'Check domain/email (mail from) if is in list(line17)  move email from Exchange Queue directory!
'Author: Felipe Ferreira  fel.h2o(a)gmail.com	
'Date: 19/09/2007
'Version: 1.0
'Recommend to stop IIS first...
'Todo: '1, Counters of emails moved, and total scanned

strScriptFile = WScript.ScriptFullname
strScriptPath = Left(strScriptFile, Len(strScriptFile) - Len(WScript.Scriptname)) 'used to define the path from where the script file is located
Dim iFSO : Set iFSO = CreateObject("Scripting.FilesyStemObject")
Dim oFSO : Set oFSO = CreateObject("Scripting.FilesyStemObject")
Dim o2FSO : Set o2FSO = CreateObject("Scripting.FilesyStemObject")

on error resume next

'@@@@@@@@@@@@@@@@@@@@@@@@@@EDIT HERE@@@@@@@@@@@@@@@
outputfile = strScriptPath & "Domains.txt"
pathemail ="c:\temp\badmail\"
strdomainblock1="comcast.net"
strdomainblock2="comcast.com"
strdomainblock3="excite.com"
strdomainblock4="sbcglobal.net"
'CHECK ALSO PATTERNS; for Email or Domain, also 64 where to move email to
'@@@@@@@@@@@@@@@@@@@@@@@@@@EDIT HERE@@@@@@@@@@@@@@@
Set ofile2 = o2FSo.OpenTextFile(Outputfile, 8, TRUE)
Set oFolder = oFSO.GetFolder(pathemail)
Set oFileCollection = oFolder.Files  

 For each oFile in oFileCollection 
  Set ifile = iFSO.OpenTextFile(pathemail & ofile.name)  
  deletefile = false
  Do until ifile.AtEndOfLine
	strLine = ifile.ReadLine
	if instr(strLine,"From:") then
	   
	   strLine = mid(strline,6,69)
	   strLine =Trim(strLine)
	  ' wscript.echo strLine	
'EMAIL ADDRESS
		'strPattern = "^[a-zA-Z][\w\.-]*[a-zA-Z0-9]@[a-zA-Z0-9][\w\.-]*[a-zA-Z0-9]\.[a-zA-Z][a-zA-Z\.]*[a-zA-Z]$"
'DOMAIN NAME
		strPattern = "[a-zA-Z0-9][\w\.-]*[a-zA-Z0-9]\.[a-zA-Z][a-zA-Z\.]*[a-zA-Z]$"
		Set RegEx = New RegExp              
		RegEx.IgnoreCase = True             
		RegEx.Global=True                   
		RegEx.Pattern=strPattern
		Set colMatches=RegEx.Execute(strLine)
		     For Each match In colMatches

			 WScript.Echo "Domain: " & match.value   
		
			    if match.value = strdomainblock1 or  match.value = strdomainblock2 or  match.value = strdomainblock3 or  match.value = strdomainblock4   then
				  filedelete = true
				  ofile2.writeline   match.value
				end if
			 Next
	end if
  loop ' goes thru each line of the file
  
  ifile.close
  wscript.sleep 40
  if filedelete = true then  
	filem = pathemail & "moved\" & ofile.name  
	ofile.move filem	
	filedelete = false
  end if
  
 next 'Go to next file in directory
 
 wscript.echo "done, output IPs at " & Outputfile 
 ofile2.close
 
 wscript.quit