Ric this is a copy of my postmaster.eml file ++start++ SKIPIFVIRUSNAMEHAS Vulnerability SKIPIFVIRUSNAMEHAS W32/Klez From: declude@%LOCALHOST% To: postmaster@%LOCALHOST% Subject: Declude Virus caught a virus
Declude Virus v%VERSION% caught %VIRUSNAME% virus in %VIRUSFILE% from %MAILFROM% to: %ALLRECIPS%. Date: %DATE% %TIME% Subject: %SUBJECT% Spool File: %QUEUENAME% Remote IP: %REMOTEIP% Headers: %HEADERS% ++end++ Friday, May 10, 2002, 11:59:00 AM, you wrote: RS> thank you. that worked great! i now know where these are coming from. RS> -----Original Message----- RS> From: [EMAIL PROTECTED] RS> [mailto:[EMAIL PROTECTED]]On Behalf Of Eje Gustafsson RS> Sent: Friday, May 10, 2002 11:32 AM RS> To: Ric Stevenson RS> Subject: Re[2]: [Declude.Virus] RS> Add RS> Remote IP: %REMOTEIP% RS> to your postmaster.eml file that way you will get the ip of the sender RS> in your virus notification. RS> Friday, May 10, 2002, 10:51:37 AM, you wrote: RS>> how do i find the ip address on the imail server? RS>> -----Original Message----- RS>> From: [EMAIL PROTECTED] RS>> [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry RS>> Sent: Friday, May 10, 2002 10:46 AM RS>> To: [EMAIL PROTECTED] RS>> Subject: Re: [Declude.Virus] >>>i have a user getting about 100 notifications a day from an unknown source >>>trying to send the SirCam worm virus. >>>------------------------- >>>Declude Virus v1.46 caught the : W32/Sircam.worm@mm virus in RS> Volumn.doc.bat >>>from <> to: (ouruser)@(ourdomain).com. >>> >>>Date: 05/10/2002 09:45:51 >>>Subject: Volumn >>>Spool File: Ddd1c02d800f8614a.SMD >>>------------------------- >>>can i stop this one particular one somehow? RS>> The best thing to do is check out what IP address it is coming from. RS> From RS>> the IP, you may be able to determine who is sending it (or, you can RS> contact RS>> whoever is responsible for that IP, by using IPWHOIS at RS>> http://www.DNSstuff.com ). RS>> -Scott RS>> --- RS>> [This E-mail was scanned for viruses by Declude Virus RS>> (http://www.declude.com)] RS>> This E-mail came from the Declude.Virus mailing list. To RS>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RS>> type "unsubscribe Declude.Virus". You can E-mail RS>> [EMAIL PROTECTED] for assistance. You can visit our web RS>> site at http://www.declude.com . RS>> --- RS>> [This E-mail was scanned for viruses by Declude Virus RS> (http://www.declude.com)] RS>> This E-mail came from the Declude.Virus mailing list. To RS>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RS>> type "unsubscribe Declude.Virus". You can E-mail RS>> [EMAIL PROTECTED] for assistance. You can visit our web RS>> site at http://www.declude.com . RS>> --- RS>> [This E-mail scanned for viruses by Declude Virus] RS> Best regards, RS> Eje Gustafsson mailto:[EMAIL PROTECTED] RS> --- RS> The Family Entertainment Network http://www.fament.com RS> Phone : 620-231-7777 Fax : 620-231-4066 RS> eBay UserID : macahan RS> - Your Full Time Professionals - RS> --- RS> [This E-mail scanned for viruses by Declude Virus] RS> --- RS> [This E-mail was scanned for viruses by Declude Virus RS> (http://www.declude.com)] RS> This E-mail came from the Declude.Virus mailing list. To RS> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RS> type "unsubscribe Declude.Virus". You can E-mail RS> [EMAIL PROTECTED] for assistance. You can visit our web RS> site at http://www.declude.com . RS> --- RS> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] RS> This E-mail came from the Declude.Virus mailing list. To RS> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RS> type "unsubscribe Declude.Virus". You can E-mail RS> [EMAIL PROTECTED] for assistance. You can visit our web RS> site at http://www.declude.com . RS> --- RS> [This E-mail scanned for viruses by Declude Virus] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231-7777 Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
