That is what I am suspecting, but I am trying to see if there is a way to track down a way to see where it came from, inside or outside.
John Tolmachoff Network Engineer 211 E. Imperial Hwy., Suite 106 Fullerton, CA� 92835 714-578-7999, ext. 104 [EMAIL PROTECTED] www.reliancesoft.com � -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of NetQuick Mail Administrator Sent: Monday, January 28, 2002 6:04 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] OT: Exchange Logs Does this sound like the dates: "This virus only attempts to massmail itself on January 25, 26, 27, 28 or 29, 2002. The users default SMTP server is retrieved from the registry. " If so it is the W32/Myparty.a@MM virus. Kevin Childers ,,,,, ����} ~' Customer Support Desk (910) 486-7845 / (888) 228-0312 Fayetteville Internet Communications APCNet - FayNet - NetQuick - QuickWAN The Carolinas' Fastest Internet Communications Provider ----- Original Message ----- From: "John Tolmachoff" <[EMAIL PROTECTED]> To: "Imail Forum" <[EMAIL PROTECTED]> Sent: Monday, January 28, 2002 7:16 PM Subject: [IMail Forum] OT: Exchange Logs I consult for a company that uses Exchange 2000. In the last for days, the exchange.log directory that holds the logs has grown huge. Each daily log is over 2.25 GB. These logs are extremely hard to comprehend. Any one know how to ready them? I suspect a mass-mailing virus, but am trying to nail down the sender. I have a log that is about 1/2 MB that I can email someone for them to look at. Please contact me Off-list ASAP. Thank you. John Tolmachoff Network Engineer 211 E. Imperial Hwy., Suite 106 Fullerton, CA 92835 714-578-7999, ext. 104 [EMAIL PROTECTED] www.reliancesoft.com Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
