Email with infected .zip attachment

[knolle]

I am using the latest Avast home version. Internet-mail provider is running with best options.
Now I got a mail with an infected .zip attachment. Avast mail scanner found no virus - direct scan found an evil worm...
Is this a correct behaviour?
Does the mailscanner not scan into archives? Is this a "pro" feature?

[DavidR]

It does scan attachments and if avast standard shield can detect it so should the mail scanner.

What email program are you using?
Is your email being scanned?
Was this pop3 email or web based email (yahoo/hotmail, etc.?
What are your mail scanner settings?

Zip file attachments represent a low level risk, first you have to open it and second you have to activate the payload (infected file inside), so if missed by the mail scanner, save the attachment to disk first don't open it. That action should ensure standard shield scans it.

[knolle]

ok, I'm using
- Thunderbird 1.02
- email is scanned (writes "clean" into mail)
- pop3
- mail scanner setting is set to best protection

after all the question is simple:
Does Avast scan email attachments completely or not?

[DavidR]

after all my answer was simple
"It does scan attachments and if avast standard shield can detect it so should the mail scanner."

Why it didn't in this case is a mystery.

Do you perhaps have Silent Mode with general answer equals Yes (rather than No) in the settings?


There can be a problem with Thunderbird and avast when trying to remove an infected email from the inbox database as it can't simply extract the email (like it can in OE), so care should be taken otherwise you could lose your inbox (as per the Thunderbird on-line FAQs). The safest way is to manually identify the email and delete it in TB and then clear/empty the deleted emails folder. This obviously doesn't explain why it wasn't detected in the first place, just trying to ensure you don't lose your inbox.

[vojtech]

Please forward me the mail (the whole source i.e. menu Message->Forward as->Attachment) to peterka@avast.com, thank you.