from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id 8A927440E7
	for <jm@localhost>; Thu, 25 Jul 2002 19:07:35 -0400 (EDT)
from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Fri, 26 Jul 2002 00:07:35 +0100 (IST)
from lair.xent.com (localhost [127.0.0.1]) by xent.com (Postfix)
    with ESMTP id C26492940ED; Thu, 25 Jul 2002 16:01:06 -0700 (PDT)
from cats.ucsc.edu (cats-mx2.ucsc.edu [128.114.129.35]) by
    xent.com (Postfix) with ESMTP id 29D442940E6 for <fork@xent.com>;
    Thu, 25 Jul 2002 16:00:41 -0700 (PDT)
From fork-admin@xent.com  Fri Jul 26 00:07:37 2002

from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id 49CAB44122
	for <jm@localhost>; Tue,  6 Aug 2002 06:12:51 -0400 (EDT)
from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Tue, 06 Aug 2002 11:12:51 +0100 (IST)
from dogma.slashnull.org (localhost [127.0.0.1]) by
    dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g73L54v27400;
    Sat, 3 Aug 2002 22:05:04 +0100
from web05.bigbiz.com (web05.bigbiz.com [216.218.198.5]) by
    dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g73L4tv27377 for
    <iiu@taint.org>; Sat, 3 Aug 2002 22:04:55 +0100
from Alfalfa.deisedesign.com ([193.193.166.41]) by
    web05.bigbiz.com (8.8.7/8.8.7) with ESMTP id OAA29513 for <iiu@taint.org>;
    Sat, 3 Aug 2002 14:03:13 -0700
from quoted-printable to 8bit by dogma.slashnull.org
    id g73L4tv27377
From iiu-admin@taint.org  Tue Aug  6 11:17:00 2002

It may be worth removing all your apps from the approved list. (a bit of a
pain, I agree) then check the first app which makes the connection. With a
bit of luck it won't be anything standard
>Unfortunately, I don't. ZoneAlarm normally gives that info but not this
>time. It just blocks the outward access and warns me that the attempt
>Sent: Saturday, August 03, 2002 9:32 PM
>Subject: Re: [IIU] spyware calling home?
> > Do you know which app is making the connection?
> > >I'm looking for advice. My pc has developed a disturbing tendency of
> > >to access IP 62.17.143.253 without my consent. It has got to the stage
> > >normal web-browsing is almost impossible.
> > >I have checked IP address on RIPE database and I know precisely who is
> > >called. I contacted that company on 14 July, when the problem first arose
> > >and asked for a remedy but (surprise) got no reply.
> > >A helpful person on the ie.comp list suggested Adaware spyware removal. I
> > >ran this and haven't had a problem again until today.
> > >The offending program is obviously not in Adaware db. (I run adaware with
> > >Any suggestions, please,  for removing whatever the f*** is causing this
> > Martin Whelan | Déise Design | www.deisedesign.com | Tel : 086-8888975
> > " Our core product Déiseditor © allows organisations to publish
> > to their web site in a fast and cost effective manner. There is no need
> > a full time web developer, as the site can be easily updated by the
> > Instant updates to keep site information fresh. Sites which are updated
> > regularly bring users back. Visit www.deisedesign.com/deiseditor.html for
> > Déiseditor © " Managing Your Information "