Once or twice I've cleaned spyware off of the computer in question, but most of the time the computers were clean. I've even had one of my servers show up once in an alert, which I went through with a fine-toothed comb afterwards. ________________________________ From: Amy Babinchak [mailto:amy@xxxxxxxxxxxxxxxxxxxxxxxxxx] Sent: Wednesday, March 16, 2005 11:03 To: [ISAserver.org Discussion List] Subject: [isalist] RE: Port Scans http://www.ISAserver.org Dan, Have you checked the machine for virus and malware/adware? The ports and service requests coming from that machine are consistent with some kind of infection. Amy