Norton Internet Security / Norton AntiVirus

[RL]

I have Norton Security System 2011, Windows XP

Is there a legitimate program named SYSTEM that would need access through the firewall? There is no info displayed on it like Path, or Publisher, or Digital signature. The info I got from the log file was Traffic Description: Outbound UDP, Port 138.

Is this a core system file, or a trojan masking as a system fie?

Also is there a guide somewhere how to configure the firewall for maximum security (meaning deny rather than allow) other than the setting Block All Network Traffic?

Thanks

[bjm_]

Welcome to the Community

re > I have Norton Security System 2011, Windows XP

Please advise Norton Security System 2011 version # ~~~ Support > About

Please advise are you running Norton Internet Security NIS11  or

Comcast Norton Security Suite

Please advise Windows XP Sevice Pack #     32/64 bit

[delphinium Norton Fighter]

System is your operating system.  It needs a good deal of access to the net in order to handle all of the requirements for multiple Windows applications.  It has to communicate with the router or DSL and it has to communicate with many different parts of itself.

[SendOfJive Norton Fighter]

Hi RL,

"System" is a legitimate entry in the Program Control list.  The best configuration for your Norton Smart Firewall is to leave it set to the defaults.  The Smart Firewall examines all traffic and is able to identify anything that looks suspicious.  Users usually get into trouble when they feel that they need to manage the firewall and block anything that they are unfamiliar with.  There are pitfalls in manually setting firewall rules, and this should be done only if you have some expertise and know what it is you are blocking and why.  Blocking the wrong thing can have detrimental consequences to the performance and security of your PC, which is why it is best to let the Automatic Program Control handle things.   "Block All Network Traffic," for example, is for specific instances where all communications need to be stopped.  This is not a setting that you should be using on other than a handful of occasions.