My Z100G Event log is showing a lot of outgoing phishing emails being blocked as suspicious activity. Although the ports and IP addresses vary the typical log entry is of the form:

Connection blocked by VStream Src:192.168.10.112 SPort:1035 Dst:72.14.217.93 DPort:80 IPP:6 Direction:Outbound DataDir:Inbound Filename:N/A Filetype:N/A VirusName:Email.Phishing.RB-1281

Full system scans by Norton/Symantec/ClamAV reveal nothing. Reinstalling the OS (without low level reformat) does nothing but generate even more suspect traffic.

Am I alone with this issue? Does anyone else have a simialr problem? Any ideas anyone?

I get the same logs; the destination address is always one registered to Google according to the ARIN WHOIS database.

quote:

Connection blocked by VStream Src:192.168.10.112 SPort:1035 Dst:72.14.217.93 DPort:80 IPP:6 Direction:Outbound DataDir:Inbound Filename:N/A Filetype:N/A VirusName:Email.Phishing.RB-1281

DPort:80 is the key here I think. To me this reads as web traffic being misidentified as a phishing e-mail signature.