What is CWFSERVICE?

Hi,
After getting over an attack by AGBOT worm (Thanks to the Spyware forum) I installed Zone Alarm's Security Suite. I have started to get a pop up when I am not on line (Dial Up) that says Something is trying to connect to SP.CWFSERVICE.NET. This is a Windows (I think) pop up not the Zone Alarm pop up.

I did a Google search for CWFSERVICE and it looks like this is a service that identifies the content of web sites for Parental Control etc. services. I searched the ZA users manual but no luck. I tried the ZA User Forum Search and found one possible reference buried three levels deep in a response to a question dealing with blocked web sites.

So, my question is: does anybody know if the request for a connection is coming from Zone Alarm? Or does anybody know what CWFSERVICE is?

Thanks in Advance,
Bob Schoner

 

SP.CWFSERVICE.NET appears to be a web site that is used by Blue Coat Webfilter. At least that is what I can tell from a google search.

 

I found their site from a search: http://www.bluecoat.com/

Blue Coat is focused on developing proxy appliances that provide powerful visibility and control of all Web communications. Blue Coat Proxy SG and ProxyAV appliances allow organizations such as ABN-Amro, Cap Gemini Ernst & Young, CompUSA, Discover, Hitachi Data Systems, John Deere, and the U.S. Air Force, to rapidly deploy applications such as content filtering, spyware prevention, Web virus scanning, IM and P2P control, Web proxy and bandwidth management while actually improving Web performance.

I do not believe that this person's machine is a home machine.

 

Hi,

Thanks to your suggestion about Blue Coat I e-mailed them and asked if Zone Alarm was connected to them; here's their reply:

"Yes, that is our website that offers our URL filtering service. It is not any kind of spyware or malware and is related to the ZoneLabs product that integrates with Blue Coat / Cerberian web filtering."

So, Zone Alarm is trying to connect to CWFSERVICE and it's perfectly legit.

Thanks again for yoyr help.

Bob Schoner

 

You have aroused my curiousity.

Exactly what version of ZoneAlarm are you using? (And is it the free or paid)

I know in your original post you say it's ZA Security Suite, which is the one I have, but I've never heard of CWFService, and I've been using ZA since day 1?

 

Hi,

It's a paid version of ZA Security Suite version 6.0 upgraded to 6.1.737.

The attempt to connect to CWFSERVICE message would only occur if I was offline (I'm on dialup). I assume if it occurred while online I would not know it.

The way I understand that it works is that Parental Control checks each site you try to go to and matches that against a list of known "bad" sites and blocks access to them. Somehow there must be a list of bad sites/categories that it checks and blocks if appropriate. I'd like to test it but my paranoia says that if it doesn't work and I wind up on a bad site I'll get malware.
I guess I could add a relatively benign category (religion eg) and see if it blocks. Another category is software/freeware downloads. I wonder if it would block MajorGeeks?

BTW, I bought it last week; today Fry's has it free after rebate (Sigh).

Have you done any testing with ZA; I'm interested in checking out their ID Lock that blocks passwords, PIN etc?

Bob Schoner

 

Ah, so it's linked (CWFService) to parental control.

This is why I don't have it, as I don't use it. Thanks for the information.

As far as the ID lock, it works pretty good. It stores your details, and if they are ever used, it blocks that use till you allow it.

It's very effective, and doesn't falter with spaces in between numbers like Norton.

ZA Security Suite also has kernel level protection which is very good.

So far, I'm very impressed with the suite.