E mail from Diskeeper always gets deleted!

[gate1975mlm]

Multiple Content-Type header - HIGH DANGER!


Sender:  "Diskeeper Corporation" <Salesinfo@diskeeper.com>
Recipient:  me
Subject:  Free utility finds performance bottlenecks on your systems

What do I need to do so I can always get this e mail. There is no virus from Diskeeper.

[DavidR]

1. avast doesn't delete anything without user intervention, either you choose to delete it when the warning is displayed or you have the settings set to move to the chest or delete automatically (depending on the version of avast you have).

2. Are you sure this is an avast warning, I don't recognise the HIGH DANGER bit at all.

3. It looks like some form of Heuristic warning and if this were avast, it would warn of a suspicious email.

4. It is not impossible to forge a from address (not even difficult), so never take it at face value.

What version of avast are you using? (home/Pro and version number)
What is your OS?
What is your email program?
What is your firewall - does it filter email?
Do you have any other security software, if so what?

[alanrf]

David,

this evening while looking into a problem reported by another user I fired up Outlook Express. 

OE is not my usual mail client and it has been quite a while since I last activated it.  It proceeded to download all the mail sitting in my ISP POP3 account. 

I am a user of the Diskeeper product of Diskeeper Corp. and I get their regular emails.

Sitting in my mailbox still were two messages from them dated mid to late October. 

Avast proceeded to light up my screen with exactly the "High Danger" warning reported by the initiator of this thread.  I can attest to the fact then when these messages originally arrived back in October (and we were using 691) there was no such alert from avast for precisely the same messages.

I cannot say whether the change has been effected by 731 or by VPS updates, but a change there certainly has been.

I think that the only difference between me and the initiator is that I trust Diskeeper and selected the "continue" option at the warning - so I got to keep the message, whereas I suspect that our friend did not.

[Vlk]

Could you please save the whole email as EML file (from OE), then ZIP it and send it to my email address for analysis?

Thanks

[sedina]

Hi, Multiple Content-Type header - HIGH DANGER!!! is new warning in avast! It means that there are multiple content type headers in email which can cause problems in security (one email client will use first content-type header, but other email client can use second content-type header). Could you please send  me ZIP file (see vlk's messages) to sedina@asw.cz? I will check it. You can disable this manner - simply uncheck "Attachment check (according to name)" in heuristic settings. thanks!

[Vlk]

Got the files, thanks. Oddly enough, the messages really DO have multiple content-type headers. I wonder if this is a problem with their mail server...

[alanrf]

I didn't notice that before, I guess it is unusual - but it is not a "rule breaker" is it?

[DavidR]

Thanks Alan, I hadn't seen that specific error before, so I wasn't sure it was from avast.