alsyundawy/eradicate-zimbra-malware ? reverse-engineered prompt

Build me a Bash based incident response and cleanup tool for a Zimbra mail server that’s been compromised.

I want one main script that can quickly detect common malware, webshells, suspicious cron persistence, and strange processes, then quarantine or remove them safely, heal Zimbra permissions, and lock down the server so it doesn’t get reinfected. It should also save forensic evidence in an incident folder with clear logs and keep a basic whitelist so trusted files, users, and IPs are not touched. If it can stop and restart Zimbra services safely as part of the cleanup, even better.

Please make it work on common Linux server distros, include a maintenance script or cron helper, and add a simple way to run a quick cleanup or a full incident response pass. If you need to check current Zimbra command behavior or best practices, look up the latest docs online before finishing.