Should I worry about NTOSKRNL.EXE ?

  • Thread starter Thread starter geezer
  • Start date Start date
G

geezer

Lately my firewall keeps signal it is blocking 'ntoskrnl.exe'. Should
I worry about this, and how do I get rid of it, or should I?

Thanks
 
geezer said:
Thank you - very interesting.
www.hijackthis.de result did not show 'ntoskrnl.exe'. It did show
flag several IExplorer entries however.
Click to expand...


http://tinyurl.com/68soy

It can be exploited by undetected malware running on the machine.

Ntoskrnl.exe should by running out of the system32 directory. You can check
that with Process Explorer and you can look inside ntoskrnl.exe and see
what's using ntoskrnl.exe or piggy backing off of it. You may spot
something. ;-)

http://tinyurl.com/klw1

Duane :)
 
geezer said:
Lately my firewall keeps signal it is blocking 'ntoskrnl.exe'. Should
I worry about this, and how do I get rid of it, or should I?

Thanks
Click to expand...


It may get involved with networking requests which are benign and
expected under Windows. However, it should never need to make an
*Internet* connection. You could add an application rule to always
block it but then it may interfere with networking processes you need
for your own intranetwork, or even for same-host networking processes.
You could define an application rule for it to allow access to 127.0.0.*
and 0.0.0.* (and you could add the IP address range for your
intranetwork hosts, too). Just don't let it connect to the outside
world.
 
It can be exploited by undetected malware running on the machine.

Ntoskrnl.exe should by running out of the system32 directory. You can check
that with Process Explorer and you can look inside ntoskrnl.exe and see
what's using ntoskrnl.exe or piggy backing off of it. You may spot
something. ;-)

http://tinyurl.com/klw1

Duane :)
Click to expand...


Thanks again.

The only ntoskrnl I find with Windows Explorer indeed is under
system32.

G
 
geezer said:
Lately my firewall keeps signal it is blocking 'ntoskrnl.exe'. Should
I worry about this, and how do I get rid of it, or should I?

Thanks
Click to expand...

As far as I know, "ntoskrnl.exe" stands for "NT (which stands for New
Technology) Operating System Kernel". This file is the core of the Windows
Operating system, it is not dangerous but essential. But it does not need
to connect to the internet so you can safely block it, if you want to.
 
Back
Top