Connection attempts in Remote Desktop Connection to 127.0.0.2:XXXXX

[chrispret]

This morning my wife noticed this list of odd addresses (127.0.0.2:XXXXX) in her RDP connection history. Is there a legitimate explanation for these, or am I right to assume that she has some kind of infection? Not sure it matters, but for completeness: Windows 7, Automatic Updates, laptop was in hibernation so no overnight activity.

 

 

I'm already running an MBAM scan, it hasn't detected anything in memory or boot but that doesn't always mean it is clean...

[David H. Lipman]

Does this sound familiar ?
 
Connect Remote Desktop Protocol (RDP) Client To Localhost

[chrispret]

No, that's not it. But I think I just figured it out.

 

She connects to a client's server using SonicWall Virtual Office. Once the VPN is established it opens up an RDP session to an address like 127.0.0.2:XXXXX. So I'm pretty sure it is not malware related, don't ask me why those addresses were populated in the dropdown all of a sudden, but I know they assigned her a new username yesterday which might contribute.

 

Thanks for poking around.