author

Post

ShadowPuterDude

Mon May 08 2006, 04:27PM

...the Shadow knows

Registered Member #1

Joined: Thu Apr 27 2006, 04:52PM
Location: Northern NY
Posts: 251
Thanked 12 times in 12 posts

This is a Self-Help Procedure. MalwareTeks is in no way liable for anything which may go wrong.

Removal of ZoneAlarm

Please print out these instructions so that you can operate with
All Browser Windows CLOSED.

Do the following:

If any of the steps below do not apply to you, or you are unable to perform the function listed, please CONTINUE to the next step.

Open the ZoneAlarm program, go to the OVERVIEW -> PREFERENCES tab, and make sure the Load At Startup box is UNCHECKED. Close the program, then right-click on the ZA icon and select Shutdown.

Now click Start -> Programs -> Zone Labs right-click on Uninstall select Properties. Now in the target box you must add a space and then /clean to the end so that it looks something like this "C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe" /clean click Apply and then OK.

REBOOT

You should now have no ZoneAlarm processes running on your system.
Now click Start -> Programs -> Zone Labs -> Uninstall. Be sure to say YES to the security check.

WARNING - Do NOT run the ZoneAlarm Uninstall program while in Safe Mode unless absolutely necessary. The program may not be able to make the proper registry changes in Safe Mode, thus generating errors after a reboot.

REBOOT

To make sure that you can see the ZoneAlarm system files, if they are still on your computer:

a. Right-click on Start, then click Explore. When the Windows Explorer panel appears:

In Windows 95, 98, 98SE: Click View -> Options (in Windows 98/98SE, this will be called "Folder Options"). Click the "View" tab, and then click the "Show all files" radio button.
In Windows ME, XP, 2000: Click Tools -> Folder Options. Click the "View" tab, and then click the "Show hidden files and folders" radio button.

b. Make sure you also UNCHECK the box to "Hide Protected Operating System Files" if you have one.

c. When searching, be sure it searches ALL hidden files and folders (in XP: check Advanced search settings)

d. Click OK.

IMPORTANT NOTE: Making modifications to system files may disable crucial functions of your Windows operating system. We strongly suggest re-enabling the "Hide files and folders" feature once all ZoneAlarm files have been removed.

Click on Start, then Search or Find, and select Files. Make sure that the location box is set to search your local hard drive (usually C:\) or All Local Drives.

Type the following exactly and delete the folder:

zonelabs (under your SYSTEM or SYSTEM32 folder)
"zone labs" (under your Program Files folder)
"Internet logs" (under your Windows or WINNT folder)

Type the following exactly - delete files found in \Windows or any subfolder below it, in your \Temp folder, or in the \Windows\Prefetch folders):

vsconfig.xml
vsdata.dll
vsdata95.vxd
vsdatant.sys
vsmon.*
vsmonapi.dll
vsnetutils.dll
vspubapi.dll
zaplus.*
zapro.*
zllictbl.dat
zlparser.dll
zonealarm.exe
zoneband.dll
vsutil.dll (please right-click, Properties -> Version to be sure it is a ZA file. Do NOT delete this file unless it is a Zone Labs file!)

Make sure your Recycle Bin is empty (right-click and select Empty).

REBOOT

NOTE: If you received an error message upon deleting the files, or if the original programs remain in the Programs list, or if the problem persists after this, removing the files in Safe Mode will allow you to delete the files properly. Click Start, Help, and search for "SAFE MODE" for information specific to your system.

Rename the directory "C:\Windows\Internet Logs" (for example, "Internet Logs1").

Make sure your Recycle Bin is empty.

It is not generally necessary to remove registry entries if reinstalling ZoneAlarm or ZoneAlarm Pro. However, should you choose to do so, the following registry entries are associated with ZoneAlarm or ZoneAlarm Pro:

Important Advisory: Deleting registry entries incorrectly may cause serious problems to your operating system (OS) which may necessitate the need to reinstall the OS. Please make sure you are able to perform these deletions correctly before you decide to edit the entries.

For information about how to edit the registry in Windows, type "regedit.exe" from a command prompt. Click "Help," then "Help Topic." Click "Changing Keys and Values."

Note that you should back up the registry before you edit it.

To enter the registry, go to Start/Run and type: "regedit." Use Control-F to find and F3 to Find Next.

Registry Entries:

- Key: HKEY_LOCAL_MACHINE\SOFTWARE\Zone Labs and all its subkeys and values
- Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm Pro

These registry items start the services required for ZoneAlarm or ZoneAlarm Pro:

- Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
- Value: MiniLog and Value: TrueVector
- Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\VSDATA95

This is a database that contains a long list of values, but only these values are related to ZoneAlarm or ZoneAlarm Pro and TrueVector:

- Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SharedDLLs
- Values:

C:\Program Files\Zone Labs\ZoneAlarm\tutorwiz.dll
C:\Windows\System\vsdata.dll
C:\Windows\System\vsdata95.vxd
C:\Windows\System\vsmonapi.dll
C:\Windows\System\vsnetutils.dll
C:\Windows\System\vsnetu.dll
C:\Windows\System\vspubapi.dll
C:\Windows\System\vsutil.dll
C:\Windows\System\Zone Labs\html.tdr
C:\Windows\System\Zone Labs\vsdb.dll
C:\Windows\System\Zone Labs\minilog.exe
C:\Windows\System\Zone Labs\vsmon.exe
C:\Windows\System\Zone Labs\vsruledb.dll

For each user who has run ZoneAlarm or ZoneAlarm Pro, there are registry keys in

- Key: HKEY_CURRENT_USER\Software\Zone Labs

The following keys allow the user to modify the sound that is played when there is an alert through use of the Control Panel Sounds applet:

- Key: HKEY_CURRENT_USER\AppEvents\EventLabels\InternetAlert
- Key: HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\InternetAlert\.current

The following keys tell Windows the ZoneAlarm and ZoneAlarm Pro Desk Band is a part of the application:

- Key: HKEY_CLASSES_ROOT\CLSID\{long string of characters}\InprocServer32 (NOTE: The string of characters will vary from system to system.)
- Value: C:\Program Files\Zone Labs\ZoneAlarm\zoneband.dll

The following keys are related to ZoneAlarm and ZoneAlarm Pro's MailSafe Feature:

- Key: HKEY_CLASSES_ROOT\ZAMailSafe

There is a value for the extension of every attachment that ZoneAlarm Pro quarantines (.vbs, for example). To find the values and keys to delete:

1) Click on HKEY_CLASSES_ROOT.
2) Press F3.
3) Type "zamailsafe" in the search field (no quotes).
4) Press F3 to find the next value. An example of the value you will see (on the right-hand side of the window) would be: ZAMailSafeExt: REG_SZ: {renamed extension -- zl9, for example)
5) Delete the value. Press "OK" at the prompt.
6) Repeat until there are no more values like the example above. ZoneAlarm Pro quarantines 37 extensions by default. However, any additional extentions you may have chosen to quarantine will also be listed in the registry.

There is also a registry key for the extension of every attachment renamed by ZoneAlarm Pro. The names of the keys will range from .zl0 to .zly. If you wish, you can follow the instructions above to find the values associated with these keys. Delete the entire key which contains these values.

For ZoneAlarm (not Pro), The following keys can be removed:

- Key: HKEY_CLASSES_ROOT\zl0
- Key: HKEY_CLASSES_ROOT\ZAMailSafe

REBOOT

References:

http://download.zonelabs.com/bin/media/pdf/ZA_Manual.pdf

http://nh2.nohold.net/noHoldCust25/Prod_1/Articles55646/CompleteUninstallNonNT.html

http://www.nohold.net/noHoldCust25/Prod_1/Articles55646/CompleteUninstalNT.html

http://nh2.nohold.net/noHoldCust25/Prod_1/Articles55646/ManualUninstall.html

[ Edited Mon May 08 2006, 04:32PM ]

"Only those who fail greatly can ever achieve greatly" - Robert F. Kennedy
Microsoft Most Valuable Professional - Consumer Security (2007-2008)
Member - Alliance of Security Analysis Professionals - Since 2006
Linux Registered User # 363218


Jump: Back to top