What is XM_Fprot_Filter :

It's a Bash script for Xmail. It starts a F-Prot scan on each entering message. If the message is clean, it goes on his way to the recipient' mailbox.

If a virus is found :

  • XM_Fprot_Filter sends a message to the admin of the system.
  • It keeps a copy of the message (option) in /var/MailRoot/filters/XM_Fprot_Filter/InfectedMessages/.
  • It sends a message to the recipient to inform him he has been protected. The message contains the subject, the sender's address, the name of the infected attachment and the name of the virus. You can add any information you want to this message, just editing a text file.
  • It adds a line to its log file.
  • It stops the infected message delivery.
 
Install : UnGzip/Untar the downloaded file in /var/MailRoot/filters/
This will create a directory structure containing the necessary files.
 
Edit /var/MailRoot/filters/XM_Fprot_Filter/XM_Fprot_Filter.sh and change settings according to your F-Prot installation and your preferences as documented.
 
Edit and modifiy /var/MailRoot/filters/XM_Fprot_Filter/MessageToRecipient.txt.en
 

Create this file : /var/MailRoot/filters/XM_Fprot_Filter.tab
Put this on one line inside this file
/var/MailRoot/filters/XM_Fprot_Filter/XM_Fprot_Filter.sh<tab>@@FILE<tab>@@FROM<tab> @@RCPT<new line>

<tab> must be real tab
<new line> must be real new line

 

Add this line to /var/MailRoot/filters.in.tab

"*"<tab>"*"<tab>"0.0.0.0/0"<tab>"0.0.0.0/0"<tab>"XM_Fprot_Filter.tab"<new line>

<tab> must be real tab
<new line> must be real new line

 
Test your new settings :
Create a file containing exactly this line :
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
 
Send a message with the above file attached. If the system admin and the recipient of the message you sent receive a notification of infected message, you're done. If the recipient receives your message with the attachement, there is a problem either with F-prot, or with your XM_Fprot_Filter install...
 
Download : XM_Fprot_Filter.tar.gz v1.1 (14 july 2003)
 
Contact : scripts NOSPAM @libre-essai.com
Take off " NOSPAM " before writing to this address.