System folder, seems unusual

Help for v3
1

Hi,
I’m wondering if any of you out there have noticed this thing I’ve recently started to notice.
As I often install new programs, and uninstall, I thus Purge the rules for the Firewall and Defense+.
I have noticed I’m often, these day’s, deleting a rule for a folder called System. This system folder has an icon of a folder in both the firewall and defense rule lists. It is the only item to use a folder for an icon. I started thinking it may be unusual for an entire folder to have a permission rule. And, this is the only item in the rule list that does not have an address to where this folder is, unlike all the other windows and other pgm process rules.

(Some time ago, prior to this subject I’m talking about, I did a rootkit scan, and found a folder in the registry called System, I finally found out it came from an O&O defrag trial software I installed, and uninstalled. So, I’m gettin wise to someone callling a folder “System”. Like calling it that makes it seem ok.)

So, I’m wondering what you make of a folder callled System that I seem to be purging often, yet remains in the rules. And it remains in those rules without an address, so I don’t know what system exactly is being talked about.

Any ideas would be appreciated.

2

Take a look at the thread https://forums.comodo.com/empty-t22795.0.html for a little more information on the unusual entrys “system” and “windows operating system”.

3

Thanks sded,
I do use tcpview from time to time to see. And yea, there are a few System entries there too.
Pretty darn generic word.
Ok, are you thinking that a windows service, like if I ran the Event Viewer, would cause a new rule, and then that rule would be able to be purged later for whatever reason?

Well, I don’t know, and that’s the problem. Odds are this is no big deal, but as long as I try to remain secure I gotta figure out things that don’t add up.

I think I’m going to delete those rules and see what happens. I’ll probably get some more info when it tries to fire up again.

I appreciate the input. And right on for recommending sysinternals, those are some really cool tools they got there, everybody needs to know about them.