Ntoskrnl.exe

[deango]

Hi. My Symantic Firewall occasionally show a pop-up that says it has
blocked
C:\Windows\Syst32\Ntoskrnl.exe. I think it is blocking incoming but it
doesn't block it 'outgoing'. What is this process and should it be
allowed? Thanks deango

 

[Rick \Nutcase\ Rogers]

Hi,

Is that the correct path, or were you abbreviating?
C:\Windows\Syst32\Ntoskrnl.exe would not be a valid system file, but
C:\Windows\System32\Ntoskrnl.exe would be.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Windows help - www.rickrogers.org

 

[deango]

Sorry Rick, It is 'System32\' I was abbreviating.........

 

[Rick \Nutcase\ Rogers]

Hi deango,

It could be nothing, or it could be an indication of a more serious
infection. (How's that for an answer?) Ntoskrnl.exe is a system file that
controls many aspects of the kernel mode, including hardware functions that
include network communications, which could account for it being labeled as
trying to access the internet. It is also possible that this critical system
file has been modified by a virus or other malware, and the system needs to
be cleaned of the problem. It should not hurt to block it from accessing the
internet. I would run full system scans with updated antivirus and
antispyware programs in Safe mode as well.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Windows help - www.rickrogers.org

 

[deango]

Thanks for the reassurance Rick. I will do the scans and see what comes