avast does not add, change or do anything with attached files. It only scans it, and if the file has a password, avast won't even be able to scan it (avast does not use brute force to decrypt files to be scanned).
Are you sure this file is not infected?
Can't you ask the password to your client?