I couldn't understand:
Try and enable an incoming connection and see how far you get

I am sure I didn't run icf...
and my os is XP pro 2002 with sp1...
and the alert is still appear,but the source IP port is different..