There are two methods used to identify these emails to you. Firstly, the subject line of the affected email will be prefixed with one of the following:
o {Virus?} - indicates that the email contained a virus and has had the attachment removed.
o {Filename?} - indicates that the email contained a potentially dangerous file attachment which has been removed.
o {Spam?} - indicates that the email is likely to be spam
o {Spam!} - indicates that the email is almost definitely spam because it got a very high detection score

The system will also "disarm" any emails that contain html tags that are considered dangerous, e.g. iframe and form tags. It will also detect and modify "phishing" type emails, by detecting if the link the email shows is the same as the hyperlink it is linked to.

Secondly, additional headers are added to the email:
o X-WTTW-VirusCheck: Found to be clean - indicates that the email passed the virus scanning tests.
o X-WTTW-VirusCheck: Found to be infected - indicates that email email contained a virus which has been removed.
o X-WTTW-SpamCheck: spam - indicates that the email is likely to be spam and contains information on how the score was reached.
o X-WTTW-SpamScore: ## - indicates the spam score for the email. The # will be the spam score received. The service has a threshold of 5 for {Spam?} and 20 for {Spam!}