IE tries to access 127.0.0.1

Hi all,
I'm using zonealarm. After I installed and uninstalled a packet sniffer (using WinPcap, I think), I decided to manually permit programs to access internet each time, in order to see the IP they are trying to connect. Problem is, IE (or other browsers) are now trying to access 127.0.0.1 before every connection and if I don't allow, I can't connect anywhere (Outlook expess and Cute FTP does not do this, however). I'm not sure when this started, it could be after XP service pack2 or some security update, or the packet sniffer may have brought a virus. I'd appreciate any suggestions. Thanks a lot..

 

127.0.0.1 = Your computer

 

Many applications do this - it's called a loopback and is needed for many programs. It should be allowed.

 

OK thanks, but... is there a way to make sure there isn't a secretly installed web server on my computer, which everything passes through and gets logged. I can't see any more IP addresses after allowing access to 127.0.0.1, because they are subsequent requests.

 

This is most likely due to any web filtering software you have installed - specialised filters (like Proxomitron or the web scanning option offered by some anti-virus scanners) need to intercept the traffic first and they do this by configuring your browser to send data to their port at 127.0.0.1.

You can confirm this by checking which port your browser sends data to on 127.0.0.1 and seeing which application has control of it - your firewall should be able to provide this information as can specialised software like DiamondCS' Port Explorer.

If your PC was running a web server, it would need to have port 80 open to everyone - a port scan at a site like GRC should suffice to confirm whether this is the case or not (if you use a router for Internet access though, the scan will be of the router, not your PC - however this does also make it impractical for someone to use your system as a web server since they would have to configure your router to open port 80 also).

 

There is nothing to worry about here. It is normal for IE to have this UDP localhost connection as it also is for Firefox's TCP localhost connection.

Regards,

CrazyM