continuous data transfer to IP 224.0.0.252

  • Thread starter Thread starter Safai
  • Start date Start date
S

Safai

Good day all,

I have realized that my PC is continually sending data to the IP address
224.0.0.252.
Why and how can I stop this?

Thanks a lot,
Morteza

P.S. my configuration: Vista Ultimate SP1, IE7, wired modem router, ADSL
(PPPoE) internet connection
 
Good be a number of things... Spyware comes to my mind first.

You have several options here from my view

1) Look into a firewall Mcafee or Norton and add the IP to the block list.
Also you could find out what program is sending the information and delete it.

2) Get a spyware scanner... I dont really like these scanners but I belive
they do work and it may delete the spyware for you.

3) You could go oldschool and format your entire drive /reinstall. This will
stop anything from going to that IP ever again! :P
 
Scan your computer with these 2 Programs, and your AV, just to be sure of no
Malware..
What were the results of the answers supplied to you in your last post re
this?

http://www.spybot.info/en/index.html

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware Program.
Download, install, update, and immunize your System with it.
Then SCAN with it.
Update it, and scan your System once a fortnight.

http://www.malwarebytes.org/mbam.php

Malwarebytes is as the name says, a Malware Remover!
For the Free version scroll down their page to either download from
Download.com, or Major Geeks.com
 
Safai wrote the following on 1/25/2009 12:16:
Good day all,

I have realized that my PC is continually sending data to the IP address
224.0.0.252.
Why and how can I stop this?

Thanks a lot,
Morteza

P.S. my configuration: Vista Ultimate SP1, IE7, wired modem router, ADSL
(PPPoE) internet connection
Click to expand...

224.0.0.252 is a multicast address limited to your local subnet. It
could be your Vista computer is using Link-Local Multicast Name
Resolution (LLMNR) to find other computers on the local network. LLMNR
broadcasts use this IP address.

Further info:
http://en.wikipedia.org/wiki/Link-local_Multicast_Name_Resolution

Disable LLMNR:
http://www.vistax64.com/vista-networking-sharing/95027-ability-disable-llmnr.html

Lance
*****
 
Thank you very much Lance. Your trick (group policy) solved the problem.

Thank you all for the input
SAFAI
 
I have been having the same problem, but I only have Premium and the
Group Policy is not available to me. Also the Registry does not have a
DNS Client under the Windows NT key. Do I have to add the DNS Client
and the EnableMulticast Registry? And if so, what type of value does it
need to be?

Thanks for any help,
Banister
Click to expand...

enable outbound blocking with windows firewall. Then go to the predefined settings and disable the ones for llmnr. You won't see the attempts anymore.

Rich.
 
I have been having the same problem, but I only have Premium and the
Group Policy is not available to me. Also the Registry does not have a
DNS Client under the Windows NT key. Do I have to add the DNS Client
and the EnableMulticast Registry? And if so, what type of value does it
need to be?

Thanks for any help,
Banister
Click to expand...

I'd like to know the answer to this too. No reason why my pc has to automatically broadcast across the network to 224.0.0.252 for every program I open. What kind of big brother nonsense is this Microsoft? I share files on my home network fine when blocking this, but why does it have to clog up and flood my logs!!!
 
I have been having the same problem, but I only have Premium and the
Group Policy is not available to me. Also the Registry does not have a
DNS Client under the Windows NT key. Do I have to add the DNS Client
and the EnableMulticast Registry? And if so, what type of value does it
need to be?

Thanks for any help,
Banister
Click to expand...

I finally found the answer my friend. We have to add these lines into the registry from the command line.

REG ADD â€HKLM\Software\policies\Microsoft\Windows NT\DNSClient\

REG ADD â€HKLM\Software\policies\Microsoft\Windows NT\DNSClient†/v â€EnableMulticast†/t REG_DWORD /d “0″ /f

for some reason adding these entries with the registry editor did not work for me. You also cannot copy and paste. Just type it in manually.

Rich.
 
Back
Top