<Sorry about previous message I forgot to change the subject> Scott,
Looking at the logging in terms of vulnerabilities I noticed that under certain circumstances it does not print out the "File(s) are Infected" line when the vulnerability is found in the subject or from field. Is this by design? Also, in terms of when it catches the vulnerability in something other than the subject what does "[X-1:" stand for? Thanks Darrell 08/31/2004 01:38:01 Q0eb966f604807108 Outlook 'CR' vulnerability [X-1: At Bi] in line 8 08/31/2004 01:38:02 Q0eb966f604807108 File(s) are INFECTED [[Outlook 'CR' Vulnerability]: 0] 08/31/2004 01:38:02 Q0eb966f604807108 Scanned: CONTAINS A VIRUS 08/31/2004 01:38:02 Q0eb966f604807108 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [outgoing from 63.247.75.250] 08/31/2004 01:38:02 Q0eb966f604807108 Subject: est Drive the Red Ferrari for Unlimited Free Leads 08/31/2004 00:02:03 Qf83a69e905108edd Outlook 'CR' vulnerability [Subject: T] in line 13 08/31/2004 00:02:03 Qf83a69e905108edd Scanned: CONTAINS A VIRUS [MIME: 1 274] 08/31/2004 00:02:03 Qf83a69e905108edd From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [outgoing from 82.225.129.128] 08/31/2004 00:02:03 Qf83a69e905108edd Subject: This is incredible,free Vi'ag;r;a ------------------------------------------- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
