Make sure you are on the latest version of your mail server, if it is Imail
then you should make sure it is not a vulnerable version. Also check your OS
to see if it has been compromised.
Do all the normal stuff to check for a compromised box.
Kevin Bilbee
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge
Sent: Thursday, May 17, 2007 8:16 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Spammer authenticating
Dear all
Last week, i caught a spammer authenticating to my sever (using admin and
test account)
I deleted these accounts (how does he found the passwords ?)
Today, i found same, using info account
But i have no info account, only alias
Looking at logs, found that he autanticated using
[EMAIL PROTECTED]
Any idea what is he doing ? why is the qfile showing [EMAIL PROTECTED]
?
QF:\Imail\spool\D07420039c9ac.SMD
Hmail.mydomain.com
I07420039c9ac
T3
E0,
S[EMAIL PROTECTED]
Y1
V0
[EMAIL PROTECTED]
NRCPT To:[EMAIL PROTECTED]
R[EMAIL PROTECTED]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
