na1r.services.adobe.com ???

Poofox

Banned
Local time
10:09 PM
Messages
3
Capture.PNG

Screencap of Process Hacker Network Tab

Am I being paranoid or is this quite strange and suspicious? None of these products have anything to do with adobe. What the heck is na1r.services.adobe.com and why is it listed so much under Local and Remote Address? I'm very experienced with computers, but networking has always been a mystery to me, so I'm not really sure what I'm looking at here...But I don't like it.
 

My Computer My Computer

OS
win7 x64
Do you have Photoshop or some other Adobe CC software ?

na1r.services.adobe.com is something to do with their activation - Adobe products 'call home' to check your product is legit.
 

My Computer My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
self build
OS
Windows 7 Pro x64 sp1
CPU
i7 4770K
Motherboard
MSI B85M-E45
Memory
8GB Corsair Vengeance 1600MHz
Graphics Card(s)
onboard
Monitor(s) Displays
LG 27MP35
Screen Resolution
1920-1080
Hard Drives
Seagate 2TB
PSU
Cooler Master GX 750
Case
Antec 300
Cooling
Seidon 120V
Internet Speed
60/18
Antivirus
MSE
Browser
Firefox
Thanks, yea some adobe products are installed, but I just don't understand how it involves all these other processes.

Can anyone tell me what this signifies? Why would that product activation be so pervasive across my system? It should only be active when I actually run some adobe software, which I do infrequently.
 

My Computer My Computer

OS
win7 x64
Do you have creative cloud running at startup?
 

My Computer My Computer

Computer type
PC/Desktop
OS
win 8 32 bit
@ samuria - No, I have no need for it, so it's disabled.

@ Anyone - I would just really appreciate some insight on wtf I'm looking at here, because to my networking ignorant mind it looks like something adobe related is forcing traffic from non-adobe apps through its server. Why would an adobe address show up as a local and remote address for e.g. Automap (MIDI controller software)?! Even creepier is Nvidia share, which can capture all my desktop activity.

Does anyone know what this means? Am I worried over nothing?
 

My Computer My Computer

OS
win7 x64
I've seen something very similar to you and have a reasonable idea of what's going on.

All those strange things boil down to one single thing. Look at your hosts file, and you'll likely found an entry like this:
Code:
127.0.0.1     na1r.services.adobe.com

Since you said you have some Adobe software, and that's an activation server for such programs, all that indicates that you have some cracked Adobe software. That entry in the hosts file in fact nulifies their activation server, by redirecting all trafic to your own computer (and dying there), thus bypassing activation and phone-home. It's a widely known trick to hack software that requires activation into ilegally working without marking itself as hacked.
A legitimate use of this very same trick could be blocking advertising servers and bundled spyware.

Now, what has all that to do with your screenshot?
Network traffic can originate to/from your own computer and any other device. Each one, even yours is identified by an IP address. Additionally, IP addresses can be assigned a name for ease of use (you don't type "50.23.246.167" in your browser, you type "www.sevenforums.com"). Process hacker tries to be helpful here by showing you names of each host involved in connections, so you see friendly names instead of IPs, so it tries to do a reverse DNS lookup. As the DNS system involves the hosts files as taking priority over anything else, and your host file says that 127.0.0.1 is na1r.services.adobe.com (so you can ilegally use Adobe software) it also means that your computer is now na1r.services.adobe.com, so that's why Process Hacker shows you that. When you see that, it's in fact your own computer.

And why specifically na1r.services.adobe.com instead of any other entry? Likely it's the very first entry in the hosts file, so it just picks anything it finds.

So, should you be worried? Not at all, it's an expectable side effect of blocking computers with the hosts file. Worry instead of why are you blocking an activation server :p
 

My Computer My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
Toshiba Sattelite A665-S6092
OS
Windows 7 Ultimate x64
CPU
Intel Core i7-740QM
Memory
8 GB DDR3
Graphics Card(s)
NVIDIA GeForce 330GT
Screen Resolution
1366x768
Hard Drives
Samsung 840 SSD 500GB
1TB USB3 external HD
Cooling
Coolermaster Notepal U3 notebook cooling pad
Internet Speed
3mbps ASDL
Antivirus
ClamWin 0.98.7
Browser
Opera 12.17 x86 (main), Firefox 38 (sec), IE11 (last resort)
Easy fix - Remove all stolen Adobe software from your system and edit out the then unneeded entries in your Hosts file, and all will be good
 

My Computers My Computers

System One System Two

  • Computer type
    PC/Desktop
    Computer Manufacturer/Model Number
    ChillBlast - Custom to my design
    OS
    Windows 11 Pro x64 [Latest Release and Release Preview]
    CPU
    Ryzen 9 5950X, 3.8 - 5.2 MHz
    Motherboard
    Asus Prime X570-Pro
    Memory
    64GB [2 x 32GB] DDR4 3200MHz
    Graphics Card(s)
    4GB NVIDIA GEFORCE GTX 1650 Ti
    Sound Card
    On-board SPDIF to 5.1 System + HDMI [5.1 system]
    Monitor(s) Displays
    32" UHD 32 Bit HDR Monitor + 43" UHD 4K 32Bit HDR TV
    Screen Resolution
    2 x 3840 x 2160 @60Hz
    Hard Drives
    1TB M2 SSD OS, 500GB Fast Access SSD, 2 x 8TB Data + Various Externals from 1TB to 4TB, 10TB NAS
    PSU
    NZXT C750 80 PLUS Gold 750W Modular PSU
    Case
    Workstation Case [Matt Black]
    Cooling
    NZXT Kraken X63 280mm CPU Cooler +2x Quiet Case fans
    Keyboard
    Logitech Wireless MX Keys & K400 + others
    Mouse
    Logitech Wireless MX Master 3S
    Internet Speed
    920 MB Down 50 MB Up
    Antivirus
    BitDefender Total Security Pro
    Browser
    Chrome (always run latest Non-Beta)
    Other Info
    Also run ...
    Laptop - Quad 8GB - Windows 10 Pro x64
    Nexus 7 Android tablet x2
    Samsung 10.2" tablet
    Blackview TAB 8 4G Android Tablet c/w Keyboard
    Wacom Intuos Pro Medium Pen Pad
    Wacom Intuos Pro Small Pen Pad
    Wacom Expresskeys Remote
    Loopdeck+ Graphics Controller
    Shuttle Pro v2 Control
  • Computer type
    Laptop
    System Manufacturer/Model Number
    Dell XPS 17 10750H
    OS
    Windows 11 Pro x64 Latest RP
    CPU
    Intel I7 10750H 5.0GHz
    Motherboard
    Dell XPS
    Memory
    32GB [2x16GB] DDR4 2933 MHz
    Graphics Card(s)
    nVidia GTX1650Ti 4 GB GDDR6
    Sound Card
    Stock [Realtek] 4 Speaker
    Monitor(s) Displays
    17" IPS UHD+ Infinity Edge Touchscreen
    Screen Resolution
    3840 x 2400
    Hard Drives
    2TB M2 NVMe, 4TB External + various 500GB & 1TB External NVMe (also have access to spinner HDD from
    PSU
    Stock
    Case
    Stock XPS Aluminium & Carbon Fibre
    Cooling
    Stock - Active Fan Control
    Keyboard
    Backlit + Various Logitech
    Mouse
    Stock Track Pad + Logitech MX Trackball
    Internet Speed
    72 MB Down 18MB Up
    Browser
    Chrome
    Other Info
    Also run ...
    Laptop - Quad 8GB - Windows 10 Pro x64
    Nexus 7 Android tablet x2
    10.2" tablet
    Sony Z3 Android Smartphone
    Wacom Intuos Pro Medium Pen Pad
    Wacom Intuos Pro Small Pen Pad
    Wacom Expresskeys Remote
    Loopdeck+ Graphics Controller
    Shuttle Pro v2 Control Pad
    10TB NAS
As the DNS system involves the hosts files as taking priority over anything else, and your host file says that 127.0.0.1 is na1r.services.adobe.com (so you can ilegally use Adobe software) it also means that your computer is now na1r.services.adobe.com, so that's why Process Hacker shows you that. When you see that, it's in fact your own computer.

re 127.0.0.1 - well spotted
 

My Computer My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
self build
OS
Windows 7 Pro x64 sp1
CPU
i7 4770K
Motherboard
MSI B85M-E45
Memory
8GB Corsair Vengeance 1600MHz
Graphics Card(s)
onboard
Monitor(s) Displays
LG 27MP35
Screen Resolution
1920-1080
Hard Drives
Seagate 2TB
PSU
Cooler Master GX 750
Case
Antec 300
Cooling
Seidon 120V
Internet Speed
60/18
Antivirus
MSE
Browser
Firefox
Back
Top