PDF files are notorious to have nasty viruses and I suspect that this is a caution that "Attachments downloaded from the internet may contain viruses" -- noting the operative word 'may contain' as opposed to 'does contain'.  There was an update in Outlook that kicks in this extremely cautious mode.  You can see that via a Google search.

Did they test it?  Save the attachment and let ESET scan it.  If it has one, it was created either at the source, or at the destination and should be dealt with there; or it's a false alarm.

Timeslips doesn't create viruses and merely packages up a PDF version of the bill, and sends it to the installed email client to deliver it.

Hi Roger. Thank you for your response! This is a strange one because ESET at the client's end indicates that a virus has been detected but when I send the exact same thing to our IT guy, who also uses ESET, the documents gets a clean slate. I'm baffled! When I scan the invoice outside of the Timeslips program (using our copier/scanner) and email it the client opens it with no problem. The problem is only when it's saved through Timeslips as a PDF. I'm going to do what you said and google the Outlook update. Thanks a bunch!!!

Actually, that's not the Outlook message then. It's either (a) a false alarm on the client, or (b) the client workstation is infected, and ESET is detecting the infection after it occurred in their environment.