Hi, this is part of a virus email :
--------------439767554304687794273679 Content-Type: application/msword; name="ARY7411 - 08.11.2017.doc" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="ARY7411 - 08.11.2017.doc" UEsDBBQABgAIAAAAIQBw5s8ffAEAAOYFAAATAAgCW0NvbnRlbnRfVHlwZXNdLnhtbCCiBAIo oAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ..... Its the only part, where a filename is given. But "$mime_filename" stays empty, so the filename can't get detected inside exims filter acl_check_mime: # File extension filtering. warn log_message = processing file "$mime_filename" for "To: $header_to -> From: $header_from / R=$reply_address" logs "processing file "" for "To: etc. etc.." Even when i "correct" the mime-header lines to a single-line each, i end up with "" as $mine_filename" . Any Ideas how to fix this ? exim-4.87-5.fc25.x86_64 -- send by my Thunderbird -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/