C:\WINDOWS\system32
toskrnl.exe

Question

Starting seeing this on my computer from my sygate firewall: Application has changed since the last time you opened it, process id: 4 Filename: C:\WINDOWS\system32
toskrnl.exe The change was denied by user. My norton was disable too (stated it was out of its trial period which was odd as I was not on that). Did a system restore but still seeing this (sygate is blocking and I am not allowing it to go outbound). disabled my network connection and reconnected and norton came back up. Ran Ad Aware and found nothing. Norton running now but finding nothing. Any thoughts? Do I have a hijack going on? I am on windows XP

ky331 · Answer

ntoskrnl.exe is the kernal (core) of the operating system   i've 'stumbled' onto the following by searching the web: it seems the original version of 'Ntoskrnl' was version '5.1.2600.0' ( SP-0). But since then, Microsoft has issued several  'Critical Updates' that change the version of your current 'Ntoskrnl.exe' to either 5.1.2600.31 (SP-0), 5.1.2600.1106 (SP-1), or the even  newer version 5.1.2600.1224 (SP-1/SP-2)   perhaps your firewall is alerting you to the change/update in this essential system file?  and that, somewhere/somehow you have to give 'user approval', that this change was legitimate?

Virus & Spyware

Was this post helpful?