ICMP response for www.instituto.com.br from 127.0.0.1 !!!

[ahvn]

Dear all,

When I ping www.instituto.com.br from my 4500 series router ( IOS 12.1 ), I find the ICMP response coming from 127.0.0.1.I tried this from many routers world wide and I found the same observation.When I searched the net I found its some virus called AttackDos.php.This observation I found in almost every PC in my network and this is propagating unwanted traffic inside my network congesting many of my links.

Does anyone know how to contain this thing.Those who have faced similiar experience and fixed it kindly help me out.

Thanks in advance.

Rgds,

Homin

[Pavel Bykov]

Are you sure this is a virus?

I tried to ping this from many locations, including from PC's located inside of the corporate network, an i also get that response. Maybe it is some kind of protection against ICMP?

[Georg Pauwen]

Hello Homin,

I think it might very well be a virus. Check out the following link for info on the WORM_YAHA.AA worm which creates 127.0.0.1 addresses for websites.

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_YAHA.AA&VSect=T

Regards,

GP

[rais]

I dont think this is a virus. The DNS for this URL is pointing to 127.0.0.1

Regards.

[Georg Pauwen]

Rais,

that is exactly what the worm does, it creates a local hosts file with entries for websites pointing to 127.0.0.1.

Regards,

Georg

[rais]

But this is the entry in the DNS server for this site. Does this mean the virus has corrupted the DNS server? Though it is possible, I highly doubt it, because all of the customers for that ISP would have been affected.

Try to traceroute from Princeton University. They also resolve it to 127.0.0.1

http://www.net.princeton.edu/traceroute.html

Other tools to verify this info:

http://www.netdept.com/netTools.jsp

Thanks.