I've not seen this in my router log prior to installing ClamWin. Can't say positively it's because of ClamWin but simply a coincidence

" get pre_option_upper=SUBSCRIBE "

I get multiple instances of this weird entry every few minutes. Six to 10 lines of this and then one or two IP addresses like 208.75.98.1 (from Community Wireless in KS),
203.94.243.191 (from India) and a couple from China servers. The IP addresses are pretty much standard fare but the weird log entry has me snowed.

Have searched the web and these forums and not a single hit. Anyone else ever run across this?

The router is a LinkSys BEFSR81 ver 2.51.3 firmware. I access the small business network via UltraVNC to view the logs and have never seen this prior to installing ClamWin on a Win2003 (WHS) server. I'll start isolating the system to see if I can narrow down what is generating this but that is difficult to do remotely *and* monitor the distant router logs at the same time.

If anyone has a clue - please enlighten me as to the meaning of this message....

Thanks,

BobS

Not much help here, but I found a reference on an antispyware forum to 203.94.243.191. In connection with that address, someone claimed that port 1434 was being hit repeatedly with an intrusion named a s WinMSSQL.worm.Helkern. The other address, 208.75.98.1 appears to be some kind of kinky site from my quick look.

Regards,

Thanks for your time and research. I'm working remotely right now trying to isolate the source from within the network. Thought maybe it was one of the workstations that has a trial version of BitDefender on it and I disabled it. Still get the message.....;-(

Appreciate your help.

BobS