An attempt is underway to capture valid email addresses. A directory harvest attack is accomplished by emailing to the target domain with a specified number of non-existent recipient addresses sent from the same IP address.
Email virus attack
A specified quantity of infected email messages has been received from a particular IP address.
Bad Sender Groups
An email message, domain, or IP address is a member of one of the following groups:
An email or IM message contains a virus, based on current Symantec virus filters.
An email or IM message contains a mass-mailing worm, based on current Symantec virus filters.
Unscannable for viruses
An email or IM message exceeds the container limits configured on the Scanning Settings page or is unscannable for other reasons. For example, a message or an attachment that contains malformed MIME cannot be scanned for viruses.
An email or IM message contains an attachment that is encrypted or password-protected and therefore cannot be scanned.
Spyware or adware
An email or IM message contains any of the following types of security risks: spyware, adware, hack tools, dialers, joke programs, or remote access programs.