How does ClamAV decide to unpack an attachment? In particular this is in reference to the recent Locky attachments that are zips but have the attachment extension “dip”