>>Ok the problem (in a nutshell) is that it is way to easy to modify the firewall rules without your knowledge. I mean you could even make something and name it iexplorer.exe and have it do stuff on port 80 yer firewall would be oblivious to it.
>
>Only as long as they also match the current version of the program. ZoneAlarm seems to use more than just the name. Any time I do a Windows Update that changes the version number of an installed program that has been granted axccess through ZoneAlarm, it asks if I want to allow access to this "new" program.

Fred, it goes further than that. ZoneAlarm compares the recorded MD5 signature of the program with the current signature. If they don't match, you get the question because ZoneAlarm figures something has changed.

Alan