We are getting an email with the subject line
UPS: Your Tracking # (insert large number)
Many times per day, per user.
AVAST in SBS isn't cleaning it, but then again, Trend Micro on another system isn't as well.
Is there somewhere I can submit a sample of it, to be checked please?