Can we prevent vsmon.exe (ZoneAlarm True Vector service) from hijacking TCP connections

Question

I just noticed that vsmon.exe from ZoneAlarm firewall started to act like proxy for TCP connections (I am guessing it's doing the same thing for UDP packets internally). I use TCPView.exe from sysinternals to troubleshoot network related issues. So if a process A.exe on the computer try to access remote address b.com on port cccc, I am expecting to see:

PROCESS, LOCAL,REMOTE

A.exe, localhost:nnnn, localhost:mmmm

Instead, I see

PROCESS, LOCAL, REMOTE

A.exe, localhost:nnnn, localhost:mmmm

vsmon.exe, localhost:mmmm, b.com:cccc

This is making things very hard to see which connections to remote addresses belongs to which process anymore. I am trying to figure out a way prevent vsmon.exe to be the middle-man process for the TCP connections from the processes running on my computer.

I am using version 11.0.780.000 of ZoneAlarm. I had the same annoying problem with Kaspersky so I changed to ZoneAlarm a little while ago because ZoneAlarm did not act like proxy process for network connections. But since few updates ago, this started to happen to ZoneAlarm also.

(1) I am wondering if there is a way to change the setting of ZoneAlarm so that it will not hijack my TCP connection like this. I searched their help forum but I could not find good information there.

(2) I am considering to look for alternative firewall products. If you know other firewall products that (a) allows one to setup process level firewall rules like ZoneAlarm or Kaspersky and (b) does not hijack the network connection like these, please let me know.

Thanks

Answer 1

Looks like we cannot (unless I shut down the FW).

I contacted Customer Service and posted the same question but no solution to do exactly what I asked. I am pretty sure they have their reasons to do this to their FW design so I just gave up on using ZoneAlarm to something that is not ZoneAlarm.