Hi, I'm trying to link the filenames in the queue to entries in the SMTP log. The filename used by exchange doesn't appear to be an extended option on including in the log (and doesn't appear to be one of the defaults either). Is there some algorithm for mapping these? Specifically I'd like to determine the recipient/sender of a particular NTFS_.EML file (without opening the file, or after the fact). The reason being that the antivirus software on the server has been occasionaly finding a virus in the NTFS_.EML files over the last few days (HTML/Phishbank.BWB). My assumption is that these are non-delivered junk emails as none have been routed and picked up on any other machines. ETrust is telling me the file was cured, but has long since left the queue directory by the time I come to look for it. All I have left is the filename reported by ETrust (NTFS_*.EML), but this doesn't seem to match anything in the SMTP log. Any suggestions? Thanks, Nick.