Blocking ntoskrnl.exe in XP

[Damjan]

> Am on NTL's cable broadband and from time to time I get a message
> from Sygate Personal Firewall saying this:
>
> "Application NT kernel & system has been blocked.
> File name is ntoskrnl.exe."
>
> Should I block it or will it affect my Net access?
>
> Am using XP Pro.

Sure. You block net access for ntoskrnl.exe, because this file is only image
that u can see when the winxp bootup.
Strange is that, that this file ask for net access. Chech your computer for
viruses.

Greets
D

[Moon]

Also check and see your firewall log when NT Kernel tries to acess/be
accessed it could be a netbios check............Moon

[Petros Kosmetatos]

Hi,

I had the same problem: ntoskrnl.exe accessing the net every 2 minutes...
Finally I blocked it, it continued trying for 2-3 days and now it doesn't
try anymore :-)

Petros

"Vance Roos" <not...@mail.com> wrote in message
news:93FCBD572...@62.253.162.115...

[Dave Korn]

"Vance Roos" <not...@mail.com> wrote in message
news:93FCBD572...@62.253.162.115...
> Am on NTL's cable broadband and from time to time I get a message
> from Sygate Personal Firewall saying this:
>
> "Application NT kernel & system has been blocked.
> File name is ntoskrnl.exe."
>
> Should I block it or will it affect my Net access?
>
> Am using XP Pro.

If the kernel is requesting internet access, that probably is down to a
device driver, and the most likely suspect would be the NetBT (netbios over
tcp/ip) device - that's the one which opens port 445. However you should
check the various other services in Start/Settings/Control
Panel/Administrative Tools/Services, and in particular make sure that UPnP
and SSDP are disabled, and you should make sure you haven't got microsoft
file sharing bound to the network card for your cable modem interface at
all. If you ensure the 'client for microsoft networks' and 'file and
printer sharing for microsoft networks' are disabled in the network
properties for the relevant interface, and also that the 'enable netbios
over tcp/ip' box is un-ticked in the tcp/ip properties/advanced
settings/WINS tab, you should stop getting the warning. In any case,
blocking it is the right thing to do.

DaveK
--
moderator of
alt.talk.rec.soc.biz.news.comp.humanities.meow.misc.moderated.meow
Burn your ID card! http://www.optional-identity.org.uk/
Help support the campaign, copy this into your .sig!
Proud Member of the Exclusive "I have been plonked by Davee because he
thinks I'm interesting" List Member #<insert number here>
Master of Many Meowing Minions
Holder of the exhalted PF Chang's Crab Wonton Award for kook spankage above
and beyond the call of hilarity.
PGP Key-ID: 0x0FB504D1 Fingerprint 04B7 2E8C 0245 680E 6484 C441 CEC7 D2BD