On 8.3.2011, at 12.43, Mark Adams wrote: > Warning: Network TCP port 1984 is being used by /usr/lib/dovecot/imap. > Possible rootkit: Fuckit Rootkit > Use the 'lsof -i' or 'netstat -an' command to check this. > > Does dovecot use this port for any reason? anyone seen this before? No & no.