System wants out ?

Got a few of these since i installed yesterday, you seen them ?

OA says it's safe, i'm presuming they mean the file is as it's a core MS one. But could some nasty make use of this as a way out ? If so it wouldn't be wise to permanently allow it.

What do you think ?

 

System usually prompts access to Intranet (not internet), your network, if you're on one. If you have certain services over a lan enabled (file sharing) it will be for this purpose. Usually ports 137, 138, 139, 445. I guess if you don't want to you could deny System ... it shouldn't really be a problem.

 

If you have a single pc you can easy deny it.

 

That alert is sorely lacking in the information needed to make that decision. What process is asking? Connect out to where? What port? What protocol?

 

Keyboard_Commando

I have both a modem & router, but i'm only using the modem right now. The router software & connection etc is set up in the PC, but the router is physically disconnected. Maybe it tried to find it ? Funny thing is, today i havn't seen an alert for it, yet, so ?

blacknight

Yes i have, no sharing here.

noone_particular

Exactly my thoughts, and possible fears. I wish i knew. If it happens again i'll run some other Apps to try and find out. Just wondered if anyone else had ever seen System doing this. Maybe they wouldn't release it has/does because not many Apps would alert to this i don't think ?

I'm not saying it was malicious in my case, but the potential is there i believe if some nasty was inside someones PC that could make use of it.

 

That's the problem. There's no way to tell without more information. The only time I've seen "system" with Kerio 2.1.5 was for NetBIOS connections. Did "where is this program located" point to any specific executable or component?
Assuming that "system" referrs to the core operating system, I'd block it on that basis. The OS itself doesn't need internet access, at least the ones I use don't.

 

I got the exact same pop-up last week while auditioning OA's latest version on XP Pro.

I agree; the request gives no useful information to help make a decision, so I clicked "Block" and moved on without any problem.
The mystery request appeared only once.

I run a single computer (no network) and have a wired router.
I would like to know what the request refers to and I hope OA fixes this, as it could lead to a serious security breach or, on the other hand, perhaps a denial of service.

 

noone_particular

Hi,

"where is this program located" pointed nowhere, which i didn't like. Not saying it was OA's fault, but it's a bit suspicious i felt, not of OA but as to what was happening.

I have disabled NetBIOS over TCP in properties for the modem.

Yes i assumed it was a core MS file, but who knows, and even if it was, as you say, it's best to block it, which i did and would again. What would it be doing wanting out anyway ? Something must have triggered it, but what/why/how ?

Very strange indeed.

Edit -

wtsinnc

Hi, just seen your post.

Well at least someone else has seen it !

I'm not sure if it's OA falsely detecting something, or a real alert for something dodgy ?

I hope Mike Nash can answer soon.

 

I did a bit of poking around with my Online Armor firewalled computer ...

I think this initial pop up is System asking to function in the Program Access tab ... as a part of Windows processes. I deleted System from the rules list and started again, after a while it gave me the pop up you have posted, and then a little while on it requested an Intranet connection (UDP OUT 137-8 )

In your case, as you are not on a network, go to Program access tab and block System. I think its safe enough to block. I have System blocked on another computer and it doesn't cause any problems.

 

So I always believed. Probably System depends from some other Windows Service that normally runs. I have few Services running in my system, and very few setted in automatic, so I almost never saw it calling the internet connection.

 

Keyboard_Commando

I did look in the Program access tab to try and block System, but it's not there ? It happened a few more times yesterday, but today it hasn't appeared.

Yesterday i untrusted and blocked some more stuff, such as Google Updater which i believe is part of Google Earth i recently installed. I noticed on a Vista PC i was using until last week, it seemed to want to update several times a day, even if not used ! See screenie. I wonder if it was that ?

You say you have System blocked on another computer and it doesn't cause any problems. Good news, but not on your present PC ?

blacknight

Yeah the less Services etc running the better, i agree.

" almost never saw it calling the internet connection " But that means you have. Can you remeber what it was related to ?


Thanx all.

 

Hi there.

If System chimes up again click block. The System rule is in Firewall - Program Access, the next time it appears, when you block it ... it will be there.

I have System allowed on my laptop, for wireless. I have a feeling disabling would stop wireless working, I will give a whirl disabled and see what happens. Like I said ... on my other computer I have blocked System and it doesn't cause me any problems.

But yeah ... OA's System popup is a bit too anonymous for my liking, also; when you move the cursor over the System rule no location shows, but every other rule tab reveals the location - a brief description would be better than nothing IMO.

 

Wireless works ok on my laptop with System blocked. I don't get why System pops up seeing I have file and printing disabled. Neways

 

I don't run online armour but I suspect a netbios connection. You can safely disable netbios if you do not have a network and usually you can disable it even if you have a network. It is required if you have a windows 2000 machine on your network. Some servers require it.

To disable netbios: Start > Control panel > network connections > right click the connection you wish to disable it on > properties > General tab > double click internet protocol (TCP/IP) > under the general tab click advanced > WINS tab > select disable Netbios over TCP/IP > OK your way out.

These instructions are for XP. If you experiece network issues enable it.

Regards,
Dave

Edit for clarity

 

Keyboard_Commando

" The System rule is in Firewall - Program Access " Havn't seen it ?

Did you try the disable ?

" a brief description would be better than nothing IMO. " I agree.

David Silvers

Hi, i had previously disabled it via the WINS tab as you suggested, but this doesn't seem to effect it ?

Anyway Thanx for the tip, which is a good one for those not already knowing how to do it

Regards,

S