Well there is a possibility that something is using System, so you need to check what, process explorer is one but one I favour is a command line to delve into it

Find out what is using the SVCHOST Service.
Windows Start, Run, type (or copy and paste) “cmd.exe /k tasklist /svc > c:\tasklist.txt” without the quotes - this opens a command window and runs the tasklist for services, the > c:\tasklist.txt outputs the results to the file and location given:

svchost.exe 1020 DcomLaunch, TermService svchost.exe 1080 RpcSs svchost.exe 1108 AudioSrv, BITS, CryptSvc, dmserver, EventSystem, helpsvc, HidServ, Netman, Nla, RasMan, Schedule, SENS, SharedAccess, ShellHWDetection, TapiSrv, Themes, winmgmt, wscsvc, wuauserv

What does your firewall log say was accessing port 120 ?