To me, it sounds like avast! is configured to keep the infected attachment in the message…