On 7 May 2020 at 23:57, Bruce  Johnson wrote:

> That´s absolutely a false positive; the TML never allowed
> attachments, and the zip file is nothing but compressed plain text
> copies of tml digests. 

It thinks it's found a javascript exploit.

I vaguely recall running into that on my systems many years back.
It's reacting to text in the message *body* that matches the
signature the AV program is using.

It might be something as stupid as "formatting drive C:"

--
Leonard Erickson (aka shadow)
shadow at shadowgard dot com