is-it-a-fish, that helps. As I have admitted before, understanding the firewall operation & windows itself is an ongoing struggle for me. To put an answer in plain language is always my goal. If I can't, then second best is linking to technical discussions.
Compedia here defines
generic host processes for win32 as:
Also known as: svchost.exe
Svchost.exe is a program that loads Windows services that are in the form of dynamic-link libraries (DLLs). It is possible for more than one svchost.exe to be running at one time, with more than 1 service being controlled by that process.
system I understand to be just that. The process you find in the task manager.
NT Kernal is
defined by microsoft in this one of 2.5 million google responses. I'm sorry I can'y summarize it well for you (or myself)
I can say this: all three of those I allow access to when considering what to do about them in regards to the firewall. Denying them does effect things. For instance, hyperlinking using Excel or Word documents is broken when you deny the generic host process for win32. I've done that trial & error.
In short, they are all windows-related. I haven't had any malware-related problems attached to them precisely. Which is not to say someone else may have a better answer. I set
sygate to "ask" when they "call to have access". Seems to work fine for me.