I have observed this a lot of times with the firewall. I get an alert for a certain connection (don’t exactly remember now what alert it is) when the the firewall is disabled. The timing of the alert is always the same, it is given immediately after logging in.
We’re going to need a little more to go on here…
What does the alert say?
I don’t exactly remember what the alert was for, but I know that it is always the “svchost.exe” and the “system” connecting to something - the first alerts you get after installing the firewall, and after logging into your account, after a restart.
I just restarted my system and got this alert -
Firewall Alert: System is trying to receive a connection from the Internet. Application: System. Remote: 220.127.116.11. Port: Ms-Dos(445).