|
Another question
Thu, 26 Jan 2006 17:45:43 +0000
uk.people.silversurfers
previous
Aries...
|
Well two really.
I keep getting this pop up message on my screen
What does it mean, well apart from telling me it's blocked LOL
Ali...
|
It means that NTOSKRNL.EXE is attempting to access the network (Internet?
LAN?) and something (your firewall? Windows firewall?) has blocked it. NT
OS KeRNeL looks like an important part of the operating system. Make sure
it's not a trojan.
Aries...
|
How do I make sure of that ? This lappy appears to be running OK without
it!
|
|
Anita Carter...
|
This is what I got when I clicked on the above :
An application names NT Kernel & System (file name ntoskrnl.exe) has been
blocked from accessing the network.
Hope it makes sense to you
Aries...
|
No it doesn't Anita. I know it's telling me that but is what is being
blocked important to my system ? It doesn't seem to be causing any
problems being block, well not so far that is
andon...
|
I probably means that you can only upload greyscale pictures :-)
Aries...
|
I read all that with interest, and as you say it is amazing what can be
found out by digging into the info available.
I did see the greyscale option and I used it too when I was creating .png
pics and x faces but I unticked that option later, and looked again at that
options after the greyscale uploads incident but maybe something else
needed to be altered as well?? Obviously what happened was down to
something I had altered but for the life of me I could not discover what it
was, so reinstalled and now all is jbexing OK again.
Thanks for the lesson and for the trouble you took typing it all out :)
|
#
#
You could look for the file properties of ntos and change them :-(
Aries...
|
Ah, maybe ? answers my other question then regarding why Irfanview pics are
not showing coloured when I upload them to the web, but if I use Photoshop
or PSP then the pics are uploaded as coloured
andon...
|
Sorry. It was meant to be taken seriously large amounts of salt.
Aries...
|
? I'm still confused LOL
andon...
|
The file ntoskrnl.exe
should live in Windows/system32/
pmj...
|
& many (though not all) Systems might also have a Copy of it in the
System32\DLLCache Folder & possibly also in other Folders, such as the
UnInstall Informatio nFolders etc.
|
mine is version 5.1.2600.2622
pmj...
|
& the (File) Version of mine is:
5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
|
size is 2.07 MB
pmj...
|
& the Size of mine is:
2.04 MB (2,148,352 bytes)
|
it is a M$ file and part of winsows.
pmj...
|
& (interestingly?) mine says that the "Original File Name" of it is:
ntkrnlmp.exe
|
All that I can think is that for some reason your file has been added
to those blocked by your Firewall.
Ali...
|
*All* files should be blocked by a firewall, unless and until they are
specifically permitted access.
|
pmj...
|
Or is included in the (built-in) list of stuff that the Firewall has?
|
You could virus check it. If OK, then unblock it, post a pic and see
pmj...
|
Why UnBlock it?
It doesn't really *need* Internet Access, does it?
As with all stuff (like Ali said), things *should* be Blocked,
from both Outbound & Inbound Access, as a matter of course, unless
& until you know what it does & why it wants the Internet Access.
When you have established whether or not you do want to Allow it
access, then you can either UnBlock it, if you do want to Allow it,
or turn off the Prompt about it being Blocked, if you want to Block it.
|
if it cures the problem and if it doesn't then re-block it until
another problem appears leading you to suspect that it is actually
helping by being free to "play".
Aries...
|
I have three instances of it on my pc and I have virus checked all of them
- clear.
Ali...
|
But Trojans aren't viruses. Are all three instances identical?
Aries...
|
see here
Ali...
|
That doesn't say. You need to have Details view enabled.
However the three folders *are* all reasonable places for copies of an OS
file. (And for trojans to hide in)
I would also have 'Hide extensions of known file types' UNticked in folder
options. It makes spotting dodgy stuff easier.
Aries...
|
I do have :)
Ali...
|
But the extension was hidden in that screenshot.
Aries...
|
I see what you mean, but I could or perhaps should have chosen another view
pmj...
|
But surely, the "View" (FilmStrip, Thumbnails, Tiles, Icons, List
or Details) that is Selected (in windoze Explorer, when showing Files,
such as the Results of a Search) doesn't change whether or not the *File
Extension* of the Files is shown?
Aries...
|
I often swap between views as sometimes icons are best for me but other
times I might need to see full details, or filmstrip etc.
pmj...
|
Yep - But what I was trying to say is that it doesn't matter what "View"
(in windoze Explorer) you have Set (or are using) !!!...
The File Extensions are still Hidden (or Visible) according to
whatever is Set for *that* Option & that's completely Separate
from the "View" Setting.
Aries...
|
Like this?
Aries...
|
or this?
http://www.valcopeland.co.uk/Image2.jpg
|
http://www.valcopeland.co.uk/Image1.jpg
|
|
|
That is a Global Setting (System Wide, though it may well be Settable
on a "per User" Basis, I think, but you don't have Multiple User
Accounts on your PC anyway, do you?) & that applies to all Views
in all Explorer Windows.
|
to screenprint.
|
|
|
|
Rabbit...
|
I wonder why I've got seven.
Ali...
|
|
|
|
|
|
|
|
|
uker...
Anita Carter...
|
Well, sounds as if your firewall is stopping system files exiting from your
computer - must have been set up by you - can you not hide the notification?
Aries...
|
that's what I think too but I cannot identify it in my Sygate applications
pmj...
|
First, you need to find out whether that particular Message *is*
actually being produced by your Sygate.
Aries...
|
How do I do that?
Mike Tullett...
|
I'm pretty sure it was produced by Sygate blocking
c:\windows\system32\ntoskrnl.exe. My setup used to show such a block and
you should find it listed both in "Running Applications" as well as the
full list of applications.
Aries...
|
I've just checked it in Sygate application and it is shown as allowed!!
Aries...
|
I have just seen 4 cases of application hijacking in Sygate log file -
Application Hijacking has been detected
The application: C:\Documents and Settings\Val\Local Settings\Temporary
Internet Files\Content.IE5\Y32R2HI7\PamelaSetup_Basic[1].exe try to launch
another application: C:\Program Files\Skype\Skype.exe to go to remote host
84.108.25.180
That is something I installed today!
Mike Tullett...
|
Yes, that is an add on for Skype. Sygate often gives a false alarm when
such a program (an add on here) then tries to load and run another. I'd be
pretty sure there is nothing to worry about.
Aries...
|
So problem solved do you think - maybe if I am quick enough, I will be able
to click on the do not show this message again LOL
Mike Tullett...
|
I'm 99.9999% sure it is not a problem:-) I never have Sygate constantly
popping up warning messages - not that they happen often, now I use a
router.
Aries...
|
I use a router too but still get a few warning messages !
Mike Tullett...
|
Yes, you still will when there is an *outgoing* warning, as it was in this
case.
|
pmj...
|
But a Router (most Routers, normally) only Blocks *Incoming*
Connection attempts!!!
It doesn't do anything at all [*1] about attempting to Block
*Out*going Connection attempts from Applications Running on your
PC, which is the job of the Firewall on the PC.
[*1] Some Routers *can* be Set to Block some Outgoing stuff,
but would have to be explicitly Set up to do that
|
|
|
|
|
Aries...
|
that simple eh - makes sense really LOL I guess I will just turn off the
notification messages then they won't be bothering me LOL
pmj...
|
LOL!
:-)
Yep maybe, but make sure you only turn off the Notification for
*that* particular thing, once you have decided whether or not you
do want to keep Blocking it.
Aries...
|
I don't seem to get the option of whether I should be blocking it or not,
just notification that it has been blocked!
|
You would want any *other* Messages, about other things, still
coming up.
The Message about that NTOSKRNL.EXE thing wasn't anything to do
with this "Pamela" thing, from what I can see.
The "Pamela" Query only came up when you mentioned what you saw
in the Log.
|
|
|
|
|
|
There are a number of things that might be doing the Blocking
(& thus Popping up the Message) & it's not unknown for MalWare to Pop
up False, misleading Messages, trying to get people to Panic & Click
on (or Delete/Adjust) things they shouldn't.
Aries...
Many Firewalls come with a Set of "PreSet" Rules, to cover lots
of the standard windoze Components, so you may have to look quite
deeply into the Options, to find the specific Rule that covers that.
Aries...
|
This pop up has only recently started happening, and as far as I remember
it is not due to anything I have altered or changed myself
|
|
list
|
|
|
|
Tickettyboo...
|
As others have said, you need to find out what is saying it's blocked. Do
you recognise as a Sygate ( or whatever you use) normal looking
information thing? My firewall always pops up the same looking kind of
window. If it does look like Sygate, then do you have it set to log
blocked applications? Does the block show up in the log?
Aries...
|
That's the strange thing, I cannot see it as being blocked in Sygate's log
and I don't know what is saying it's blocked but assumed it was Sygate -
now I am not so sure. I will have to see a definite legit Sygate message
pop up before I can confirm that. I will keep my eyes skimmed. All I can
say is I am not getting this particular pop up message on the desktop.
|
If you are sure it has been blocked by your firewall, then it 'could' be
that you have recently been on the update site and one of the updates has
replaced that file? My firewall would pop something up to say that the
application has been modified since I last used it and do I want to carry
on. Do a search on your harddrive to find all the instances of that file
Aries...
|
Definitely not an update pop up message as that is a distinctly different
query that pops up every time I update an application.
Do a search on your harddrive to find all the instances of that file
|
in whatever drive you are using. I did and it seems to have been replaced
Aries...
|
I have done that and I have three on my lappy - all scanned and virus free.
|
/ amended within an update labelled KB890859. I did that on 6th Jan, but I
think I reinstalled around that time, so maybe the update is a lot older
than that.
|
And question number two:
Why has Irfanview started producing greyscale pics when I post em up to the
web ? They are not greyscale when I view them?
Ali...
|
Do you mean that Irfanview is producing pics which you see in colour from
your hard disc, but in greyscale from the web?
Aries...
|
yes - that's exactly it
Aries...
|
ftp via plusnet
Ali...
|
Very strange! Try downloading one the same way, and see if it's still
grayscale. I'm assuming that other pictures on the web are still in
glorious colour?
Aries...
|
yep. No I'm not messing about any longer, I will just uninstall and
reinstall that should fixted it LOL
Ali...
|
Why do you think it is Irfanview to blame, and not the ftp program?
Aries...
|
Simply because when I ftp a pic saved from psp or photoshop the result is
in colour
Ali...
|
Ok, but if a pic on your hard disk shows in colour, but the supposedly
identical copy of it on your web space shows in greyscale, the program that
created it wouldn't be the first place I'd be looking.
Does your local copy show in greyscale when viewed with your browser?
(Trying to eliminate all possible sources of difference)
Aries...
|
yes but problem solved now as I have reinstalled Irfanview :)
|
|
|
|
|
|
|
|
Have you got 'Save in greyscale' ticked in the JPEG/GIF save options?
Aries...
|
Not that I can see, and I have not deliberately set it like that
|
|
Tickettyboo...
|
Cos you prolly brokted summat :-)
Aries...
|
Ta muchly for any useful comments :)
|
|
