Recently various people on my address book, together with others who weren't even in my address book, but were on the address list of a letter that had been sent to me, received an email ostensibly from me with a virus which I gather included a virus.
Moral, as has been said above, don't trust an attachment even from someone you know unless you are sure it's from them. And even then you aren't safe.
I try never to send attachments, but instead to put whatever I want to send up in my webspace, and send a link to it in the email. So far as I know that is still safe.
And my security systems are now a lot better than they were.