Strange. Absolute Strange!!!!!!

Hello all!
Today something very strange is happening on my network. When i started my PC my KERIO firewall is always asking me what to do with one incoming conection.

_______________________________________________-
[08.12.2004 ã. 21:43:49]

Direction: incoming
Local Point: 0.0.0.0, port 1025
Adapter: SiS 900-Based PCI Fast Ethernet Adapter - Packet Scheduler Miniport
Remote Point: 213.91.228.206 [213.91.228.206], port 4502
Protocol: TCP

Application path: System
Description: system
File version:
Created: N/A
Modified: N/A
Accessed: N/A

RuleId = 536870933
_________________________________
The IP from where it is comming i know! I spoke with the man to whom belong the IP and he told me that he does nothing( and i can trust him 100%)
Can someone tell me what the hell is going on here.
What is that aplication system? Is he trying to use remote control of windows?
Please any suggestion?

do you think it is possible his computer has been infected / hijacked / compromised and your computer has been attacked and could also be infected / hijacked / compromised ?

1024 - the port you're talking about is RPC.... How can you trust him exactly? What makes you think he's OK too trust? Do you allow him to know your IP? What exactly made you think he was OK?

He is a friend of me. We live in the same building. And we use LAN chat enterprise for comunication(so he must know my IP). Ah, and few minutes ago i was visiting him and i found out he has a worm svcsp.
And gore what means RPC?

RPC = Remote Procedure Call .. can be used by a service for legit means, or in your case by a worm to propogate to another machine.

Taking this a step further, port 1025 is MSTask Scheduler. Also, look at your rule ID number (RuleId = 536870933) and reference it on the support page provided by your vendor. It will surely tell you when, how and why it triggers.

If you REALLY want to know what is up, fire up ethereal and watch the network traffic from his host to yours.