4

After some recent AV/FW software update (Comodo) and restarting my computer, I was alarmed with big amount of warnings that application "x" (where "x" is pretty much all of what I try to run) try to establish outgoing connection to adress 224.0.0.252 (or sometimes similar adress from same range). Even if it is some dummy app I've just created, or any app that has nothing to do with internet. Besides that "System" process itself tries to send these IGMP requests as well requests. 5 connections per minute on average. There was also increase (or FW update triggered oversensitivity) with traffic on ports 137 and 138 UDP, which I fixed by disabling NetBIOS.

My question is: What can be the cause of this? Is that normal? Did my firewall got oversensitive with the latest update, alarming me of some inner Windows stuff that happens all the time? Or maybe I've catched something malicious (Comodo / Spybot Search and Destroy seem not to raise any red flags). What else I can use to check/clean my system for threats that can be applied over my current AV.FW (Comodo)?

-----Edit-----

Freshly installed system with all updates seem to behaviour same exact way with less intensity so far. Scan with Windows Defender offline didnt revealed any problems.

Im basically out of ideas and still wonder if its caused by some recent system update or maybe faulty firewall software. And if its caused by some rootkit how to reveal it and get rid of it.

0

2 Answers 2

2

This sounds like you caught something malicious. If you caught a virus/trojan/spyware that used DLL Injection and in that injected DLL it calls home to that IP address you saw you would see exactly the kind of behaviour you are experiencing.

This also could be a update gone awry from a legitimate program, and that would explain why the antivirus did not catch it, but it is unlikely.

I would recommend going to a different computer you know has no infections and go download Windows Defender Offline. This will let you make a bootable CD/USB (if you make a bootable USB you can update the virus definitions by running the setup program again with the drive plugged in) and it will scan your computer for infections without booting the OS, that way if the infection is blocking the virus scanner from seeing the infected files, launching before windows (and before the virus can get it's hooks in) the offline scan can see the hidden files.

1
  • The symptoms described do not suggest to me that anything malicious is going on.
    – Dale
    Feb 17, 2016 at 23:09
1

224.0.0.252 is for name resolution on the same local link LLMNR

According to The Internet Assigned Numbers Authority:

Multicast routers should not forward any multicast datagram with destination addresses in this range, regardless of its TTL.

That means that packets sent to 224.0.0.252 (the multicast address) is scoped to prevent a multicast-enabled router from forwarding the query message beyond the subnet on which it was initially sent.

The purpose of these transmissions is to resolve names (like DNS does). It resolves single label names (like: MYCOMPUTR), on the local subnet, when DNS devolution is unable to resolve the name. This is helpful if you are in an Ad-Hoc network scenario, or in a scenario where DNS entries do not include hosts on the local subnet.

So if you're on a non-routable private network, those packets will only be seen by local computers that are listening for them (configured for Network Discovery). What the listeners will learn from listening is the computer's name.

You can search your registry for EnableMulticast, which should be (generally) under an HKLM Windows Software branch. If this is set to zero, those packets should stop.

If you are on IPv4, your local computers will probably be able to use NetBIOS over TCP/IP for name resolution, but since that doesn't work over IPv6, LLMNR would take-over.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .