System wants out ?

Discussion in 'other firewalls' started by StevieO, Jul 28, 2009.

Thread Status:
Not open for further replies.
  1. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Got a few of these since i installed yesterday, you seen them ?

    OA says it's safe, i'm presuming they mean the file is as it's a core MS one. But could some nasty make use of this as a way out ? If so it wouldn't be wise to permanently allow it.

    What do you think ?
     

    Attached Files:

    • sys.png
      sys.png
      File size:
      11.4 KB
      Views:
      625
  2. Keyboard_Commando

    Keyboard_Commando Registered Member

    Joined:
    Mar 6, 2009
    Posts:
    690
    System usually prompts access to Intranet (not internet), your network, if you're on one. If you have certain services over a lan enabled (file sharing) it will be for this purpose. Usually ports 137, 138, 139, 445. I guess if you don't want to you could deny System ... it shouldn't really be a problem.
     
  3. blacknight

    blacknight Registered Member

    Joined:
    Sep 25, 2007
    Posts:
    2,434
    Location:
    Europe

    If you have a single pc you can easy deny it.
     
  4. noone_particular

    noone_particular Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    3,798
    That alert is sorely lacking in the information needed to make that decision. What process is asking? Connect out to where? What port? What protocol?
     
  5. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Keyboard_Commando

    I have both a modem & router, but i'm only using the modem right now. The router software & connection etc is set up in the PC, but the router is physically disconnected. Maybe it tried to find it ? Funny thing is, today i havn't seen an alert for it, yet, so ?

    blacknight

    Yes i have, no sharing here.

    noone_particular

    Exactly my thoughts, and possible fears. I wish i knew. If it happens again i'll run some other Apps to try and find out. Just wondered if anyone else had ever seen System doing this. Maybe they wouldn't release it has/does because not many Apps would alert to this i don't think ?

    I'm not saying it was malicious in my case, but the potential is there i believe if some nasty was inside someones PC that could make use of it.
     
  6. noone_particular

    noone_particular Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    3,798
    That's the problem. There's no way to tell without more information. The only time I've seen "system" with Kerio 2.1.5 was for NetBIOS connections. Did "where is this program located" point to any specific executable or component?
    Assuming that "system" referrs to the core operating system, I'd block it on that basis. The OS itself doesn't need internet access, at least the ones I use don't.
     
  7. wtsinnc

    wtsinnc Registered Member

    Joined:
    Oct 3, 2008
    Posts:
    943
    I got the exact same pop-up last week while auditioning OA's latest version on XP Pro.

    I agree; the request gives no useful information to help make a decision, so I clicked "Block" and moved on without any problem.
    The mystery request appeared only once.

    I run a single computer (no network) and have a wired router.
    I would like to know what the request refers to and I hope OA fixes this, as it could lead to a serious security breach or, on the other hand, perhaps a denial of service.
     
  8. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    noone_particular

    Hi,

    "where is this program located" pointed nowhere, which i didn't like. Not saying it was OA's fault, but it's a bit suspicious i felt, not of OA but as to what was happening.

    I have disabled NetBIOS over TCP in properties for the modem.

    Yes i assumed it was a core MS file, but who knows, and even if it was, as you say, it's best to block it, which i did and would again. What would it be doing wanting out anyway ? Something must have triggered it, but what/why/how ?

    Very strange indeed.

    Edit -

    wtsinnc

    Hi, just seen your post.

    Well at least someone else has seen it !

    I'm not sure if it's OA falsely detecting something, or a real alert for something dodgy ?

    I hope Mike Nash can answer soon.
     
  9. Keyboard_Commando

    Keyboard_Commando Registered Member

    Joined:
    Mar 6, 2009
    Posts:
    690
    I did a bit of poking around with my Online Armor firewalled computer ...

    I think this initial pop up is System asking to function in the Program Access tab ... as a part of Windows processes. I deleted System from the rules list and started again, after a while it gave me the pop up you have posted, and then a little while on it requested an Intranet connection (UDP OUT 137-8 )

    In your case, as you are not on a network, go to Program access tab and block System. I think its safe enough to block. I have System blocked on another computer and it doesn't cause any problems.
     
  10. blacknight

    blacknight Registered Member

    Joined:
    Sep 25, 2007
    Posts:
    2,434
    Location:
    Europe

    So I always believed. Probably System depends from some other Windows Service that normally runs. I have few Services running in my system, and very few setted in automatic, so I almost never saw it calling the internet connection.
     
  11. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Keyboard_Commando

    I did look in the Program access tab to try and block System, but it's not there ? It happened a few more times yesterday, but today it hasn't appeared.

    Yesterday i untrusted and blocked some more stuff, such as Google Updater which i believe is part of Google Earth i recently installed. I noticed on a Vista PC i was using until last week, it seemed to want to update several times a day, even if not used ! See screenie. I wonder if it was that ?

    You say you have System blocked on another computer and it doesn't cause any problems. Good news, but not on your present PC ?

    blacknight

    Yeah the less Services etc running the better, i agree.

    " almost never saw it calling the internet connection " But that means you have. Can you remeber what it was related to ?


    Thanx all.
     

    Attached Files:

  12. Keyboard_Commando

    Keyboard_Commando Registered Member

    Joined:
    Mar 6, 2009
    Posts:
    690
    Hi there.

    If System chimes up again click block. The System rule is in Firewall - Program Access, the next time it appears, when you block it ... it will be there.

    I have System allowed on my laptop, for wireless. I have a feeling disabling would stop wireless working, I will give a whirl disabled and see what happens. Like I said ... on my other computer I have blocked System and it doesn't cause me any problems.

    But yeah ... OA's System popup is a bit too anonymous for my liking, also; when you move the cursor over the System rule no location shows, but every other rule tab reveals the location - a brief description would be better than nothing IMO.
     
  13. Keyboard_Commando

    Keyboard_Commando Registered Member

    Joined:
    Mar 6, 2009
    Posts:
    690
    Wireless works ok on my laptop with System blocked. I don't get why System pops up seeing I have file and printing disabled. Neways :doubt:
     
  14. I don't run online armour but I suspect a netbios connection. You can safely disable netbios if you do not have a network and usually you can disable it even if you have a network. It is required if you have a windows 2000 machine on your network. Some servers require it.

    To disable netbios: Start > Control panel > network connections > right click the connection you wish to disable it on > properties > General tab > double click internet protocol (TCP/IP) > under the general tab click advanced > WINS tab > select disable Netbios over TCP/IP > OK your way out.

    These instructions are for XP. If you experiece network issues enable it.

    Regards,
    Dave

    Edit for clarity
     
    Last edited by a moderator: Jul 31, 2009
  15. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Keyboard_Commando

    " The System rule is in Firewall - Program Access " Havn't seen it ?

    Did you try the disable ?

    " a brief description would be better than nothing IMO. " I agree.

    David Silvers

    Hi, i had previously disabled it via the WINS tab as you suggested, but this doesn't seem to effect it ?

    Anyway Thanx for the tip, which is a good one for those not already knowing how to do it

    Regards,

    S
     
Loading...
Thread Status:
Not open for further replies.