I spent a fruitless hour yesterday on this, so I thought I'd try it again today.

I have searched for this extensively, and have found many references to Sygate specifically blocking access of ntoskrnl.exe, but almost exclusively Sygate. One review of the product mentioned that filesharing was blocked when they allowed it to block the file, and was re-enabled when they allowed it:

http://www.pcw.co.uk/personal-computer-world/software/2043598/sygate-personal-firewall

So if you are sharing files or printers on your home network, this could happen as a result.

Also: Sygate itself was bought out by Symantec, sometime in the 2005-2006 timeframe. Because of this, some Sygate info is no longer available. I used the Wayback Machine to locate a reference to the Sygate forums talking about this issue (as far back as 2005). The reference is here:

http://web.archive.org/web/20050527195904/http://forums.sygate.com/vb/showthread.php?threadid=12989

Be patient, takes a while to load. One of the posters said this:

"To tie it together a little better:

All modern operating systems (and many apps for that matter) have a highly modularized design architecture in order to make it easier to design, impliment, and maintain.

As a result, there needs to be a process which provides for overall execution control and resource allocation.

In operating systems, the role is provided by the "kernel". All MS operating systems have an executeable or dll for this.

One of the reasons (there are others) you periodically see the "kernel" get blocked in Windows, is that since 98 came out, MS has increasingly tied internet based functionality into all aspects of the operating system.

What happens in many cases, is you will have been running an application which makes use of some native Windows internet functionality, and then have moved on to something else. When the app closes out, it releases its links to the various modules it was using and Windows returns the freed resources to the "general" pool.

However, There is one last thing which needs to happen which is to properly shutdown the TCP connection which was established. If the the originating app doesn't handle this itself or has exited before the connection is shut down completely, the kernel takes over the role of monitoring for the "handshake" traffic from the port reset, since the allocated socket can't be left "abandoned".

You can see this in operation using a tool like Netmon for example (you will see a dying connection shown in the "time wait" state). If the timeout expires the connection will close at your end, regardless if the expected reponse was received.

At this point, if there is no firewall, the kernel would send a "reset/ack" packet back to inform the sender the connection is closed. If you have blocked the kernel, you get the popup, and no response is sent back.

Another possibility, again due to the tight integration of internet functionality, is if traffic (both internal or external) arrives which the running apps don't know what to do with, it will be directed back to the kernel to try and figure out what's going on, which can lead to popups depending on the circumstances.

As Jarmo has suggested, since MS Networking housekeeping traffic is handled by the kernel, it is possible to have the kernel get blocked, even if you have explicitly allowed it as an "app", due to a violation of one of the security options (NetBIOS protection for example), or an advanced rule due the order of processing in SPF.

HTH,

Alinator"

So the ntoskrnl.exe sometimes does some cleanup of session traffic, so it *does* have a reason to occasionally access the network.

Between one of the reasons, it seems likely that this is just a normal aberration of Sygate, and not an infected file, particularly since it was so prevalent for Sygate in that timeframe. I would run a full scan with up-to-date definitions, and if it came out clean, I wouldn't worry about it any more. The couple of viruses that have affected ntoskrnl.exe in the past are so old that they should be detected by any decent virus scanner.

I wish I could give you a more definitive answer, but if it were my machine, I wouldn't sweat it if it scans clean. As to why it could have changed, Windows updates have done that in the past (regarding ntoskrnl.exe).

Have you made any significant updates to your machine since this began, ie service-pack upgrades to Windows XP? The NT Kernel is the brain of your computer, though "Kernel System" is backward, it is usually "System Kernel" which makes this a bit suspicious. I've included a link to a discussion of possible virus infection by the Bolzano virus, if it has recurred in some form, though it is years old and not especially dangerous at this point. Otherwise, I asked about changes such as Service Packs installed since those might actually have changed your kernel. Under normal circumstances your kernel will not change (this can amount to brain surgery for your computer, so is not undertaken often).

I would, since it's a good idea anyway, run a full virus scan using a couple products. If you have anti-virus software already, you can supplement it with a scan using AVG Anti-virus (http://free.avg.com/) or ClamWin (http://www.clamwin.com) both of which are free versions. You should also probably run separate scans for malware/adware. I still use Spyboot Search and Destroy, and there are other free products out there that will also work. Running different products is important, because no one has 100% effectiveness in scanning or combating every piece of malware. If two products both individually have 95% efficiency, collectively they top 99%.