Loopback 127.0.0.1:80 ?? any ideas

  The Rep 17:20 19 Jan 04
Locked

Hello, over the last 72 hrs Zonealarm has been blocking upwards of 150 alerts from this IP Loopback 127.0.0.1:80. These alerts are locking my internet connection. An scan with updated adaware and AVG antivirus have shown nothing.

Please if you can help get in touch....

Many thanks

The Rep

BT dial up internet
WINXP pro SP1
P4 2.4
GF3Ti 200
512mb Ram
Adaware 6 ref file 01R247 10.01.2004
Zonealarm 3.1.395

  Chegs ® 17:54 19 Jan 04

click here

I'm not certain,but typing "Loopback 127.0.0.1:80" into google seems to indicate that its a spoofed IP thats trying to contact a trojan on your puter.

  Valvegrid 18:01 19 Jan 04

Are the alerts incomming or outgoing? 127.0.0.1 is your local computer. Have a look in your hosts file you should see something like this:

~~~~~~~~~~~~~~

# Copyright (c) 1998 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP stack for Windows98

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host


127.0.0.1 localhost

~~~~~~~~~~~~~~~~~~~~~~

You may find you have a entry like this:

127.0.0.1:80 Loopback

Try puting a # at the start of the line and see if it continues, don't forget to re-boot the computer.

Paul.

  Valvegrid 18:05 19 Jan 04

As Chegs ® says it could be a trojan, try running a scan with this program:

click here

  Valvegrid 18:06 19 Jan 04

As Chegs ® says it could be a trojan, try running a scan with this program:

click here

  The Rep 19:03 19 Jan 04

hi Guys thanks for the responses.
Valvegrid, the alert is classed as incoming. I added a # to 127.0.0 local host but this didnt reolve anything.
I tried using spyhunter to look for trojans etc but nothing showed up.

I am stumped!!

  Chegs ® 19:08 19 Jan 04

click here

Try this for a trojan/virus scan,if nothing shows then its probably ZA trying to prick your paranoia. :-)

  Lionheart ? 19:12 19 Jan 04

Have a look here, might help.

click here

  Chegs ® 19:17 19 Jan 04

I already had a look thru all those postings,and found nothing that made much sense.Thats why I posted the link earlier,as they seemed to have some ideas about it.

  Valvegrid 19:37 19 Jan 04

I must admit, I would be far more concerned if the alert was outgoing. I have set my ZA security settings to Medium. I found by setting them to high slowed the connection because my ISP weren't sure I was there because they couldn't ping my computer. Setting ZA to medium will still block the highest risk incoming attacks, but more importantly, its monitoring what's is asking for an internet connection. If it's anything out of the norm, it could well be a little cretin.

Paul.

  The Rep 20:21 19 Jan 04

Chegs, I ran the trend micro scan... all clear.
The problem is still persisting. Point of note the port that it attempting to access is always different.
Lionheart thanks for the link.
Valvegrid will try settings at medium.... Will test ZA at GRC.COM aswell.

Any other sugestions gladly welcomed...

This thread is now locked and can not be replied to.

Amazon Fire HD 8 review: A brilliant combination of function and value – with one massive caveat

1995-2015: How technology has changed the world in 20 years

How to create an introvert-friendly workplace

iPhone 7 review: Enhanced cameras, a refreshed design and water resistance make the iPhone 7 an…