Hello, I have recently installed Sygate Personal Firewall as a security measure for my computer. I am not experienced in firewalls and these kind of settings, but i have configured the Firewall the way i could, allowing several application that i know are harmless and some other apps set to ask me before. However i keep getting a message that i don`t know what it is about and it sounds something like this " An application named NT kernel and Systems is trying to access the system. ntoskrnl.exe" I set the firewall to block this access. Can somebody please tell me what should i do? Is it something normal and i should allow it or its better to keep it blocked?

It is a system process working... Allowing the NTKernel to access ntoskrnl.exe will not harm your computer, I think... Deny this access may stop some process, or desability something in your windows. I think you need only deny the processes that try to reach the network, acessing some ip adress Sygate tell you the process is trying to access... The inside processes, I think you need not to worry with them.

Hello Leonardo thanks for your reply. I have noticed that the message i get is actually reffering to the network accessing :"An application named NT Kernel and System (filename ntoskrnl.exe) has been blocked from accessing the network" And its weird that i have set now the NT Kernel and System to first ask me about the action, but its still blocking it. Maybe its an incoming traffic a indeed and not something internal. What do u think?

I'm using sygate have some time, and I found it works fine most of the time, but it has their bugs... Sometimes, It blocks some acesses we don't want it to block, and the only way I know to fix the problem is uninstalling and re-installing the firewall... That NT Kernell process, specifically, is blocked on my system at now... What I know about it? Whem I have html files on my hard drive, the Windows Explorer tries to get updated content on any on-line remote content this page has in it, like banners and pictures. The windows explorer will load this content to make a preview thumbnail of the webpage to show in your right section of the explorer window. I think Explorer uses the NT Kernel and System (specific file ntoskrnl.exe) to access the content on the internet. See if it is blocked in such times you view html files in your directories. So, if you disallow this process from acessing the internet, you will only prevent the thumbnail of the webpage to be correctly drawned. I use the Explorer and NT Kernel processes blocked from accessing the network to prevent other programs like trojans or viruses from acessing the internet trought these system files. I think that if one of these files get infected by a virus, the virus can access the internet using the name of the process... See that I have not the needed knowledge to say it is true, but I think it may be a good security measure. If blocking a program from accessing the network doesn't make your computer, network or any important program stop working, what harm can do block this file? ;)

This appears to be an annoying bug in the current (ver 5.6) free Sygate Personal Firewall (SPF) running in XP. To get Internet Connection Sharing (ICS) to work with SPF, Sygate recommends setting certain programs to "allow," including the NT Kernel, ntoskrnl.exe. When I do this, Sygate still notifies me when it blocks at least some access attempts by ntoskrnl.exe. When I check the box asking not to show the pop-up window again, this has no effect, the same message still pops up. Despite the messages, ICS works fine. As for the comment above, "I think that if one of these files get infected by a virus, the virus can access the internet using the name of the process..." this should not be possible with SPF, as it uses checksum verification of programs and DLL authentication to ensure that a virus is not masquerading as a legitimate program. Zone Alarm has a similar feature.

My comment immediately above about DLL authentication in Sygate Personal Firewall is correct, but I did not realize that the feature must be turned on in order to work. It's in Tools > Options > Security. I also did not realize that when this feature is turned on, SPF produces a whole new set of incomprehensible alert messages.

Aside from your security decision as to whether to allow/ask/block network access by this program (note, it is used when other PCs look for network shares) there is clearly a bug in the free Sygate software. When set to allow or ask, it still blocks this process. This can be seen as the number of blocked packets goes up when monitoring Sygate, and frequently gets a popup warning. This stops the use of normal network shares, requiring the 'allow all' option to be enabled when connecting to a shared drive, then back to 'normal' for security to be enabled again afterwards...