How can i know what programm generates virus traffic to 127.0.0.1 ?

Please, watch screenshot from wireshark for more information about virus traffic.
I have iptables, who blocked this traffic.

I want delete software, who generates virus traffic, how can i do it?

Attached Thumbnails

 

What makes you think this is the result of a virus?
Plenty of things could generate traffic to localhost including, if memory serves me correctly, X11.

well.

how to find out what PID of process generates this traffic?

Something like:As root (or with sudo, as appropriate).

i get next strings:

localhost (127.0.0.1) is your local machine. The screenshot shows something talking from your machine to something on your machine. That is normal in most cases. More specifically, tcp port 631 is the printing service, which is most likely implemented by "cups". If you want to get rid of that traffic (on your machine), stop the service "cupsd" or search an installed package like "cups" and uninstall. You will not be able to print though. I would recommend keeping everything as it is if you do not know exactly what you are doing.

no no no..this is virus traffic, because,
in iptables i was allowed traffic from "localhost my pc" to "localhost my PC"
and blocked from "localhost my pc" to "localhost other pc".

in next screenshot we can view next situation: we have traffic from localhost to "ipp" ..and traffic want send "syn" packets for generate connection...and connect is false, because we get answer with "rst,ack" packets.

Attached Thumbnails

 

Looks fine to me, what makes you worried?

what is "ipp"?

You are confusing "ipp" (the port/protocol) with "localhost" (the host). The first red line shows a packet from localhost:ipp to localhost:54420. Perfectly normal for an answer of your local printing service to some program querying the printers or jobs.

Please just read the documentation for the program you are using to view these things rather than claiming to have a virus.
Sorry if that is a little abrupt but posts by people who "have a virus" without a shred of evidence are frequent and are extremely harmful to Linux as a whole as they are much like "The Boy Who Cried 'Wolf!'" In that when somebody actually does have a problem they can be dismissed.
So, again, please do not post unsubstantiated virus claims out of ignorance and please read some documentation.

no no no..it is not cups.

i get next strings with command "netstat -tuwapn":

result has not cups.

Please just read some documentation.

Says Destination Port 631. Cups. Printer.