Exim configuration.  Not tested, "stolen" from DrWeb instructions entirely.

Add the following to Exim configuration file:

1) Filter settings. If filter is active already, add only few transport
parameters for filter (see below) and ignore the following section

--- cut ---
######################################################################
#          MESSAGE FILTER CONFIGURATION SETTINGS                     #
######################################################################
--- cut ---

add to existens or create new trusted by exim user and group:

--- cut ---
trusted_users = avclient
--- cut ---

modify or add new settings:

--- cut ---
message_filter = /var/spool/avp/avcheck
message_filter_pipe_transport = filter_pipe
message_filter_reply_transport = address_reply

--- cut ---
# Example:
# trusted_users = drweb
# trusted_groups = drweb
# message_filter = /usr/exim/system_filter.exim
# message_filter_pipe_transport = filter_pipe
# message_filter_reply_transport = address_reply

2) Then in the section

--- cut ---
######################################################################
#                      TRANSPORTS CONFIGURATION                      #
######################################################################
#                       ORDER DOES NOT MATTER                        #
#     Only one appropriate transport is called for each delivery.    #
######################################################################
--- cut ---

add the description of the correspondent transport:

--- cut ---
filter_pipe:
  driver = pipe
  user = avclient
  group = avgroup
  return_fail_output
--- cut ---

Then create filter file on the path described above as
(/path/to/system/filter/). Add a new filter there, if it already exists:

--- cut ---
# Exim filter # DONT DELETE THIS LINE
## Version: 0.10

#
# Only run any of this stuff on the first pass through the
# filter - this is an optimisation for messages that get
# queued and have several delivery attempts
#
# we express this in reverse so we can just bail out
# on inappropriate messages
#

if $received_protocol is "drweb-scanned"
then 
  # looks like a already scanned message
  finish
endif

if error_message and $header_from: contains "Mailer-Daemon@"
then
  # looks like a real error message - just ignore it
  finish
endif

if not first_delivery
then
  # not first delivery attempt
  finish
endif

# Dr.Web Filter
pipe "/var/spool/avp/avcheck MAIL_CMD="$EXIM_CMD -bm -i -oMr drweb-scanned -f"
{/PATH/TO}/drweb_exim.sh $sender_address $recipients"

finish
--- cut ---

{/PATH/TO} - should be changed into absolute path to drweb_exim.sh script

