Pro Mail Trojan

  • Thread starter Thread starter Clay Reitsma
  • Start date Start date
C

Clay Reitsma

I am using McAfee Internet Security 6. In MIS 6 there is a traffic monitor
that indicates what programs are listening on which ports. In my case when I
select Port 110 in the traffic monitor, the description of what is listening
on Port 110 says "Pro Mail Trojan / Post Office Protocol - Version 3". I
have run various removal tools for trojans and none of them have detected a
Pro Mail Trojan.

Does anyone know if in fact the problem as described above indicates the
presence of a trojan on my system?
 
I am using McAfee Internet Security 6. In MIS 6 there is a traffic monitor
that indicates what programs are listening on which ports. In my case when I
select Port 110 in the traffic monitor, the description of what is listening
on Port 110 says "Pro Mail Trojan / Post Office Protocol - Version 3". I
have run various removal tools for trojans and none of them have detected a
Pro Mail Trojan.

Does anyone know if in fact the problem as described above indicates the
presence of a trojan on my system?
Click to expand...

Here's some antivirus products that detect the promail trojan:

http://www.virusbtn.com/resources/vgrep/vgrep.cgi?terms=promail&product=0

and here's McAfee's desciption of this password stealer:

http://vil.nai.com/vil/content/v_99148.htm

McAfee should alert as PWS I would think if your PC is infested with
this Trojan.


Art
http://www.epix.net/~artnpeg
 
Clay said:
I am using McAfee Internet Security 6. In MIS 6 there is a traffic monitor
that indicates what programs are listening on which ports. In my case when I
select Port 110 in the traffic monitor, the description of what is listening
on Port 110 says "Pro Mail Trojan / Post Office Protocol - Version 3". I
have run various removal tools for trojans and none of them have detected a
Pro Mail Trojan.

Does anyone know if in fact the problem as described above indicates the
presence of a trojan on my system?
Click to expand...

110 is the standard port for POP3, do you have any pop-proxies
(anti-spam tools) running?

You could type
telnet localhost 110
at the command prompt and see what response you get, something like:

+OK QPOP (version 2.3-XS4ALL) at mailpop13.xs4all.nl starting.
+OK <[email protected]>, POP3 server ready.
+OK Hello there.

type quit to end the session.
 
Back
Top