OK in the messages source, and the only thing to view to see what the bounce was in the rendered message was message.scr. Some nice social engineering , really. Let's compress the file and rerun the scan: [usr-1@srv-1 ~]$ gzip message.scr [usr-1@srv-1 ~]$ ls mess* message.scr.gz [usr-1@srv-1 ~]$ ~/clamav/bin/clamscan m* mbox: OK