Listowners-L Archives

Archiver > Listowners > 2002-05 > 1022857323


From:
Subject: Re: [LO] Re: Invalid request received from you
Date: Fri, 31 May 2002 11:02:03 EDT


In a message dated 5/31/02 5:56:54 AM Eastern Daylight Time,
writes:

> What's the explanation for this message? Is it another sign of someone
being
>
> infected by the Klez worm? My lists have no subscribers from
princeton.edu,
>
> and, to the best of my recollection, I have never corresponded with anyone
> from there.
>
Wilson-

It sure looks like the work of KLEZ to me. The message didn't come from
Princeton.edu but rather was sent from someone at shaw.ca TO Princeton.edu:

Received: from Princeton.EDU (postoffice.Princeton.EDU [128.112.129.120])
by lists01.Princeton.EDU (8.9.3/8.9.3) with ESMTP id DAA29744
for <>; Fri, 31 May 2002 03:29:17 -0400
(EDT)
Received: from pd5mo1so.prod.shaw.ca (h24-71-223-10.cg.shawcable.net
[24.71.223.10])
by Princeton.EDU (8.12.3/8.12.3) with ESMTP id g4V7T0Zs026690
for <>; Fri, 31 May 2002 03:29:00 -0400 (EDT)
Received: from pd2mr1so.prod.shaw.ca (pd2mr1so-ser.prod.shaw.ca
[10.0.141.110])

It looks like the post originated here: 24.76.129.22

...So the KLEZ infected person who forged your list address is with shaw.ca
but that is about all I can tell from the headers.

Joan

This thread: