[AMaViS-user] Customize AV scanner response actions

[Anders N. <an...@no...>]

Hiya!

I run Amavis-new with 2 AV scanners, NOD32 and Kaspersky 5.0, this works
just great... But I see a need to somehow customize how Amavis handles the
scanner's responses.

This is primarily related to Kaspersky which can send responses that I see
should be handled differently than just "Virus found" or "Clean", something
in between...

Kaspersky sends a warning response when it can't scan a file, for example a
password protected or encrypted file, like the psw protected zip files that
contains viruses.  But, the problem is that some of my clients do send
"legitimate" files encrypted or password protected.

On these files Kaspersky sends messages like "Password-protected archives
were detected" and "Suspicious files were detected."

Of course with exit numeric exit codes.  So, what I want to do with these
e-mails, is to distribute them to the recipient, perhaps as an attach, and
modify the e-mail header to contain something like "***WARNING*** or
similar, and maybe an explanatory body text and the original e-mail
attached.

Is this possible with today's version (I have amavisd-new-20030616-p5) or is
it planned for a future version?  Can today's version be easily modified?

Regards,
Anders Norrbring
Norrbring Consulting