I'm a long-time user of the Check Point (formerly Zone Labs) ZoneAlarm firewall, so it was the first thing I installed on a new Dell Precision 490 workstation.
However, this time ZoneAlarm exploded into a frustrating series of crashes and hangs, which I never really got resolved even after lots of testing with the help of Zone Labs and Dell (gory detail below for fellow sufferers).
But out of all this testing came another discovery that was more of a doh! event -- ZoneAlarm adds a huge delay to startup, like 20 to 30 seconds, even on hot new machines.
Even on the new multi-core Dell Precision 490, I see a 20 second delay at the Welcome screen.
And an older Dimension 8200 desktop (P4 2.53 GHz), spends 22 seconds at the Welcome screen, then another 30 seconds hanging after initially drawing the gray desktop background!
But if I disable ZoneAlarm from running at startup, the Welcome screen flashes by in only a second or two. This is particularly odd, because manually launching ZoneAlarm after boot takes more like 6 seconds.
There's plenty of discussion of this on the Web and on ZoneAlarm's own forums, but it was helpful to have Check Point officially confirm this to me, saying that a 20 to 30 second delay is typical for firewall / anti-virus applications, and that the benefits of the protection ZoneAlarm provides outweighs the inconvenience of slower boot-up times.
So now at least I finally understand why I need to take a coffee break whenever I reboot a machine ...
I've been a big fan of the ZoneAlarm firewall -- It has a good history of secure protection, and I like the way the interface provides a clean view of status and options. You can run it in a "set and forget" mode, or, as on some of my machines, you can set it to generate alerts so you can see the amazing number of Windows applications that feel the need to check in over the Internet at startup and when they are launched.
More recently, ZoneAlarm has bulked up to a full Security Suite by adding anti-virus and anti-spam checking. The new version 7.0 also switched to the Kaspersky anti-virus engine, which has improved the product's ratings.
ZoneAlarm Slow Boot
I had been suffering for a while with horribly slow boot time on my machines. It's just something that I had just gotten used to as a Windows feature -- I had put it down to Windows XP sluggishness and the accumulation of start-up applications on older machines.
But in my testing for the ZoneAlarm crashes, I spent a lot of time measuring hangs during the boot process thinking they were artifacts of the deeper crashing problem.
You can try this yourself by disabling ZoneAlarm from launching at startup. In the main application, click Overview, Preferences, then un-click Load ZoneAlarm at Startup. (This is also shown as zlclient in the Startup Items list in the System Configuration Utility.)
But it turns out this is an ongoing issue with ZoneAlarm, as shown by postings in its online forums. For example:
Slow Startup
http://forums.zonealarm.com/rss/message?board.id=gen&message.id=41236
Extremely slow system startup!
http://forums.zonealarm.com/rss/message?board.id=cfg&message.id=46166
Here you'll see advice on what to do, like using MsConfig to reduce the number of other programs launching at startup.
But what I could not find in these online resources was a clear statement that these kinds of delays were typical with ZoneAlarm.
However, in discussions with me about the issues I'm describing here, Check Point was very clear about what our expectations should be:
"Yes, ZoneAlarm Internet Security Suite does cause some delays at boot-up. 20 to 30 seconds is typical, but it can be longer depending on individual configurations. In opting to provide our customers with maximum levels of protection, we sacrifice a small footprint, and thus boot-up delays are longer than with solutions that provide less security. With the latest 7.0 version, we switched to Kaspersky AV, which added again to the size of our footprint. We felt it was worth it to provide users with a much more powerful and secure AV engine."
"It's always a challenge to find the best balance between providing maximum security with minimal user impact. ... If I understand correctly, you are seeing about a 20 second delay. This does not seem out of the ordinary."
"We do our best to try and optimize our products for as many possible hardware configurations as we can, although it's challenging given all of the potential variations. Realistically, we are not going to be able to eliminate boot-up delays entirely. Philosophically we believe the benefits of the protection we provide outweigh the inconvenience of slower boot-up times."
ZoneAlarm Crashes
Just for the record, here's a summary of the problems that I was having with the ZoneAlarm installation ...
After installing ZoneAlarm Security Suite 7 on a brand new Dell Precision 490, I saw a progression of hangs and crashes, both at startup, and in running the application.
These included:
- Hangs at the first Windows XP boot screen (minutes, or forever)
- Hangs at the Windows Welcome screen (minutes, or forever)
- Hangs at the first drawing of the Windows desktop (minutes, or forever)
- Manually launching ZoneAlarm crashed the driver (TrueVector service)
- Enabling/disabling Anti-Virus/Anti-Spyware crashed the driver (TrueVector service)
Again, you'll find similar reports online, for example:
Latest ZAP Crashing on Windows Reboot/Shutdown
http://forums.zonealarm.com/zonelabs/board/message?board.id=inst&message.id=60473
Uninstalling and re-installing the application did not resolve this. A quick test with the older version 6 did not demonstrate such problems.
I worked on the phone with ZoneAlarm support for several long sessions trying different options and start-up strategies. We were never able to find a consistent pattern to cause or resolve these issues. In extensive further testing and re-booting, they seemed to occur after a change to the ZoneAlarm parameters or the MsConfig startup sequence. Re-booting after a MSConfig change might work fine if the System Configuration dialog was displayed, but another reboot after turning it off would then hang. Re-booting after a hang then might work fine.
The bottom line: Changing the ZoneAlarm startup configuration clearly causes it to fail and crash, i.e.:
- Enable/disable "Load ZoneAlarm at startup" check box under Overview / Preference.
- Enable/disable Anti-Virus and/or Anti-Spyware check boxes
- Enable/disable Anti-Virus Check-On-Open option under Advanced Options
- Enable/disable other unrelated Startup applications under MsConfig
I reported other results and evidence to ZoneAlarm, and submitted the TVDEBUG.LOG file. But we got no further in understanding this. The ZoneAlarm product manager did suggest that ZoneAlarm is only a consumer product, and is not really qualified for use on servers, although the Precision is more of a workstation than a server.
Meanwhile, the Dell product manager was kindly trying to replicate this problem on a test system running a trial version of ZoneAlarm. Since they did not see similar problems, it suggested that somehow my Windows installation had become corrupted. The only solution left was to wipe the disk and re-install the system from scratch.
Unfortunately, while Dell often builds their systems with a hidden recovery partition (press CTRL+F11 at the initial Dell boot screen), the Precision did not have this installed.
Instead, and as a final sanity check, the Dell product manager make a disk image of his test system, which I installed on my system.
So far so good... I can get back to trying out new software.