Update the virus definitions = being using (ok, not for the off line, but how many off line computers will have?).
That would be a possibility, if there were program ids or similar, but afaik there aren't. (happy about that!)
And as most users are on dynamic IPs, it's quite hard to follow/track...!
asyn