Windows Media Player blocked by COMOD over 600 times - even in offline mode

Comodo Internet Security - CIS Firewall Help - CIS
#1

My Windows Media Player is driving me nuts! Most of the time, exactly once every 60 seconds on the head, it tries to access 92.242.144.10 or 92.242.144.50, which are both from http://www.barefruit.co.uk/ which is a DNS service. I am currently using COMODO DNS servers so I am led to believe there is something wrong in relation to this. It is really bothering the hell out of me seeing over 1000 blocked events for the week and all of them are WMP, most attempts are exactly 1 minute apart, and all to the same location and those 2 IP addresses.

The WMP sharing service is disabled, WMP has been set to offline mode, all options which would induce WMP to want to access the internet have been unchecked, and WMP auto updates have been disabled via registry.

Why won’t it stop trying to access the DNS server??? And, is this to do with COMODO DNS or improperly implemented firewall/defense rules? Or could it really be some weird-o infection which seems obsessed with only one specific company’s DNS server?

I’ve attached a screenshot of the firewall events window.

[attachment deleted by admin]

#2

Oh, and this only happens while WMP is actually open. It does not attempt anything when closed.

#3

It seems that WMP is trying to ‘diagnose’ connectivity. Barefruit is used by many DNS services to redirect HTTP 404 traffic.
It could be that something in your WMP is trying to load a specific page that causes this.

May I ask why you specifically blocked the icmp traffic?

#4

Er, you said ICMP traffic not the forum itself… oops

I didn’t specifically set that, I just blocked Windows Media Player in Comodo’s block list. This is just what it has been doing since then. I am not trying to open any web page in media player and I turned off all possible options that pertain to accessing the web, yet it still wants to when there should be no reason for it to be doing so. I also set it to offline mode so I don’t know what interest it should have when its told to stay offline.

#5

Here’s a new address attempt, different than before.

Accessing the computer/network itself? File/print sharing is disabled and so is media player sharing…

[attachment deleted by admin]

#6

Can you go to Firewall, Network Security Policy and find WMP there, then remove the block rule you seem to have created by accident?

#7

Blocking it wasn’t an accident. I don’t want it accessing the internet.

I reapplied the block rule and now I’m getting TCP and ICMP blocks now even though I’ve gone through every option and registry mod I could find to get WMP to stop attempting to connect to the internet.

If I can’t get it to stop I may as well turn off the alerts for it instead.

#8

The 0.0.0.0 to 127.0.0.1 communication is not an internet request its the loopback zone or localhost, many programs\services use this to communicate with themselves.

#9

Yeah I was having a hunch it was something like that… then it occurred to me yesterday in order to update media library art and such it seems to need to do that, since stuff started becoming out of sync after blocking that in particular.

Thanks for the response though, I didn’t know how to put it into technical terms.