I've set up a small qmail server (150 users) with delivery to
/var/spool/mail via procmail, then I've added an antivirus scanner Mks_Vir
(popular in Poland) and attachment renamer (renattach) into message pipe. It
works great, it's very fast and simple, removes or deactivates all fauna
that comes to vulnerable clients (mostly MS Outlook).
I've got some tasks to do with qmail.

I have to copy ALL mail WITH attachments to special mailbox
(/var/spool/mail/archive) and do this only IF the message has come from
preset IP address.
I have to add an responder that gets From address from message that HAS
attachments and composes warning message from file to sender (to address got
from From: field). This also should be done if message comes from preset IP
address.
Note that only messages WITH attachments have to trigger those actions.

How to do this ?

Maybe procmail ?
Thanx in advance.

Marcin (xpascal@_REMOVE_SPAM_FILTER_poczta.onet.pl)