Sygate Personal Firewall

[[TCS]BlackMamba 0]

The following things i am unsure whether to allow to access my pC and send out info:

NT Kernel And System (C:\WINDOWS\system32\ntoskrnl.exe)

Generic Host Process For Win32 Services (C:\WINDOWS\system32\svchost.exe)

LSA Shell (Export Version) (C:\WINDOWS\system32\lsass.exe)

Edited March 27, 2004 by [TCS]BlackMamba

[Kewl 0]

BlackMamba,Mar 27 2004, 16:56 ] The following things i am unsure whether to allow to access my pC and send out info:

NT Kernel And System (C:\WINDOWS\system32\ntoskrnl.exe)

Generic Host Process For Win32 Services (C:\WINDOWS\system32\svchost.exe)

LSA Shell (Export Version) (C:\WINDOWS\system32\lsass.exe)

my anti-virus has been picking up those files as trojans (redirecting my internet explorer), the most recent that i picked up was C:\WINDOWS\system32\svchost.exe. Not sure where it came from though.

[Crimson 0]

I had the svchost.exe virus too. IIRC, that is a Norton AV file that got infected... can't remember how I got rid of it though.

[Kewl 0]

I had the svchost.exe virus too. IIRC, that is a Norton AV file that got infected... can't remember how I got rid of it though.

did you notice thse files on the C: drive? i noticed that whenever i rebooted my comp those kinds of files were listed in c:\ dir like they were added whenever i rebooted my system. I got rid of them by running anti-vir.

[[TCS]BlackMamba 0]

svchost can be a trojan if it in in the following: C:\WINDOWS\system32\win\svchost.exe

however when it is where mine is:

NOTE: Svchost.exe is a legitimate program, which is not malicious, found in the System32 directory

Edited March 27, 2004 by [TCS]BlackMamba

[Dannik 43]

ntoskrnl.exe is safe to allow or disallow, unless your computer is part of a domain, then you'll likely have to allow it.

svchost.exe, if in the path you indicated, can be used maliciously by problem apps/trojans, but it also is required for many legitimate uses, so if you are reasonably sure your system is virus/trojan/worm free, go ahead and enable give svchost.exe permission.

lsass.exe provides user authentication in Windows services. I have it set to 'ask', and it doesn't ask often. It's really used for folks in proper multi-user environments (like domains, etc) but it has some low level needs in certain day to day user services.