Re: Tracking source of outbound SMTP messages

Jim,

>I would try a comm trace. It shows source & destination IP's.

Thanks.  That was enough to get to the bottom of it.  The trace showed that all
the traffic was only from the 400 itself, and not virus traffic at all.  It
turned out to be the infamous looping in the SMTP server, which had never
happened before at this installation.

It was coincidence I guess that it happened at the same time as they were
disinfecting the Fizzer hit.  Or more likely related to it as a partially
completed mail was stopped when the anti-virus fix took over, and left a
malformed entry in the MSF queue.  Or whatever.

After one warm start the volume was down to one smtp instance in NETSTAT *CNN,
and after a second warm start it resumed normal operations.  This at least
explains why I wasn't seeing another entry under NETSTAT *CNN for the mail
arriving from the PC to get relayed out to the net.  And why they couldn't find
a PC still infected...

Doug