From your description, its not actively trying to send data, its listing =
for incoming data. You may have a backdoor trojan on your system.

http://pestpatrol.com/pestinfo/t/tel...server_1_0.asp

The above link gives one example.

--=20
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.
=20
"David Hetherington" wrote =
in message ...
Hey all,
I just wanted to ask if anyone else has had this happen.
XP SP2 was installed a few days ago, and now there is an error showing =
up on=20
the log on screen that the security log is full and has to be cleared =
by the=20
administrator.
The Event ID is listed as a security event and id is 861.
The Windows Firewall has detected an application listening for =
incoming=20
traffic.=20
Here are the details on it.
=20
Name: -=20
Path: C:\WINDOWS\system32\lsass.exe=20
Process identifier: 1276=20
User account: SYSTEM=20
User domain: NT AUTHORITY=20
Service: Yes=20
RPC server: No=20
IP version: IPv4=20
IP protocol: UDP=20
Port number: 1106=20
Allowed: No=20
User notified: No
=20
=20
I know that I can just set the firewall to allow this program but what =
is it=20
and why does it need access out, and if it is important why did it not =

automaticly receive access out.
Thanks guys and gals.
=20
=20