In my case I run a shell script that uses ripmime and then takes the parts and scans them. My detection rate is about 2-3 times higher using this method instead. I have tired different mime extracting proggies (about 4 or 5 all I could find at the time) and ripmime has by far the best mime support of any of them. Some of them were actually worse than the one built into clamav.
Did you happen to compare amavisd-new with ripmime? One of the nice things about amavisd-new is that it handles unpacking the message *and* runs fast.
- Sam Nilsson
