1
[Tue Feb 11 10:37:00 2020] 127.0.0.1:49951 [404]: (null) /c/msdownload/update/software/defu/2020/02/am_delta_patch_1.309.678.0_2ed0992bc429bfc321a0209f24dcd8912733a2a5.exe - No such file or directory

The above was logged by PHP's built-in webserver, which listens on 127.0.0.1:80 for my internal, private use only. It is the first request that happened at all today, as soon as it was started (on startup).

Something, supposedly Windows 10, tried to fetch an EXE (seemingly a patch) from there, naturally resulting in a 404 error since I'm obviously not hosting any Windows patches in my "dev server"'s WWW dir.

This has never happened before, at least not that I've noticed. Why would it ever try to fetch a patch from localhost on port 80? That makes no sense to me.

The part where it says "(null)" is where it normally says either "GET" or "POST". I have no idea what kind of request is "null", or how that is even technically possible.

The webserver only listens on localhost port 80:

start "PHP-dev server" /min cmd.exe /C php -S 127.0.0.1:80 -t "./WWW"

Important note #1: My "hosts" file contains no 127.0.0.1 entries (only a bunch of 0.0.0.0 ones added by Spybot Anti-Beacon).

Important note #2: I have verified that, under "delivery optimization" in the Windows Update settings, "Download from other PCs" is still turned off (I unchecked it right away after installing Windows).

The above tells me that it can't be Windows Update doing a confused "peer-to-peer" update fetch. But then what else?

0 Answers0