You can further customize Application Control settings, based on application behavior, application component behavior, and other specific factors.

To get to Advanced Application Control settings:

1. Click in the ANTIVIRUS & FIREWALL panel of the ZoneAlarm software client.
2. Click Settings in the Application Control section.
3. Click Advanced Settings.
   The Application Control Settings window opens.
4. Make necessary configuration changes:
   • Enable advanced controls - application, service, and component controls
   • Change OSFirewall settings
   • Configure settings for suspicious program behaviors - connection attempts and attempts to act as a server
   • Configure permissions for individual programs
   • Configure permissions for program components
5. Click OK.

Enabling Advanced Controls

To turn on advanced application controls:

1. In the Application Control Settings window, select the Application Control tab.
2. From the navigation tree in the Application Control Settings window, select Advanced Control options as necessary:
   • Enable Advanced Application Control - prevents malicious applications that try to abuse standard Windows service calls
   • Enable Application Interaction Control - blocks untrusted programs from launching trusted programs for Internet access
   • Enable Timing Attack Prevention - prevents malicious programs from exploiting kernel timing vulnerabilities for execution of untrusted code
   • Enable Microsoft Catalog Utilization (selected by default) - to prevent alerts for programs that are in the MS Windows database of known and trustworthy applications.
     Note - ZoneAlarm software can still show alerts about programs that are cataloged in the MS Windows database, if they try to act as a server outside of the Trusted Zone.

To enable services control:

In the Application Control tab, select Enable Services Control.

To configure component control:

1. Enable component control - in the Application Control tab, select Enable Component Control.
2. Configure components:
   1. From the navigation tree, select View Components, then select a program component from the list that shows.
   2. Right-click on the Permission field.
   3. Select new permission - Allow (to automatically grant permissions), Deny (to automatically deny permissions), or Ask (to ask for permissions when component runs).
   Note - to change MS Windows Access Control properties, while a component is selected, click View Properties. Change properties in the window that opens. Refer to MS Windows Help for instructions.

Changing OSFirewall Settings

OSFirewall is enabled by default and detects when programs try to do one of these types of suspicious actions:

• Install ActiveX
• Change the hosts file
• Change IE search page
• Change which programs load at startup

By default, OSFirewall reacts to those actions according to the program permissions. To change permissions for a specific program, refer to Customizing Program Access Permissions see "Configuring Permissions for Individual Programs" below . You can also change OSFirewall settings to react identically to all actions of the same suspicious activity type.

To change OSFirewall settings:

1. From the navigation tree in the Application Control Settings window, select OSFirewall.
2. Make sure Enable OSFirewall is selected.
3. Right-click on the OSFirewall rule you want to change, and select an action:
   • Allow
   • Deny
   • Ask
   • Use Program Settings (default)
4. Click OK.

Configuring Settings for Suspicious Program Behaviors

Some programs can try to gain access to or to act as a server for the computers in your Trusted Zone or your Public Zone. By default, Application Control asks for permission for a program to connect or to act as a server on every such attempt. You can configure Application Control to always allow or always deny each type of connection.

To configure settings for suspicious program behavior:

1. From the navigation tree in the Application Control Settings window, select Advanced.
2. In the Connection Attempts section, select one of the permissions for attempts to connect to the Trusted Zone and to the Public Zone - Always allow access, Always deny access, or Always ask for permission (default).
3. In the Server Attempts section, select one of the permissions for attempts to act as a server to the Trusted Zone and to the Public Zone - Always accept the connection, Always deny the connection, or Always ask before connecting (default).
4. In the Alerts & Functionality section, select relevant alerts and rules:
   • Show alert when Internet access is denied
   • Deny access if permission is set to ask and the TrueVector service is running but ZoneAlarm is not (selected by default)
     TrueVector is a ZoneAlarm security service that monitors Internet traffic and generates alerts for suspicious access attempts. It shows as vsmon.exe service in the MS Windows list of processes and continues to run, even if ZoneAlarm is not running.
   • Require password to allow a program temporary Internet access (selected by default)
If you want to return to the original settings, click Reset to default.
5. Click OK.

Configuring Permissions for Individual Programs

ZoneAlarm software tracks programs that try to access the Internet or a local network, or to gain server privileges, and assigns access permissions to them. You can change permissions for individual programs on the list, add a program to the list, or remove a program from the list.

To change permissions for a program on the list:

1. In the ANTIVIRUS & FIREWALL panel, go to Settings at Application Control, and select View Programs.
   You can also select View Programs from the navigation tree in the Application Control Settings window.
2. In the View Programs window that opens, select a program.
   The information about the highlighted program shows in the Detail area below the list of programs.
3. Click in the fields and select parameter values:
   
   

   Programs	The name of a program. Note: You cannot change this field.
   SmartDefense	Defines the level of SmartDefense Advisor control: Auto - SmartDefense Advisor defines the access policy Custom - manually define the access policy and the trust level by changing the values of Outbound Trusted, Outbound Internet, Inbound Trusted, and Inbound Internet fields. Note - if you change one or more of these fields, the value in the SmartDefense field will automatically change to Custom System - the program is used by the operating system, and SmartDefense Advisor does not define the access policy for it Note - If you try to change the value in SmartDefense field or one of the other fields for a system program, a warning will show - This is the system program, are you sure you want to change it?. Be careful, changing system program policies can interfere with normal operation of your computer.
   Trust Level	Define the actions that a program is permitted to do: Super - the program can perform suspicious actions without seeking permission, and no alerts are displayed Trusted - the program can perform suspicious actions without seeking permission, but unknown programs must ask for permission Restricted - the program can perform trusted-level actions but cannot perform suspicious actions Ask - a Suspicious Behavior alert shows during run time, and lets you decide whether to allow or to deny access Kill - the program does not get any access and cannot run No Enforcement - the program can run without any restrictions and is not monitored by ZoneAlarm NOTE: We do not recommend overwriting the default value of the Trust Level parameter, because the ZoneAlarm software assigns policies to known programs automatically, and the SmartDefense Advisor security team constantly monitors and updates the database of these programs.
   Outbound Trusted	Defines permissions for sending data to the Trusted Zone: Allow - lets all outbound traffic go out to the Trusted Zone Deny - does not let any outbound traffic go out to the Trusted Zone Ask - at run time, asks for permission for the program to send traffic to the Trusted Zone
   Outbound Internet	Defines permissions for sending data to the Internet: Allow - lets all outbound traffic go out to the Internet Deny - does not let any outbound traffic go out to the Internet Ask - at run time, asks for permission for the program to send traffic to the Internet
   Inbound Trusted	Defines permissions for data sent from the Trusted Zone: Allow - lets all inbound traffic from the Trusted Zone Deny - does not let any inbound traffic from the Trusted Zone Ask - at run time, asks for permission for the program to receive inbound traffic from the Trusted Zone
   Inbound Internet	Defines permissions for data sent from the Internet: Allow - lets in all inbound traffic from the Internet Deny - does not let in any inbound traffic from the Internet Ask - at run time, asks for permission for the program to review inbound traffic from the Internet

To add a program to the list:

1. Click Add.
   The Add Program window opens.
2. Select the executable file of the program you want to add (with .exe file extension).
3. Click Open.
   The Add Program window closes, and the program shows on the list. By default, after you add a program to the list, its SmartDefense setting is Auto, and all the other settings are Ask.

To remove a program from the list:

1. Select a program from the list.
2. Click Remove.
   The Delete Confirmation window opens.
3. Click Yes to confirm the deletion.
   The program disappears from the list.

Customizing Program Options

For each program, you can further customize Security options, define Send Mail privileges, and configure Expert Rules.

To get to the customization options:

In the View Programs tab of the Application Control Settings window, select a program and click Options.

The Program Options window opens.

To customize Security program options:

1. In the Program Options window, select Security tab.
2. Select security options, as necessary:
   • Advanced Application Control > This program may use other programs to access the Internet
   • Advanced Application Control > Allow Application Interaction
   • Outbound Email Protection > Enable Outbound Email Protection for this program (selected by default)
   • Authentication > Authenticate Components (selected by default)
   • Authentication > Authenticate program by full path name only
   • Authentication > Program changes frequently

To define Send Mail privileges:

1. In the Program Options window, select Send Mail tab.
2. Select a Change the setting to allow the program to send/receive email option:
   • Allow (default)
   • Block
   • Ask

To configure Expert Rules:

1. In the Program Options window, select Expert Rules tab.
2. Click Add.
3. Continue as the Adding Expert Rules support article describes.

To change MS Windows Access Control properties for a program:

1. In the Program Options window, select a program and click View Properties.
2. In the window that opens, change properties as necessary. For instructions, see MS Windows Help.

Configuring Permissions for Program Components

You can change permissions for individual program components or remove a component from the list. Program components are DLLs that are allowed to load by trusted processes.

To change permissions for a program component:

1. From the navigation tree in the Application Control Settings window, select the View Components tab.
   The Components table shows the name, the description and the default Access permission for each of the detected components.
2. Select a component.
3. Click in the Access field and select one of these:
   • Allow
   • Deny
   • Ask

To remove a component from the list:

1. Select a component.
2. Click Remove.

To learn more about a component:

Click View Properties. The Windows program properties window opens. See MS Windows Help for more information on program properties.