Ouch! Sigh. ;-( There goes my weekend. Thanks for the good advice - again.
Rick ---------- Original Message ---------------------------------- From: "Kevin Bilbee" <[EMAIL PROTECTED]> Reply-To: [email protected] Date: Fri, 25 Nov 2005 15:51:08 -0800 Since this is a mail server you may be better served by doing a clean install of the OS. If you are still getting popups then you still have something on the machine. What ever it is may download and install other bad things. Kevin Bilbee > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Rick Brooks > Sent: Friday, November 25, 2005 1:06 PM > To: [email protected] > Subject: RE: [IMail Forum] virus on mailserver? > > > Thanks for the good advice. > > I did the following: > I upgraded mailserver to imail 8.15HF2 > Killerwebmail to 8.04 (edited templates afterwards) > Scanned server and found virus in several mailboxes that were > uncleanable (F-prot did not want to clean files in archive). > So the offending virus names (some files named .zip) were > documented as well as the mailbox names and passwords. The > mailboxes were deleted (sorry about that) and recreated after > reboot, the .zip file names were added to the virus.cfg file > in Declude to make sure we did not allow those thru again. > > The performance is fast again and solid except the pop-ups > are still coming up on the desktop. > > > I tried the mail archive and did not find anything that would > be related because we do not have LDAP running (or would we > be vulnerable anyway?) > > Rick > > > > > ---------- Original Message ---------------------------------- > From: "Travis Rabe" <[EMAIL PROTECTED]> > Reply-To: [email protected] > Date: Thu, 24 Nov 2005 10:33:02 -0800 > > That is not a good sign. Check the archives. Someone else > had run into this in the past by way of an IMAP > vulnerability. They had to wipe/reload the server. Anytime > the Imail Client just opens ans closes, something is > accessing it. IF it isn't you, then it's someone else. > > Travis > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Rick Brooks > Sent: Thursday, November 24, 2005 7:53 AM > To: [email protected] > Subject: [IMail Forum] virus on mailserver? > > Hello, > I am an email admin for a small ISP and we are using Imail > 8.14, Declude AV, Junkmail PRO, and Hijack with F-Prot. This > week we are seeing an imail email client popping up on the > desktop of the Win 2K server. Has anyone seen this, know what > it is and how to dis-able it? > > Thanks in advance, > > Rick > > > ______________ ______________ ______________ ______________ > Sent via the WebMail system at clearsurfusa.com > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > > > ______________ ______________ ______________ ______________ > Sent via the WebMail system at clearsurfusa.com > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > --- > [This E-mail scanned for viruses by Declude Virus] > > --- [This E-mail scanned for viruses by Declude Virus] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ ______________ ______________ ______________ ______________ Sent via the WebMail system at clearsurfusa.com To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
