thanks greg, if you are using unxutils, would you mind sharing how you put the incoming/outgoing together?
We have very few infections (so far) from within our school distrcit but when they do occur, it would be nice to know it.... I t's a great add! bob On Tuesday, April 27, 2004 12:23 PM, Greg Little <[EMAIL PROTECTED]> wrote: > Hopefully Greg H will answer your question for "counts" >�but, if you want to do it for notification e-mails. (using a % variable) > You can set a rule in your e-mail to route ones with this >phrase to a place where you will "see" them. > > We've had very few of these, but in this case one of the >customers we host "stacy-insurance.com" sent a few Netsky's. So >we contacted them and the viruses quit coming. > (For spoofing viruses, which is almost all now days, you won't >know the user name, but may be able to get the domain.) > > Greg Little > > >Declude Virus Ver. 1.79 caught the the W32/[EMAIL PROTECTED] virus in document.pif >from [Forged] to: [EMAIL PROTECTED] > >Date: 04/13/2004 10:19:27 >Subject: Re: Re: Thanks! >Spool File: Df6e7707601540904.SMD >Remote IP: 64.108.112.144 > >In or Out: outgoing >recipient host: yahoo.com >Sender Host: bhfqh.com > >Headers: >Received: from yahoo.com [64.108.112.144] by mail.stacy-insurance.com with ESMTP > (SMTPD32-8.05) id A6E770760154; Tue, 13 Apr 2004 10:19:19 -0400 > . . . > > > Bob McGregor wrote: > >Greg, > >how are you defining the counts inbound/outbound? That would be >nice so you know when it's one of your own sending out... > > > > --- [This E-mail scanned for viruses by Findlay Internet] --- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] --- This E-mail came from the >Declude.Virus mailing list. To unsubscribe, just send an E-mail >to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". >The archives can be found at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
