home > The Bat! (english) > The Bat! and F-PROT
With the free dos version of the virus scanner F-PROT you can scan mail attachments automatically. According to www.av-test.org (a project of a German university, thus said to be independent), F-PROT is the best free scanner. There is also a Windows version which is more comfortable and offers an on access scanner (which scans all files on your harddisk when saved and/or opened). The DOS version is just an on demand scanner, so it has to be launched whenever you want to check for viruses* - but with TB! you can do this automatically on all downloaded attachments. Note: A virus scanner does not mean total security on your machine. There are new viruses which are spread so fast that even up to date virus software is not able to recognize them. So never forget to watch all downloaded files with attention. Note that there are problems with the free DOS version of F-PROT and Windows NT 4.0/2000/2003/XP. For details, check the corresponding support page. To be sure that your files are properly scanned, DO NOT USE F-PROT FOR DOS with these operating systems.
F-PROT is free and can be downloaded here. It's a ZIP file without installation routine - just copy it in a new directory (and maybe check the signatures with PGP).
Create a new filter in TB! I recommend that you put it somewhere near the top so that it always triggers and another filter has no priority. Filter criteria is '@' somewhere in the kludges so that every mail matches.
Then activate "Message has attachments" in the advanced tab - we will just check mails which actually have attachments, not every mail coming in.
Then we need two actions: One which extracts the attachment to a temporary directory and one which launches F-PROT (which only works from a batch file, not directly called from TB!):
viruscan.bat looks like this on my machine (Note: you have to adjust the paths of the f-prot directory and the windows directory):
c:\programme\f-prot\f-prot c:\windows\temp\av /archive /beep /dumb /noboot
/nomem /freeze /list
del c:\windows\temp\av\*.* /q
You can adjust the F-PROT's parameters to your needs. See the documentation
of F-PROT for the possibilities you have. /archive searches within
archives (like ZIP files), /beep makes a sound when a virus is
found, /dumb searches in every file regardless of its extension, /noboot
doesn't check the boot records (which of course takes some time and is not
recommended when starting F-PROT from TB!), /nomem doesn't check
the memory (same note as /noboot), /freeze freezes the
DOS box where F-PROT is executed - only if a virus is found. Together with
"Wait for completion" in the filter, TB! freezes until the DOS box is
terminated - I have that setting to be sure not to miss the warning. /list
lists the results of the check.
The parameter /q deletes (under Windows 2000) all files in the
directory without confirmation. So be sure you have a temp directory just for
that single purpose. If you have Windows 98, the line should be
Echo y | del c:\windows\temp\av\*.*
Where
'y' is the character you have to have to press for conformation
('yes' on English language systems, 'ja' on German systems...). Note: If F-PROT
finds a virus, that batch file process has to be terminated (due to the freeze
mechanism). The del command won't work then, so you have to delete the file
manually
As the viruscan filter is the first filter, you have to activate "Continue processing with other filters" on the Options tab.
All filters you have set up before remain working.
I recommend that you test your setup to be sure that it works. There is a virus test file for that purpose which doesn't do any harm, but is recognized by every virus scanner: Create a new file with a text editor with the following text:
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
Save
it as eicar.com (note that it's not eicar.com.txt! It should look
like a DOS program in Windows explorer) and send it to yourself.
* You can also kind of "automate" this by creating a batch file like "$PATH\f-prot %1" and add this to your send to menu -> check a file via right click... and welcome to the beautiful and powerful world of batch files.
Contact/Imprint, PGP keys: DSS / RSA