Fsecure detected inbound malware probe from Untangles IP?

[kipper]

Hi,

Fsecure installed on an XP Pro machine has blocked the following traffic from Untangles IP:

Direction: Inbound
Protocol: TCP
Services: Malware - Bagle.Y in
Remote port: 9512
Local Port 2535

The Internet disconnected shortly after this warning

I take it the IP source is the Untangles server IP as the packets travel through it?

I have checked the Untangle logs for viruses and attempted intrusions although nothing is logged.

Any ideas?

Chris.

[Lee Sharp]

Three posibilities.
1) Malware not in the untangle definitions yet. Something scanned and passed would seem to come from the server.
2) False positive from Fsecure. Something scanned and passed would still seem to come from the server.
3) Compromised Untangle server. It could really be the server. This is less likely but possible. It gets very unlikely is untangle is not your only internet facing firewall. (If it is a bridge behind a firewall.)

I placed them in order of likelihood, in my opinion.