diff -urN src.orig/malware.c src/malware.c
--- src.orig/malware.c	Sat Aug 21 08:46:24 2004
+++ src/malware.c	Sat Aug 21 08:46:23 2004
@@ -21,8 +21,9 @@
 #define SHUT_WR 1
 #endif
 
-#define DRWEBD_SCAN_CMD 	0x0001
-#define DRWEBD_RETURN_VIRUSES	0x0001
+#define DRWEBD_SCAN_CMD             (1)     /* scan file, buffer or diskfile */
+#define DRWEBD_RETURN_VIRUSES       (1<<0)   /* ask daemon return to us viruses names from report */
+#define DRWEBD_IS_MAIL              (1<<19)  /* say to daemon that format is "archive MAIL" */
 
 /* Routine to check whether a system is big- or litte-endian. 
    Ripped from http://www.faqs.org/faqs/graphics/fileformats-faq/part4/section-7.html
@@ -174,7 +175,7 @@
 
 			/* prepare variables */
 			drweb_cmd = htonl(DRWEBD_SCAN_CMD);
-			drweb_flags = htonl(DRWEBD_RETURN_VIRUSES);
+			drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
 			snprintf(CS scanrequest, 1024,CS"%s/scan/%s/%s.eml", 
 				    spool_directory, message_id, message_id);
 
@@ -257,7 +258,7 @@
       
 			/* prepare variables */
 			drweb_cmd = htonl(DRWEBD_SCAN_CMD);
-			drweb_flags = htonl(DRWEBD_RETURN_VIRUSES);
+			drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
 			snprintf(CS scanrequest, 1024,CS"%s/scan/%s/%s.eml", spool_directory, message_id, message_id);
 			drweb_slen = htonl(Ustrlen(scanrequest));