Loopback 127.0.0.1:80 ?? any ideas

  The Rep 17:20 19 Jan 2004
Locked

Hello, over the last 72 hrs Zonealarm has been blocking upwards of 150 alerts from this IP Loopback 127.0.0.1:80. These alerts are locking my internet connection. An scan with updated adaware and AVG antivirus have shown nothing.

Please if you can help get in touch....

Many thanks

The Rep

BT dial up internet
WINXP pro SP1
P4 2.4
GF3Ti 200
512mb Ram
Adaware 6 ref file 01R247 10.01.2004
Zonealarm 3.1.395

  Chegs ® 17:54 19 Jan 2004

click here

I'm not certain,but typing "Loopback 127.0.0.1:80" into google seems to indicate that its a spoofed IP thats trying to contact a trojan on your puter.

  Valvegrid 18:01 19 Jan 2004

Are the alerts incomming or outgoing? 127.0.0.1 is your local computer. Have a look in your hosts file you should see something like this:

~~~~~~~~~~~~~~

# Copyright (c) 1998 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP stack for Windows98

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host


127.0.0.1 localhost

~~~~~~~~~~~~~~~~~~~~~~

You may find you have a entry like this:

127.0.0.1:80 Loopback

Try puting a # at the start of the line and see if it continues, don't forget to re-boot the computer.

Paul.

  Valvegrid 18:05 19 Jan 2004

As Chegs ® says it could be a trojan, try running a scan with this program:

click here

  Valvegrid 18:06 19 Jan 2004

As Chegs ® says it could be a trojan, try running a scan with this program:

click here

  The Rep 19:03 19 Jan 2004

hi Guys thanks for the responses.
Valvegrid, the alert is classed as incoming. I added a # to 127.0.0 local host but this didnt reolve anything.
I tried using spyhunter to look for trojans etc but nothing showed up.

I am stumped!!

  Chegs ® 19:08 19 Jan 2004

click here

Try this for a trojan/virus scan,if nothing shows then its probably ZA trying to prick your paranoia. :-)

  Lionheart ? 19:12 19 Jan 2004

Have a look here, might help.

click here

  Chegs ® 19:17 19 Jan 2004

I already had a look thru all those postings,and found nothing that made much sense.Thats why I posted the link earlier,as they seemed to have some ideas about it.

  Valvegrid 19:37 19 Jan 2004

I must admit, I would be far more concerned if the alert was outgoing. I have set my ZA security settings to Medium. I found by setting them to high slowed the connection because my ISP weren't sure I was there because they couldn't ping my computer. Setting ZA to medium will still block the highest risk incoming attacks, but more importantly, its monitoring what's is asking for an internet connection. If it's anything out of the norm, it could well be a little cretin.

Paul.

  The Rep 20:21 19 Jan 2004

Chegs, I ran the trend micro scan... all clear.
The problem is still persisting. Point of note the port that it attempting to access is always different.
Lionheart thanks for the link.
Valvegrid will try settings at medium.... Will test ZA at GRC.COM aswell.

Any other sugestions gladly welcomed...

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

The Evil Within 2 review-in-progress

Photoshop CC 2018 released with new Curvature Pen and better brush tools

Camera tips to take better iPhone photos

Les meilleures applications de covoiturage 2017