sendmail log question

Found some odd log file entries while combating SOBIG.e



This first entry shows one instance of receiving the virus.  It has
both sendmail accepting the message and sendmail delivering the message.

I also pasted the header of the message. Pretty normal.

---

Jun 25 18:05:42 mail sendmail[4918]: h5PM5dC04918:
from=<[email protected]>,
size=111813, class=0, nrcpts=1,
msgid=<[email protected]>,
proto=ESMTP, daemon=MTA, relay=hv.domain.com [10.10.50.25]

Jun 25 18:05:42 mail sendmail[4942]: h5PM5dC04918:
to=<[email protected]>,
delay=00:00:03, xdelay=00:00:00, mailer=local, pri=141498, dsn=2.0.0,
stat=Sent

Return-Path: <[email protected]>
Received: from 94X8JT (hv.domain.com [10.10.50.25])
        by mail.domain.com (8.11.6/8.11.6) with ESMTP id
h5PM5dC04918
        for <[email protected]>; Wed, 25 Jun 2003
18:05:39 -0400
Message-Id: <[email protected]>
From: <[email protected]>
To: <[email protected]>
Subject: Re: Movie
Date: Wed, 25 Jun 2003 17:05:34 --0500
Importance: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MSMail-Priority: Normal
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="CSmtpMsgPart123X456_000_018486FB"

-------

These entries do not have a log file entry for sendmail
accepting the message for delivery.  Only sendmail
delivering the message.  I included 1 header

-------
Jun 25 17:18:05 mail sendmail[2397]: h5PLI2C02352:
to=<[email protected]>, delay=00:00:03, xdelay=00:00:01,
mailer=local, pri=141498, dsn=2.0.0, stat=Sent

Jun 25 16:51:54 mail sendmail[15546]: h5PKpoC15537:
to=<[email protected]>, delay=00:00:04, xdelay=00:00:01,
mailer=local, pri=141498, dsn=2.0.0, stat=Sent

Return-Path: <[email protected]>
Received: from MNELSON_LT (hv.domain.com [10.10.50.25])
        by mail.domain.com (8.11.6/8.11.6) with ESMTP id
h5PKpoC15537
        for <[email protected]>; Wed, 25 Jun 2003
16:51:50 -0400
Message-Id: <[email protected]>
From: <[email protected]>
To: <[email protected]>
Subject: Re: Movie
Date: Wed, 25 Jun 2003 16:51:50 --0400
Importance: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MSMail-Priority: Normal
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="CSmtpMsgPart123X456_000_009B6ABD"

Jun 25 16:44:30 mail sendmail[9640]: h5PKiOC09573:
to=<[email protected]>, delay=00:00:04, xdelay=00:00:02,
mailer=local, pri=141498, dsn=2.0.0, stat=Sent

I tried grep the log file for the smtp id's in all
instances.  I sent mail from yahoo, my client, pine on
the mail server and a machine that lived on the same
subnet.  All have two entries in the log file.  Has
anyone else seen the single entry in their logs?  I also
grep'ed -20 and looked at the lines nearby.  The
10.10.50.25 is the firewall and shows if nothing else
they came from the outside.

Thanks,
Gordon Bowersox