RE: Trojan or something ?
- From: Syed Muqeemuddin <smuqeem@xxxxxxxxxxx>
- To: "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
- Date: Tue, 5 Aug 2003 11:04:22 +0300
What other softwares have u installed on the exchange server, any drivers..
scanners.. printers anything at all...????.
Get a sniffer running on your network.. it will tell you more information
about the traffic... apart from the port number and the ip address of the
destination.
Syed Muqeemuddin
Network Administrator
Saudi International Petrochemical Company
Al-Khobar; Kingdom of Saudi Arabia
Tel: +9663-801-0111 Extn-281
-----Original Message-----
From: John Tolmachoff (Lists) [mailto:johnlist@xxxxxxxxxxxxxxxxxxx]
Sent: Tuesday, August 05, 2003 9:16 AM
To: [ExchangeList]
Subject: [exchangelist] RE: Trojan or something ?
http://www.MSExchange.org/
> My Exchange 5.5 Server doing some illegal activities. Firewall log shows
> that it tries to connect to some unknown Private Class C IP (While Our
> network is using Private Class A IP addresses) and IP address 3.0.0.2
(none
> of our node). Destination port is 4939, 4940, 4561, 1519 and 1528. Is this
> normal or some kind of trojan ?
Run, do not walk, to your nearest virus scanner and spyware scanner and scan
the system.
It does sound suspious.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist
Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 ISA Server Resource Site: http://www.isaserver.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this MSExchange.org Discussion List as:
smuqeem@xxxxxxxxxxx
To unsubscribe send a blank email to
$subst('Email.Unsub')
Other related posts:
