Make sure you are on the latest version of your mail server, if it is Imail then you should make sure it is not a vulnerable version. Also check your OS to see if it has been compromised.
Do all the normal stuff to check for a compromised box. Kevin Bilbee From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Thursday, May 17, 2007 8:16 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Spammer authenticating Dear all Last week, i caught a spammer authenticating to my sever (using admin and test account) I deleted these accounts (how does he found the passwords ?) Today, i found same, using info account But i have no info account, only alias Looking at logs, found that he autanticated using [EMAIL PROTECTED] Any idea what is he doing ? why is the qfile showing [EMAIL PROTECTED] ? QF:\Imail\spool\D074200390000c9ac.SMD Hmail.mydomain.com I074200390000c9ac T3 E0, S<[EMAIL PROTECTED]> Y1 V0 [EMAIL PROTECTED] NRCPT To:<[EMAIL PROTECTED]> R<[EMAIL PROTECTED]> --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
