Hi, I've run into this lately, too. It appears that amavis uses the local installation of "file"'s magic configuration for identifying file-content.
With an old "file magic" it says "Zip archive" for newer word docs, and in turn probably extracts the contents to check each file individually, and eventually stumbles over trash/0000.dat, which triggers as DOS-executable. With a new / updated "file magic" it correctly reports word-doc, and probably isn't touched any further. -- Rado, enjoy
