Beyn
2004-09-29, 10:41:19
Hi, ich hab ein Problem. Seit dem ich Service Pack 2 installiert habe, ändern sich ein paar System Files immer und die wollen sich natührlich mit dem Internet verbinden, was ich jedoch nicht will. Meine Firewall hat sie auch blockiert. Nur verändern sie sich halt immer und ich muss nach jedem Restart die Fenster 3-4 mal wegklicken. Das nervt! Ich benutze Sygate Personal Firewall 5.5. Wenn ich den Zugang für die Files erlaube, dann kommen die Fenster trotzdem, mit der ähnlichen Meldung....
Kann ich die Files irgendwie temporär blockieren oder sie sich nicht verändern lassen? Hier ein Beispiel von der FW Meldung:
"NT Kernel_System has changed since the last time you used it. This could happen if you have updatet it recently. Do you want to allow it to acces the network?
The executable has changed since the last time you used: C:\WINDOWS\system32\ntoskrnl.exe
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
File Description : NT Kernel & System
File Path : C:\WINDOWS\system32\ntoskrnl.exe
Process ID : 0x4 (Heximal) 4 (Decimal)
Connection origin : local initiated
Protocol : UDP
Local Address : 169.254.185.121
Local Port : 137
Remote Name :
Remote Address : 169.254.255.255
Remote Port : 137 (NETBIOS-NS - Browsing requests of NetBIOS over TCP/IP)
Ethernet packet details:
Ethernet II (Packet Length: 106)
Destination: ff-ff-ff-ff-ff-ff
Source: 00-a0-c5-39-6f-5e
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 20 bytes
Flags:
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 128
Protocol: 0x11 (UDP - User Datagram Protocol)
Header checksum: 0x222d (Correct)
Source: 169.254.185.121
Destination: 169.254.255.255
User Datagram Protocol
Source port: 137
Destination port: 137
Length: 8
Checksum: 0x8221 (Correct)
Data (58 Bytes)
Binary dump of the packet:
0000: FF FF FF FF FF FF 00 A0 : C5 39 6F 5E 08 00 45 00 | .........9o^..E.
0010: 00 4E 00 07 00 00 80 11 : 2D 22 A9 FE B9 79 A9 FE | .N......-"...y..
0020: FF FF 00 89 00 89 00 3A : 21 82 80 01 01 10 00 01 | .......:!.......
0030: 00 00 00 00 00 00 20 46 : 48 46 41 45 42 45 45 43 | ...... FHFAEBEEC
0040: 4F 43 41 43 41 43 41 43 : 41 43 41 43 41 43 41 43 | OCACACACACACACAC
0050: 41 43 41 43 41 41 41 00 : 00 20 00 01 C0 0C 00 20 | ACACAAA.. .....
0060: 00 01 00 04 93 E0 00 06 : 00 00 | ..........
Und noch ein zweites :
"Generic Host Process for WIn32 Services has changed.,.
The executable has changed since the last time you used: C:\WINDOWS\system32\svchost.exe
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
File Description : Generic Host Process for Win32 Services
File Path : C:\WINDOWS\system32\svchost.exe
Process ID : 0x590 (Heximal) 1424 (Decimal)
Connection origin : local initiated
Ethernet packet details:
Ethernet II (Packet Length: 68)
Destination: 01-00-5e-00-00-16
Source: 00-a0-c5-39-6f-5e
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 24 bytes
Flags:
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 1
Protocol: 0x2 (IGMP - Internet Group Management Message Protocol)
Header checksum: 0xde1 (Correct)
Source: 169.254.185.121
Destination: 224.0.0.22
Binary dump of the packet:
0000: 01 00 5E 00 00 16 00 A0 : C5 39 6F 5E 08 00 46 00 | ..^......9o^..F.
0010: 00 28 00 34 00 00 01 02 : E1 0D A9 FE B9 79 E0 00 | .(.4.........y..
0020: 00 16 94 04 00 00 22 00 : EA 03 00 00 00 01 04 00 | ......".........
0030: 00 00 EF FF FF FA 00 00 : 20 46 47 45 50 46 47 45 | ........ FGEPFGE
0040: 42 43 41 43 : | BCAC
Kann ich die Files irgendwie temporär blockieren oder sie sich nicht verändern lassen? Hier ein Beispiel von der FW Meldung:
"NT Kernel_System has changed since the last time you used it. This could happen if you have updatet it recently. Do you want to allow it to acces the network?
The executable has changed since the last time you used: C:\WINDOWS\system32\ntoskrnl.exe
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
File Description : NT Kernel & System
File Path : C:\WINDOWS\system32\ntoskrnl.exe
Process ID : 0x4 (Heximal) 4 (Decimal)
Connection origin : local initiated
Protocol : UDP
Local Address : 169.254.185.121
Local Port : 137
Remote Name :
Remote Address : 169.254.255.255
Remote Port : 137 (NETBIOS-NS - Browsing requests of NetBIOS over TCP/IP)
Ethernet packet details:
Ethernet II (Packet Length: 106)
Destination: ff-ff-ff-ff-ff-ff
Source: 00-a0-c5-39-6f-5e
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 20 bytes
Flags:
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 128
Protocol: 0x11 (UDP - User Datagram Protocol)
Header checksum: 0x222d (Correct)
Source: 169.254.185.121
Destination: 169.254.255.255
User Datagram Protocol
Source port: 137
Destination port: 137
Length: 8
Checksum: 0x8221 (Correct)
Data (58 Bytes)
Binary dump of the packet:
0000: FF FF FF FF FF FF 00 A0 : C5 39 6F 5E 08 00 45 00 | .........9o^..E.
0010: 00 4E 00 07 00 00 80 11 : 2D 22 A9 FE B9 79 A9 FE | .N......-"...y..
0020: FF FF 00 89 00 89 00 3A : 21 82 80 01 01 10 00 01 | .......:!.......
0030: 00 00 00 00 00 00 20 46 : 48 46 41 45 42 45 45 43 | ...... FHFAEBEEC
0040: 4F 43 41 43 41 43 41 43 : 41 43 41 43 41 43 41 43 | OCACACACACACACAC
0050: 41 43 41 43 41 41 41 00 : 00 20 00 01 C0 0C 00 20 | ACACAAA.. .....
0060: 00 01 00 04 93 E0 00 06 : 00 00 | ..........
Und noch ein zweites :
"Generic Host Process for WIn32 Services has changed.,.
The executable has changed since the last time you used: C:\WINDOWS\system32\svchost.exe
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
File Description : Generic Host Process for Win32 Services
File Path : C:\WINDOWS\system32\svchost.exe
Process ID : 0x590 (Heximal) 1424 (Decimal)
Connection origin : local initiated
Ethernet packet details:
Ethernet II (Packet Length: 68)
Destination: 01-00-5e-00-00-16
Source: 00-a0-c5-39-6f-5e
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 24 bytes
Flags:
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 1
Protocol: 0x2 (IGMP - Internet Group Management Message Protocol)
Header checksum: 0xde1 (Correct)
Source: 169.254.185.121
Destination: 224.0.0.22
Binary dump of the packet:
0000: 01 00 5E 00 00 16 00 A0 : C5 39 6F 5E 08 00 46 00 | ..^......9o^..F.
0010: 00 28 00 34 00 00 01 02 : E1 0D A9 FE B9 79 E0 00 | .(.4.........y..
0020: 00 16 94 04 00 00 22 00 : EA 03 00 00 00 01 04 00 | ......".........
0030: 00 00 EF FF FF FA 00 00 : 20 46 47 45 50 46 47 45 | ........ FGEPFGE
0040: 42 43 41 43 : | BCAC