Rick, Please let me know if the rebuild fixes this. We have this happen (Imail1.exe opens on the server desktop) and our configuration is the same as yours (Imail 8.15HF2, and the 3 Decludes 1.82). This only seems to happen when there is a rash of the Sober viruses going around.
Thanks, Mike -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Friday, November 25, 2005 11:59 PM To: [email protected] Subject: RE: [IMail Forum] virus on mailserver? I will join you in spirit on Saturday. I will be at a client rebuilding their server. John T eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:IMail_Forum- > [EMAIL PROTECTED] On Behalf Of Rick Brooks > Sent: Friday, November 25, 2005 6:04 PM > To: [email protected] > Subject: RE: [IMail Forum] virus on mailserver? > > Ouch! > Sigh. > ;-( > There goes my weekend. > > Thanks for the good advice - again. > > Rick > > > ---------- Original Message ---------------------------------- > From: "Kevin Bilbee" <[EMAIL PROTECTED]> > Reply-To: [email protected] > Date: Fri, 25 Nov 2005 15:51:08 -0800 > > Since this is a mail server you may be better served by doing a clean > install of the OS. If you are still getting popups then you still have > something on the machine. What ever it is may download and install other bad > things. > > > > > Kevin Bilbee > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Rick Brooks > > Sent: Friday, November 25, 2005 1:06 PM > > To: [email protected] > > Subject: RE: [IMail Forum] virus on mailserver? > > > > > > Thanks for the good advice. > > > > I did the following: > > I upgraded mailserver to imail 8.15HF2 > > Killerwebmail to 8.04 (edited templates afterwards) > > Scanned server and found virus in several mailboxes that were > > uncleanable (F-prot did not want to clean files in archive). > > So the offending virus names (some files named .zip) were > > documented as well as the mailbox names and passwords. The > > mailboxes were deleted (sorry about that) and recreated after > > reboot, the .zip file names were added to the virus.cfg file > > in Declude to make sure we did not allow those thru again. > > > > The performance is fast again and solid except the pop-ups > > are still coming up on the desktop. > > > > > > I tried the mail archive and did not find anything that would > > be related because we do not have LDAP running (or would we > > be vulnerable anyway?) > > > > Rick > > > > > > > > > > ---------- Original Message ---------------------------------- > > From: "Travis Rabe" <[EMAIL PROTECTED]> > > Reply-To: [email protected] > > Date: Thu, 24 Nov 2005 10:33:02 -0800 > > > > That is not a good sign. Check the archives. Someone else > > had run into this in the past by way of an IMAP > > vulnerability. They had to wipe/reload the server. Anytime > > the Imail Client just opens ans closes, something is > > accessing it. IF it isn't you, then it's someone else. > > > > Travis > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Rick Brooks > > Sent: Thursday, November 24, 2005 7:53 AM > > To: [email protected] > > Subject: [IMail Forum] virus on mailserver? > > > > Hello, > > I am an email admin for a small ISP and we are using Imail > > 8.14, Declude AV, Junkmail PRO, and Hijack with F-Prot. This > > week we are seeing an imail email client popping up on the > > desktop of the Win 2K server. Has anyone seen this, know what > > it is and how to dis-able it? > > > > Thanks in advance, > > > > Rick > > > > > > ______________ ______________ ______________ ______________ > > Sent via the WebMail system at clearsurfusa.com To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
