merijn.org resolves to 127.0.0.1?

radiospan

Hi,

I've been trying to download the latest version of CWShredder (hijack-ware removal tool) from merijn.org.

The website wasn't opening up, so I pinged it and...

Pinging [url]www.merijn.org[/url] [127.0.0.1] with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

Why is it pinging 127.0.0.1? I remember something about Windows having a "hosts" file which is like a local DNS or something, but I can't find it?

Capt'n Midnight

in win95/98 c:\windows
in nt/2k/xp \windows\system32\drivers\etc

hosts has NO EXTENSION - right click and open in notepad.

depending on the OS you use - probably better off restarting after you change it

127.0.0.1 is the local machine - one way of blocking a site is to point to the local machine

might malware be re directing it

radiospan

Something must be redirecting it, but it's not the HOSTS file, theres just one entry in it:

127.0.0.1 localhost

Can somebody else try to ping www.merijn.org? What IP comes up?

parasite

getting same results using linux

Stephen

Yep, resolving to 127.0.0.1 for me as well.
You can get a copy of cwshredder here though: http://www.majorgeeks.com/download4086.html

Its about 2 weeks old

maxheadroom

http://www.spywareinfo.com/~merijn/

richardo

Something must be redirecting it, but it's not the HOSTS file, theres just one entry in it:

No. No redirection. Nothing to do with Hosts. It is actually set up that merijn.org directs to 127.0.0.1 on the DNS servers.

therecklessone

I read somewhere that there is a whole host of gangs that target anti-spyware sites for DDOS attacks, could this be a symptom?

The majorgeeks link works by the way, and its the most up to date version. Got mine last night.

Oh, and Spybot is on v1.3, but I didn't find that out untilI downloaded the newest version from the PC World website because my online update for v1.2 was returning "no new updates" all the time

Stephen

Funny you should say that, spywareinfo.com is timing out now.

therecklessone

Read about it at http://www.theregister.co.uk/2004/06/29/cws_shredder/

The link was posted in the boards Security forum.

Capt'n Midnight

http://209.133.47.69
http://209.133.47.12 **
http://209.133.47.200

eg:
http://209.133.47.12/~merijn/files/CWShredder.exe - 146KB v 1.59.1