OT: How do I now whats legit

[Sinster]

what is tripping my firewall. Like I get a NTKERNAL.exe for outgoing traffic. Some SVHOST.exe , explorer, and others

 

[Qumahlin]

explorer and svchost are always gonna want to contact out, they are the main windows components and svchost controls all the network protocols and services.

 

[gothic]

SVHost legitimately wishes server rights, and is ok, as is the applications layer gateway, but i'd draw the line at NTKernal. There should be no reason why it should request export / server rights. Your Generic Hosts Processes may also request server rights, which should be granted.

The only one I adamantly refuse to give server rights to is Explorer, I tend to get very paranoid, especially when I Neotraced the given address as going straight back to your mate B.Gates!!!!

(My argument is that I will contact Microsoft when I want, NOT when XP thinks I want.

TOK