>>Ok the problem (in a nutshell) is that it is way to easy to modify the firewall rules without your knowledge. I mean you could even make something and name it iexplorer.exe and have it do stuff on port 80 yer firewall would be oblivious to it.
>
>Only as long as they also match the current version of the program. ZoneAlarm seems to use more than just the name. Any time I do a Windows Update that changes the version number of an installed program that has been granted axccess through ZoneAlarm, it asks if I want to allow access to this "new" program.

Correct.