What is a Reason for Outgoing TCP Connections to Port 25 (SMTP) From Random TCP Ports on a PC with no Email Client Running?
What is a Reson for Outgoing Tcp Connections to Port 25 (SMTP) From Random Tcp Ports on a Pc with no Emamil Client Running? The IP addresses that it was trying to reach resolved to yahoo and aol webmail mx servers. I am trying to track down a spam virus in a network, is this sysmptoms of the virus.
Software/Hardware used:
Software/Hardware used:
ASKED:
June 20, 2010 8:48 PM
UPDATED:
June 22, 2010 12:24 AM
Answer Wiki:
It certainly could be. VIruses can replicate using email from an infected client.
To see all answers submitted to the Answer Wiki: View Answer History.
It could also be other type of malware, such as a key logger or other type of spyware. These programs use to have smtp functionality to send data they gather from the victim.
It’s something sending out email that shouldn’t be.
One way to stop this is to block all computers from connecting from inside your network to outside your network on port 25, except for the machines which should be (your Exchange mail gateway for example).