"A remote system is attempting to access Microsoft Windows Explorer"?

[Mean_Chlorine]

Every now and then, usually shortly after restarting the system,
Norton Personal Firewall pops up an allow/deny requester with the
message that "A remote system is attempting to access Microsoft
Windows Explorer", and suggests that access should be allowed.
As I can see no legitimate reason for anyone to access Explorer (note
that this is not INTERNET explorer), I've always denied the request,
and haven't noticed any bad effects, but I still wonder what this
might be.

I did ask Norton to analyse the threat, and the call is purporting to
come "from a local address" on my network - which seems unlikely,
given that this machine is the _only_ machine on my network.
It doesn't necessarily have to be a spoofed call, it could be a local
process attempting to log in, e.g. Norton Firewall itself.

So - any ideas what this might be, or how to check up on it more
thoroughly?

 

[David]

Check the logs of NIS and see if you can find the IP address of the remote
system. In the Statistics window, click on View Logs. Then check the
connections and there should be an entry where you denied access.
If the address looks foreign, I'd recommend adding it to your blocked list.

 

[Mean_Chlorine]

Check the logs of NIS and see if you can find the IP address of the remote
system.

Found it. Bizarrely, the IP number resolves as the IANA register. I
can't see why IANA would connect to my Windows Explorer. Smells of
spoofing to me.