Symptom:
Inconsistent Virus Reporting across reports

Customer perception: "appliances are failing to report "Virus Detected" statistics in their Incoming Email Summary data."


+Report: Monitor>Overview>Incoming Mail Summary:Virus Detected

Virus Detected Shows: 0

+Report: Monitor>Virus Types: Virus Detected

Virus Type report for the same period as the Overview detailing that multiple[le viruses were processed and blocked..

"Total infected Messages" = 80+ (displayed by virus type)

Conditions:
Online Help File (Categorizing Email Messages on the Overview Page) on the "Virus Messages Detected" Row shows: 
"The total count and percentage of message detected as virus positive and not also spam."

The key point is contained in this sentence:  ?The total count and percentage of message detected as virus positive and not also spam.? (Emphasis is mine.)

Based upon a closer examination of the IronPort modified Subject lines in the Virus Quarantine (when sorted by Subject), I would agree that it appears this algorithm is the one responsible for the perceived discrepancy.

From that viewpoint, I now believe that the Overview, Incoming Mail Details, and other related reporting sections are functioning correctly as designed.

That being said, I cannot say that I am completely happy with the design.