Hi,
> 3. Viewing the log for the night before the attack I found an
> unusual number
> connections to ports on the server - port numbers I don't usually
> associate
> with e-mail. I have copied and pasted a sample at the end of this message.
> My question is whether this could be related to the hijacking or if it
> indicates normal activity?
These entries are generated by the monitor service which connects to
the SMTP service in specific time intervals to check if it is still
alive. You should find those eintries all over the log, they are normal.
bye
Markus Oestreicher
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
