RE: Trojan or something ?

  • From: Syed Muqeemuddin <smuqeem@xxxxxxxxxxx>
  • To: "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
  • Date: Tue, 5 Aug 2003 11:04:22 +0300

What other softwares have u installed on the exchange server, any drivers..
scanners.. printers anything at all...????. 
Get a sniffer running on your network.. it will tell you more information
about the traffic... apart from the port number and the ip address of the


Syed Muqeemuddin
Network Administrator
Saudi International Petrochemical Company
Al-Khobar; Kingdom of Saudi Arabia
Tel: +9663-801-0111 Extn-281


-----Original Message-----
From: John Tolmachoff (Lists) [mailto:johnlist@xxxxxxxxxxxxxxxxxxx] 
Sent: Tuesday, August 05, 2003 9:16 AM
To: [ExchangeList]
Subject: [exchangelist] RE: Trojan or something ?

> My Exchange 5.5 Server doing some illegal activities. Firewall log shows
> that it  tries to connect to some unknown Private Class C IP (While Our
> network is using Private Class A IP addresses) and IP address
> of our node). Destination port is 4939, 4940, 4561, 1519 and 1528. Is this
> normal or some kind of trojan ?

Run, do not walk, to your nearest virus scanner and spyware scanner and scan
the system.

It does sound suspious.

John Tolmachoff MCSE CSSA
eServices For You

List Archives:
Exchange Newsletters:
Exchange FAQ:
Other Internet Software Marketing Sites:
Leading Network Software Directory:
No.1 ISA Server Resource Site:
Windows Security Resource Site:
Network Security Library:
Windows 2000/NT Fax Solutions:
You are currently subscribed to this Discussion List as:
To unsubscribe send a blank email to

Other related posts: