Actually, looks like some one put this back into the spool directory. Notice what time Imail SMTP is processing it and what time Declude scanned it:
20030627 182647 127.0.0.1 SMTPD (067A0288) [216.226.209.71] RCPT TO:<[EMAIL PROTECTED]> 20030627 182658 127.0.0.1 SMTPD (067A0288) [216.226.209.71] E:\IMAILSRVR\spool\D8c09067a02886365.SMD 12250 06/27/2003 18:26:58 Q8c09067a02886365 Scanner 1: Virus=: W32/[EMAIL PROTECTED] (corrupted) Attachment=15-10-GB.pdf.pif [3] I 06/27/2003 18:26:58 Q8c09067a02886365 Found a bogus .pif file 06/27/2003 18:26:58 Q8c09067a02886365 File(s) are INFECTED [: W32/[EMAIL PROTECTED] (corrupted): 3] 06/27/2003 18:26:58 Q8c09067a02886365 Scanned: CONTAINS A VIRUS [MIME: 2 8604] 06/27/2003 18:26:58 Q8c09067a02886365 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [outgoing from 216.226.209.71] 06/27/2003 18:26:58 Q8c09067a02886365 Subject: See todays hottest stars in their most intimate moments 20030627 185551 127.0.0.1 SMTP (5536) E:\IMAILSRVR\spool\Q8c09067a02886365.SMD 20030627 185551 127.0.0.1 SMTP (5536) processing E:\IMAILSRVR\spool\Q8c09067a02886365.SMD Difference is almost 30 minutes. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
