> > Since I upgraded our email server to qmail-scanner-1.21st (from 1.16) > > and courier-imap-3.0.3 (from 2.2.1) we have been seeing Port Scan > > Attack's hit client computers which are running McAfee Internet Security > > Suite 6 and behind a Netgear Firewall. > > Sorry - you're a bit vague there. Are you saying you are seeing port scans > originating from your Qmail-Scanner server? If so, then either the box is > compromised, or your firewall/IDS is misidentifying attacks > > Not really much to do with Qmail-Scanner....
Yes, it comes from the IP address of the Qmail-Scanner server through the IMAP port. We also updated our Netgear router/firewall's firmware at the same time. We are just trying to track this down and because we updated several pieces of software we are post this on the lists for each of the softwares involved. The client software is Outlook 2000 and Outlook Express 6 if that makes any difference. We have run scans on our client machines and have not found any viruses. We also scaned the email server with clamav 0.70 and not found any viruses either. Any ideas why it come from the IMAP port of that machine. It happens after a IMAP session is finished. -- Lloyd Albin <[EMAIL PROTECTED]> ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
