On Thu, 1 Feb 2007, Brian Loe wrote:
> One of our support technician's machines is attempting to connect to
> random IP addresses on port 25 - in a pretty needy fashion. He says
> he's scanned the box with the latest updates from McAffee and it
> hasn't found anything.
>
> We discovered it because one of my basic (meaning I got it off the
> 'Net) rules for SEC flagged it as a possible PHEL trojan.
>
> Any thoughts?
See what process keeps opening sockets?
Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
paul@compuwar.net which may have no basis whatsoever in fact."
_______________________________________________
firewall-wizards mailing list
firewall-wizards@listserv.icsalabs.com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
|