thank you. that worked great! i now know where these are coming from. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Eje Gustafsson Sent: Friday, May 10, 2002 11:32 AM To: Ric Stevenson Subject: Re[2]: [Declude.Virus]
Add Remote IP: %REMOTEIP% to your postmaster.eml file that way you will get the ip of the sender in your virus notification. Friday, May 10, 2002, 10:51:37 AM, you wrote: RS> how do i find the ip address on the imail server? RS> -----Original Message----- RS> From: [EMAIL PROTECTED] RS> [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry RS> Sent: Friday, May 10, 2002 10:46 AM RS> To: [EMAIL PROTECTED] RS> Subject: Re: [Declude.Virus] >>i have a user getting about 100 notifications a day from an unknown source >>trying to send the SirCam worm virus. >>------------------------- >>Declude Virus v1.46 caught the : W32/Sircam.worm@mm virus in Volumn.doc.bat >>from <> to: (ouruser)@(ourdomain).com. >> >>Date: 05/10/2002 09:45:51 >>Subject: Volumn >>Spool File: Ddd1c02d800f8614a.SMD >>------------------------- >>can i stop this one particular one somehow? RS> The best thing to do is check out what IP address it is coming from. From RS> the IP, you may be able to determine who is sending it (or, you can contact RS> whoever is responsible for that IP, by using IPWHOIS at RS> http://www.DNSstuff.com ). RS> -Scott RS> --- RS> [This E-mail was scanned for viruses by Declude Virus RS> (http://www.declude.com)] RS> This E-mail came from the Declude.Virus mailing list. To RS> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RS> type "unsubscribe Declude.Virus". You can E-mail RS> [EMAIL PROTECTED] for assistance. You can visit our web RS> site at http://www.declude.com . RS> --- RS> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] RS> This E-mail came from the Declude.Virus mailing list. To RS> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RS> type "unsubscribe Declude.Virus". You can E-mail RS> [EMAIL PROTECTED] for assistance. You can visit our web RS> site at http://www.declude.com . RS> --- RS> [This E-mail scanned for viruses by Declude Virus] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231-7777 Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
