First you will need to add the files to your machine
see http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cdosys/html/_cdosys_enabling_or_disabling_a_binding.asp 
for more information....

First create a sample .vbs file or it won't work..here is one




cscript smtpreg.vbs /add 1 OnArrival SmtpScriptingHost cdo.ss_smtpOnArrivalsink "mail from=*"
cscript smtpreg.vbs /setprop 1  OnArrival SmtpScriptingHost sink scriptname "c:\event sink\smtp.vbs" 
cscript smtpreg.vbs /setprop 1 onarrival SmtpScriptingHost Source priority "300"
cscript smtpreg.vbs /enable 1 OnArrival SmtpScriptingHost


Now all mail entering and leaving using smtp will be montiored and you can perform what ever you like

You can only look at the body of non-TNEF e-mails....so don't try to look at the body of the messages 
It will not all mail.





<SCRIPT LANGUAGE="VBScript">
Sub ISMTPOnArrival_OnArrival( ByVal Msg, Status)
'Create by Matthew Hudson September 2001 
'foriegn spam filter may 2002

  Dim WshShell 
  Dim fs
  Dim file
  Dim Msg
  Dim iBp
  Dim data
  dim Flds
  dim retstring
  dim cis
  dim messageid
  dim spamfield
  Set Msg = CreateObject("CDO.Message")
  Set iBp = Msg.GetInterface("IBodyPart")
  Set data= Msg.GetInterface("IDataSource")
  Set fs = CreateObject("Scripting.FileSystemObject")  
  Set file = fs.OpenTextFile("c:\event sink\maillog.log", 8, True)
 

'***************************************************************** Log File
   file.write  vbCrLf
  file.Write "From: "  & Msg.From & vbCrLf
  file.Write "To: " & Msg.To & vbCrLf
  file.Write "CC To: " & Msg.cc & vbCrLf
  file.Write "BCC To: " & Msg.bcc & vbCrLf
  file.Write "Subject: "& Msg.Subject & vbCrLf
  file.Write "Date-Time: "& Now & vbCrLf
  file.write "Recipentlist Names: " &  & vbCrLf
  file.write "Attachments: " &msg.Attachments.Count& vbCrLf
  file.write "Content-type: " &iBp.Charset & vbCrLf

'**********************************************
'look in the message for the header info
With msg
'grabe the perl mx record and the message id of the e-mail
    cis = .Fields.Item("urn:schemas:mailheader:X-Perlmx-Spam").Value   
    messageid = .Fields.Item("urn:schemas:mailheader:message-id").Value
End With

	' if you found a perlmx record abort the message

if not isempty(cis) then
	' setup to grab the envelope of the message
 set Flds=Msg.EnvelopeFields
 	' 3 is abort cdoStatusAbortDelivery
	'set the status of the message to abort
 Flds.Item("http://schemas.microsoft.com/cdo/smtpenvelope/messagestatus").value = 3
 Flds.Update
	'tell Event sink to skip the remaining parts of the file and move to the next event
 Status = cdoSkipRemainingSinks 
 

end if


'***************************************************reset all before you leave
spamfile.close
file.close
  Status = cdoRunNextSink
  set fs=nothing
  set file=nothing
  set WshShell = nothing
  set objShell = nothing
  set iBp=Nothing
  
'************************************************
 End Sub
 </SCRIPT>