To a technical person it might be plain, if the below, is my internet sourse or those bad guys that set me my current trojan horse (downloader.6.BA)(yes, someone else). The firewall will ask me again, what should I say yes or no? Thank much, in advance. File Version : 5.1.2600.1106 (xpsp1.020828-1920) File Description : NDIS User mode I/O Driver (ndisuio.sys) File Path : C:\WINDOWS\System32\DRIVERS\ndisuio.sys Connection origin : remote initiated Protocol : TCP Local Address : 4.15.129.164 Local Port : 139 (NETBIOS-SSN - NETBIOS Session Service) Remote Name : Remote Address : 4.15.186.83 Remote Port : 2363 Ethernet packet details:

If you're using a wireless network card, look here NDIS user mode I/O Driver ??? http://www.experts-exchange.com/Networking/Broadband/Q_20919833.html

Thanks for the advice, perhaps it can give me a hint, but... I use (Verizon) DSL on a home computer. I, just now, had a little message, by the icon tray, that said ...it blocked 'NT Kernal & System' from doing something, from accessing, my computer. This may be the virus sender of "downloader.6.ba"... I knowtise it is on the firewall's list of "applications" with an 'ask' by it. (I have XP 5.1) Opps, I see my just-now-blocked-intrusion "version" is "5.1.2600 (xpsp2.030424=1633)" ...and this is about the same verion ..."5.1.2600 (xpsp1)...." as the "NDIS User mode I/O Driver"...(the one the firewall asks me about after my startup). 'Internet Explorer' also has a 'xpsp1' in it's version. (This is either a good sign or a bad one.) Finally having a firewall is great...exept for this one question-asking It has for me.

I found my answer, I googled and came up with http://forums.sygatetech.com/vb/showthread.php?threadid=2370 that shows that in the sygate firewall program, in the option of (applications), you have to allow allot of the applications at the botton, fron the outside...I ended up allowing them all.