That would be the spool\virus directory, correct? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com
> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Friday, August 29, 2003 5:51 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.Virus] SoBig > > > >is there a utility that will go thru the log and count the numbers of > >viruses per remote (or local) ip adress? so i can block the most guilty > >adresses on my gateway ? > > You might want to go to the spool directory at a command prompt, and type: > > find "Received:" D*.SMD > file1.txt > sort < file1.txt > file2.txt > > Then, you can open file2.txt with Notepad and scroll through it to find the > worst offenders. If you have several weeks or more of viruses in there, > you may want to clear out the directory and only use new incoming viruses. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
