Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

how to stop explorer.exe from communicating with itself on 127.0.0.1


  • Please log in to reply
3 replies to this topic

#1 ajiten73

ajiten73

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:58 PM

Posted 08 June 2017 - 10:40 AM

I am using windows 7, and most probably to install an app named Nastaveni.XviD got this error of explorer eating up a lot of network, few  GBs per day. 

This app is not visible in installed applications, and when running system restore also does not show in the list of programs that will be removed by resotration to a previous restore point.

However, in  windows search box it shows up on typing its name. The file location is shown as rundll32.exe file in C:/Windows/System32 folder.

For Nastaveni.XviD, the properties from windows search box on right click shows it as having target as : C:\Windows\System32\rundll32.exe xvid.ax,Configure

May be it is a portable app (which I understand as something that does not have registry entry). It seems like a superb virus to me.

I tried all tools, and stopped WindowsUpdate & Windowssearch services also. For some time (30 mins approx.), it worked then I do not know how it all started again. I then resorted to trial version of Netbaalncer to at least stop from being network bandwidth for the month. To compensate for the lack of detailed information in NetPlanner, I saw in TCPView that explorer was basically communicating (as Established connection) on two addresses with remote address and local addresses as below

Local  address                                                                    Remote address

127.0.0.1                                                                                  127.0.0.1 

some mac address starting with 2406                                some mac address starting with 64

 

I am perplexed, dead with trying all options, and wonder how NetPlanner is so easily able to stop explorer from making any Tcp connection, when I have simply failed.

I also worry if NetPlanner will fail after a few days, if Nastaveni.XviD is a virus.I have no antiviirus and run windows defender only. I am thinking of what to do in future without formatting my machine ever.

 

 



BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,092 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:01:58 AM

Posted 08 June 2017 - 10:51 AM

Looks like some codec pack you installed...to me.

 

https://docs.google.com/document/d/1rvx4YZx6-MWCDxrrjFIRbh0Evt2LX6R8h2PHdiOf9c0/edit

 

https://www.cnet.com/forums/discussions/how-can-i-uninstall-the-xvid-codec-541715/

 

Louis



#3 ajiten73

ajiten73
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:58 PM

Posted 08 June 2017 - 11:06 AM

Hi Louis, 

              The first web page you refer to goes nowhere. Second, is a site that gives a one liner for uninstalling codecs by asking to go to the codec's (here, NastaVeni.XviD) site, that does not exist seemingly. I installed that in a hurry for Dolby audio video viewing.

Please help me more.

 

Best regards.



#4 ajiten73

ajiten73
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:58 PM

Posted 08 June 2017 - 11:19 AM

Hi all, 

        I am sorry that in tired state I stated NetBalancer 9.9.5 as NetPlanner in second & third references to the software. I feel that trying to install too many tools to diagnose / correct the error made this error.

Really sorry for that.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users