在 Windows 资源管理器中，打开 C:\EventSink 文件夹，右键单击左侧窗格，指向新建，然后单击文本文档。
5.
将新文件命名为 Smtpmsgcheck.vbs。如果出现重命名对话框，请单击是。
6.
右键单击新文件，然后单击编辑。在编辑器（记事本）中输入下列 VBScript 代码：
Sub IEventIsCacheable_IsCacheable()
'To implement the interface, and return S_OK implicitly
Eng Sub
Sub ISMTPOnArrival_OnArrival(ByVal Msg, EventStatus )
Dim envFlds
Dim colAttachs
Dim iFound
Set envFlds = Msg.EnvelopeFields
If Msg.Subject = "" Or Len(Msg.Subject) < 5 Then iFound = 0
Else
iFound = Instr(1, Msg.Subject, "VIRUS", 1) ' First position of the word VIRUS
End If
'Check whether the message contains a VBS attachment
Set colAttachs = Msg.Attachments
For Each oAttach in colAttachs
If Instr(1, oAttach.FileName, "vbs", 1)> 0 Then iFound = 1
Next
If iFound > 0 Then
'Do not deliver, place message in the Badmail directory.
envFlds ("http://schemas.microsoft.com/cdo/smtpenvelope/messagestatus") = 3
envFlds.Update 'Commit the changes of the message status
'Skip remain event sinks
EventStatus = 1
End If
End Sub
@ECho Off
REM*********** The following 2 lines install the Event Sink to log SMTP Messages ***********
Cscript smtpreg.vbs /add 1 onarrival SMTPMessageCheck
CDO.SS_SMTPOnArrivalSink "mail from=*"
Cscript smtpreg.vbs /setprop 1 onarrival SMTPMessageCheck Sink
ScriptName "C:\EventSink\SMTPMsgCheck.vbs"
REM ***** Remove the 'REM' tag from the following line *****
REM ***** If you want to deinstall the Event Sink again *****
REM cscript smtpreg.vbs /remove 1 onarrival SMTPMessageCheck
9.
保存更改，然后关闭记事本。
10.
单击开始，单击运行，键入 cmd，然后单击确定以启动 Windows 2000 命令提示符。键入 cd \EventSink 以更改到 C:\EventSink 文件夹。
11.
键入 instsink.bat，然后按 ENTER，执行批处理文件并注册 EventSink 示例以记录消息。验证事件接收已正确注册，然后键入 exit 并按 ENTER 退出命令提示符。
