Wes,

While we're not in the antivirus business (yet...) we are familiar with them as we deal with them every day. You'll want to double-check with your antivirus vendor, however we believe the TROJ_ILLWILL.A you are encountering is actually a variant of the BAGLE virus, specifically TROJ_BAGLE.AC that was discovered on Aug 9, and became very active. Some antivirus vendors (ex. Trend Micro) had initially classified the first virus strains as ILLWILL and then changed name.

You are probably seing real viruses being stopped. Please note that SpamFilter is "antivirus aware", meaning that if one of the temp files SpamFilter caches to drive suddently disappears, SpamFilter will assume antivirus software detected a virus and deleted the file. When this happens, SpamFilter will "understand" and will clean up after itself by deleting the other temp files related to that email and continue processing other messages. If some emails slip thru it is because the antivirus software was not fast enough in deecting the virus in the temp files before SpamFilter processes them (SpamFilter pauses for a few hundreds of a second after writing files to allow A/V software to scan them).

Roberto F.
LogSat Software

We do block just about everything even  including zip files (I take a beating on that! but my IT director backs me up 100%).

I now use three levels of "purifing" the bad email out of my system.

SpamFlter receives the messages, clears out spam, lots of viruses

NAI AV Client realtime scans the file I/O from the workings of Spamfilter catching 99% of all viruses.

NAI WebShield receives the message from SpamFilter, filters out all messages with zip and messages with macros.  The blocked zip/macro messages directory is scanned from time to time and unwanted messages are discarded and the the good ones forwarded to the user.

In addtion to virus attachement type files all mutlimedia file are dis-allowed including mp3, mepg, avi, mov and such

Last year network had two virus infections which were completly contained to the workstation and both of those cases involved users who were checking outside email systems through webmail.  We have just installed SurfControl web filtering and as of two weeks ago we block all outside webaccess and chat including messenging such as Yahoo chat. Last year all POP3 access to outside email system was closed.

I take all virus threats seriously as you can see!!  :)

Yes, I am no longer seeing that virus now that AV signatures have been updated, all is well in Columbia Missouri!!

Oh and too, my users LOVE Spamfilter ISP !!!!