0

I noticed a weird address in the Local Address column in the Network tab of Process Hacker in lots of program that work with internet connection (like chrome, firefox, dropbox, thunderbird etc..).

The address in question is this one: hhbekxxw5d9e.pflexads.com.

Most of these preocesses have the same adrress also in the Remote Address column. Some of these send and receive data over the network.

I've tried scanning with Malwarebytes and Microsoft Security Essential, both with no results. I'm on Windows 7.

My hosts file is picked from https://github.com/StevenBlack/hosts so luckly those requests are blocked, I'm no expert in these things and wondered what is producing this and if it's anything that should not be neglected.

Any suggestions?

UPDATE

It uses small traffic, but it stacks up from time to time: starts with few bytes and then it goes for some KB. Fact that worried me most is that this address is in also 1password process and Teamviewer too.

I'm no netowrk expert, but I've tried with Wireshark to filter the recordings with Tcp.port filters on what is listed on the Process Hacker network tab. Unfortunately the output of the filter is blank, wich is kinda odd to me since I can actively see reported in the network tab of Process Hacker that data is going for those processes through those ports. Am I blatantly missing something?

2
  • After a bit of googling, it seems that the address is really just an advertisement related address. Some ad-block software and plugins have it blacklisted as such. Is it using a lot of traffic, tho?
    – Leathe
    Oct 15, 2015 at 11:38
  • @Leathe yes I googled some too but I only found what you have already I guess, no real info on what is it or what program init this binded to several processes. I updated my question with some additional data, thank you.
    – Gruber
    Oct 15, 2015 at 14:50

1 Answer 1

2

Today I noticed the same thing on my computer. After searching the web for a little bit it hit me.

These ports are loopback addresess (127.0.0.1/localhost), which normally would translate to your computer name.

The addresses that appears are from the HOSTS file of your computer (C:\Windows\System32\drivers\etc\hosts).

Process Hacker instead of showing localhost or the computer name, it looks for the first 127.0.0.1 line in HOSTS and thinks that's the computer name.

1
  • Forgot about this question! Actually I managed some time ago to find that it was my edited hosts file to be the culprit, can't find the source I found though. Nice reminder thank you!
    – Gruber
    Oct 22, 2018 at 9:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .