Hi everyone, i couldn't find the introduction forums.
So, Hi everyone.

Does anyone knows what in the world is:

pokerface. ibiza. bishopston. net ?

LimeWire tries to make a connection to that site on port 3559.
When I ping it resolves to 127.0.0.1 aka localhost, but in the browser, bring me a "NT Logon Security", yahoo and google only displays links coming from the "url" mentioned, I want to know, why LimeWire tries to make a connection (on load time) to a site which behaves so estrange, and had a estrange "pokerface" name (like HackmanGT ) ?

I would appreciate very much any reference, information, comments, links, laughs, insults, everything will be very appreciated.

Thanks in advance,
HackmanGT



Background :

I had tested on the same PC: AVG Antivirus Free, NOD32 Trial, Avast! Personal, AntiVir Free, Norton Antivirus 2006. Lavasoft AdAware, SpyBot Resident (Updated all). Posted HijackThis logs to 4 forums (never had an answer, from TechGuy, Wildersecurity, others). Executed Trend Micro House Call 6. Microsoft Malware Removal Tool. Updated from Microsoft. Sun SDK Application Server JRE 1.6. I dump with tcpdump & analized manually. Downloaded Limewire Java source, compiled on NetBeans 5.5, and debugged (step) the most critical Gnutella protocol *** found nothing ***.

I tested ZoneAlarm and Norton AV 2005 Firewall. None of the above throws me any alert, even when I'm 100% ZoneA is working very good. I don't care too much about Norton.

I even "Remote Trace Route" to that site from Greece, Poland and USA.
Eight servers resolves to the same 127.0.0.1

It even doesn't have whois arin (who is registered database).
I'm a Microsoft user since DOS 3.1. And recently a Linux SUN Caldera 1.2, Linux Devian 2.2, from a few years. Software Designer and ... Intranet Administrator, Web Site Administrator.

Well,...upon some research I found that one (though it talks of :3558):

Virusbuster

And that's what the developer forum talks (it includes that mysterious address)

Unable to connect with no gnutella.net file? - LimeWire Forums

Cheers
FOTH

__________________

"Never Argue With An Idiot. They Will Drag You Down To Their Level, Then Beat You With Experience"

VirusBuster Description

VirusBuster, also known as VirusBurst, is a rogue anti-spyware program that displays fake warning messages in order to trick the user into purchasing the software. VirusBuster alleges to remove spyware but instead it installs a trojan that pops up deceptive advertisements that resemble security messages. VirusBuster may change the Internet Explorer default home page and redirect the web browser to malicious web sites.

Spyware Or Not? - Virusbuster!!?

THE URL ONLY CONNECTS WHEN THE USERS RUNS LIMEWIRE NOT EVERYTIME.

THANKS FOR YOUR ANSWER foolofthehill ,
ANY OTHER ADVISE STILL WILL BE APPRECIATED A LOT

Your reply sounds rather like an attempt to "argue" than an appreciation that someone at least tries to help you....

My other advice was the LW Developer Link !!!

Regards
FOTH

__________________

"Never Argue With An Idiot. They Will Drag You Down To Their Level, Then Beat You With Experience"

I really apreciate your help.
Im very grateful to you!
LimeWire is a very nice java, helpful software!

I seem like an "argue" .. because I copy and paste from a spyware site ...
I should wrote .. "I quote" ...

Im in charge of .. at least ... the most basic status of security of a few networks .. so .. you post had helped me to "watch out" those sites. I always have a parallel site to try to fool some spyware, and it had worked 50%...

Of course I dont try to bother anyone, neither to change anything in the sofware, neither make anyone's life angry, neither sad, I only want to know, why?

I still want to know why LimeWire has that site on the "gnutella" static ip network ? And I'm open to any kind of comments.

I re-download from the "original source" of course, reinstalled LimeWire to make shure, and its still there. Uninstall and its gone. I dont want to use another p2p.. I really like LimeWire (its written in the best programming language ever ).

Thanks a lot in advance.

Thanks foolofthehill for your advice.
Even when I believe it's harmless because LimeWire distribute it hard-coded.

Resolved the strange thing for my own configuration.
Removed that from gnutella.net configuration file and remove writing privileges to gnutella.net file.

It's gone away