Trojan?

[ricmitch_uk]

A few days back, my firewall picked up krnl386.exe trying to access the net. I checked this out and the program's version info seems authentic enough, but should my Windows Kernel Core be accessing the net?
Norton Firewall keeps blocking something with the:
"Default block Subseven/Backdoor trojan" rule. I checked the registry, and msconfig.exe but I can't find anything incriminating.
Does anyone have any info?

[zmerlinz]

My computers firewall picks up kernel386 quite often but i don't think that it is doing any harm, programs like messanger or my virus checker when it needs to update send that through first

[Jethro]

Damn l thought this was going to be a thread about condoms

This one time at band camp.....

[ricmitch_uk]

Originally posted by Jethro
Damn l thought this was going to be a thread about condoms

This one time at band camp.....

Why??

[ricmitch_uk]

Whatever this thing is my firewall's blocking it's using port:
27374

[chrisjk]

I have Norton too and it also seems the Win Kernal wants t access the internet (sometimes it says Explorer) . I made a rule telling it to disallow every time with no adverse effects. I occasionally get an app called "@x$%&" or something like that trying to do the same, I always say no to that.

[Illspirit]

BEWARE!!! 27374 is the default Sub7 port!!!!

Try running the exe when your offline, and if nothing happens, check the size of the exe. If its about 380kb then i think you should get rid of it!

[ricmitch_uk]

The port number it uses is the reason it's being blocked. However it is not the krnl386.exe that is causing these alerts, it is another program which I haven't determined yet. (krnl386.exe is about 120KB)

[lord_dude]

Instead of potentially deleting something needed by windows, y not just get a virus scanner. They also detect trojans.

[ricmitch_uk]

I have Norton AV but I wasn't sure whether it would pick it up. It didn't get Kak, I used my own personal skills to spot that and remove it.

[lord_dude]

Thats very odd. Norton is supposed to be one of the best. Did u have all the lattest updates?

[ricmitch_uk]

Yeah. I update every month. I'm no fool when it comees to virii. I also enable the detect unknown virii thing as well. AV and Firewall are constantly running on my system, since I've been on certain websites, attacks have increased 2 fold.

[V(ery) Basic]

Why is it that somebody like me (no firewall, virus scanner or security features of any sort) never gets a virus?

I feel left out. It is as if they don't care about me

[chrisjk]

Nope, you're just VERY lucky never to have been probed. Don't push your luck anymore though.

[lord_dude]

Originally posted by V(ery) Basic
Why is it that somebody like me (no firewall, virus scanner or security features of any sort) never gets a virus?

I feel left out. It is as if they don't care about me

A firewall is most important. Viruses can usually be avoided by being careful what you download and by not using outlook or outlook express. I agree with chrisjk. zonealarm is free from www.zonelabs.com.