"Virus scanners detect the first bytes of a file and, when this contains MZ (amongst others, MZ means executable), will block the attachment ... regardless of the extension."
Which is why many malware payloads are .zips - and because zips are now widely scanned they've recently resorted to ARJ archives (presumably they'll move to other ancient compression formats later)
Biting the hand that feeds IT
