When its not virus scanned yet, or it has been moved on later passes of the virus scanner, probably should swap these conditions.