better demime handling?

"Fajar A. Nugraha" <[email protected]> Mon, 01 Nov 2004 12:43:01 +0700
Newsgroups gmane.mail.exim.exiscan.user
Message-ID <[email protected]>
Hi,

I'm using exiscan-acl-4.14-24 (It's not the latest version, I know).
Changelog http://duncanthrax.net/exiscan-acl/CHANGELOG shows no change 
in demime handling from 24-28.

I have been using exiscan's demime to unpack mail attachments and have 
clamav scan it.
Some MyDoom.M viruses were correctly identified from the unpacked 
attachments.

Others, however, cause exiscan to create broken attachment (broken .zip, 
to be exact),
which cannot be unpacked with unzip, and clamav couldn't detect anything 
on it.
If I run clamscan (with its own mail scanning engine enabled) on the 
original mail
(not the attachment), it can recognize the .zip attachment, can 
recognize the file in it (.scr),
and can find the virus MyDoom.M

So, obviously, clamav's engine (it's not using demime, btw) can unpack 
this particular mail correctly
but exiscan cannot (it only creates broken attachment).

Is there a plan to improve exiscan's demime unpacker?
I have the mail sample if anyone's interested.

Regards,

Fajar