Virus Scan Filter Scripting

(Added in V6.17)

The VIRUSSCAN.LUA script has a single function FilterResult

This function is called for every virus that a VPOP3-integrated (eg VPOP3 AV or Sophos SAV Interface) detects. The function has the opportunity to 'filter' the virus detection so that VPOP3 will act as if the virus was not detected.

Obviously this has some security implications so should be used with care! A valid use may be if there are false positives that you need to ignore.

VPOP3 calls:

FilterResult(virus_name, attachment_name, archive_name, filter_variables)

The function returns a boolean value to indicate whether the virus detection should be skipped (true) or used (false).

• virus_name is the name assigned by the virus scanner
• attachment_name is the name of the attachment where the virus was detected
• archive_name is the name of the archive file (eg ZIP file), if any, where the attachment was located
• filter_variables is the list of attachment filter variables at this point in time. Standard variables are authsender, senderaddr, messagetype and subject. These can be used for skipping detected viruses from certain senders or with certain subjects.

Example:

function FilterResult(virus, attach, archive, vars)

if (vars["senderaddr"] == "test@pscs.co.uk" and virus == "Eicar-Test-Signature") then
 return true;
end

return false
end