I misspoke. I do not look at the headers, I just look at sender and subject. Sorry.
About 75% of my incoming email is spam.
I get one or two infected attachments per day and all come from "Microsoft" or other fake addresses. But the senders are cunning and use many variations of sender and subject. POPFile deflects them all, but that is after they have been downloaded and Norton has detected the virus. I don't think I have ever received an infected attachment from a legitimate source.
Thanks for the suggestion about just using the "attachment" column in MailWasher.
SC