Author Topic: AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????  (Read 4176 times)

Offline Cognus

  • Newbie
  • *
  • Posts: 10
    • Personal Message (Offline)
AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????
« on: March 23, 2010, 12:09:11 PM »
Friends I have a serious debug issue going on where Outlook Express is unable to receive/display messages from perfectly safe, and frequently-needed, senders.  This just started after a recent update to AVAST 5 free edition, and though I have no evidence that AVAST has marked the senders somehow, I'm at the "bottom of the stack" in debug attempts, having whitelisted all the affected users at the ISP, found no error messages at the ISP, can see the incoming messages just fine at the ISP level, but the messages are getting bit-bucketed without ever landing in the inbox.dbx.

I read the helps & info on AVAST 5 and it clearly tells me that the antispam routine for email scanning will mark some messages, or senders, as "blacklist" and states that the user can manage the whitelist & blacklist.  However, in my version of the UI, I see no access whatsoever to the "antispam" section of the program, and certainly no visibility to such blacklist.

Can someone tell me about this?

Offline igor

  • avast! team
  • Serious Graphoman
  • *
  • Posts: 11335
  • Gender: Male
    • AVAST Software
    • Personal Message (Offline)
Re: AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????
« Reply #1 on: March 23, 2010, 12:11:51 PM »
The antispam filter is not present in the Free version of avast!... so I don't think it's connected to avast!.
Does it help if you stop the resident protection (or just the Mail Shield) temporarily?

Offline Cognus

  • Newbie
  • *
  • Posts: 10
    • Personal Message (Offline)
Re: AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????
« Reply #2 on: March 23, 2010, 01:09:13 PM »
Igor
are you CERTAIN that the routine is literally removed from the free version? I know it is common marketing practice to simply remove the UI portion of a package so that the function appears to be missing [incentive for the customer to move up a notch], when in fact it is present and working in default mode.

approaching this from another direction:  it is certainly true that AVAST 5 Free is scanning mail [assuming the feature has not been manually stopped].  So, what is it doing with any message that it sees that run afoul of its parameters????  And once it sees a "bad" message, does it necessarily flag each/every instance of the same to the attention of the User?  I know the AVAST team takes great care to minimize the interruption of the user so I'm wondering what is going on under the hood.

Stopping the realtime mail scanner has no effect on the things I'm watching and looking for.  This would seem to support the idea that something local to the client-machine has "marked" for extinction any message incoming from the certain senders - the incoming message arrives unmolested at the ISP, then the local mail client [OE6] logs-in and fetches the message, marking it "read" [I think... not really certain how that exchange works], then the message never appears anywhere in the OE6 database so far as I have been able to ascertain.  With the flag set to "leave copy on the server", the message is intact at the ISP's 'inbox'.

I keep trying to blame it on OE6 but there are no error messages whatsoever in OE6, and when you really examine the package, there is just not much to it that could conceivably SELECTIVELY and Automatically block just a few routine senders.  The "blacklist" function within OE6 is entirely manual, not automatic, and best I can tell it is void of any junk filtering.  At the ISP level, just for good measure, we have all these users whitelisted.   So I'm down to just a couple of items that have the ability to selectively, blindly, and automatically 'tag' an incoming message as 'bad' and disappear it to the bit-bucket.  AVAST is the best candidate.   Turning off the Windows Firewall [which has no mail screening function anyway] was neuter, and the router in use, though it has the common garden variety firewall, has no ability to screen mail fetches.

Offline DavidR

  • avast! Überevangelist
  • Certainly Bot
  • *****
  • Posts: 69233
  • Gender: Male
  • No support PMs thanks
    • Personal Message (Offline)
Re: AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????
« Reply #3 on: March 23, 2010, 01:36:04 PM »
It isn't present either in the UI or otherwise and it most certainly isn't running/working in default mode. I say this in all confidence being both and avast 5.0 free antivirus and OE6 user, it doesn't have any impact at all on my receipt of emails.

The help file caters for the use of all functions, including those not in the free version, so that is where the confusion arises. There is even help for the process virtualization (sandbox), firewall and Command line scanner all of which are part of the avast! Pro or Avast! Internet Security suite.

Why can't you receive the emails, e.g. what error messages are displayed ?
Core2Duo E8300/ 4GB Ram/ WinXP ProSP3/ avast! free 2014 9.0.2018/ Outpost Firewall Pro9.1/ Firefox 28.0, NoScript, RequestPolicy/ MailWasher Pro/ DropMyRights/ MalwareBytes AntiMalware Premium 2.0.1/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security

Offline Cognus

  • Newbie
  • *
  • Posts: 10
    • Personal Message (Offline)
Re: AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????
« Reply #4 on: March 23, 2010, 02:20:16 PM »
hi - thanks for helping.
There are no OE error messages of the 'flag' kind during Send/Receive function. I'm a novice at reading the logs, so I'm going to pull those [pop3 and IMAP] this a.m. when I run a few test mails through again - someone has given me a couple of tips on what to look for.

OE6 works correctly as best I can tell.  the only incoming messages that are nixed are from several frequent senders who do business together.  I see nothing odd in their messages at all, but then I'm no expert on headers etc.  One can look at the incoming messages via webmail on the ISP's mail server [by account, that is] and it all looks lovely.   But coming into OE6, or somewhere else in the local client machine, the incoming message from one of these certain few senders simply vanishes, or never actually made it to the client, and there's the rub.  I can do term searches in OE6 [planting oddball strings in test messages to make it easy], and they simply don't exist... not in any folders [these users are not very complex, so not many folders], not in Deleted.  I also installed WLM client on one of the affected units, but it was no diff.  I don't know what 'engine' components WLM has in common with OE6 under the hood.  Same issues persist.

But back to AVAST - I'm not ready to relent just yet.  AVAST Free DOES include a realtime mail scanner [though I'll take your word that it does not include even one line of the AntiSpam or Firewall applets].  When that mail scanner trips its threshold on a particular inbound message, what does it do?  What action is taken and what alerts are presented?

Offline DavidR

  • avast! Überevangelist
  • Certainly Bot
  • *****
  • Posts: 69233
  • Gender: Male
  • No support PMs thanks
    • Personal Message (Offline)
Re: AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????
« Reply #5 on: March 23, 2010, 02:52:59 PM »
The Mail Scanner should alert to any infection and not simply delete, whilst you can change the detection Actions, in the Mail Shield, Expert Settings, Actions and set the First action to Ask rather than Move to chest.

However, I doubt this would make any difference (other than give you first action on any detections) as I don't believe these are actually virus detections as they wouldn't be totally silent so you weren't aware something had happened. You could check the avast chest and see if there is anything there relating to emails, but I would be surprised if there was.
Core2Duo E8300/ 4GB Ram/ WinXP ProSP3/ avast! free 2014 9.0.2018/ Outpost Firewall Pro9.1/ Firefox 28.0, NoScript, RequestPolicy/ MailWasher Pro/ DropMyRights/ MalwareBytes AntiMalware Premium 2.0.1/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security

Offline Cognus

  • Newbie
  • *
  • Posts: 10
    • Personal Message (Offline)
Re: AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????
« Reply #6 on: March 23, 2010, 04:32:11 PM »
ok.
We did catch four previously-undetected corrupt or infected files on a full scan, but I need to look carefully at the log to see the nature of these.  I too would be surprised if they were mail-related.

Tell me this if you know:  if I uninstall AVAST 5 using the tool provided, do you think it has any chance of affecting this issue?

Offline DavidR

  • avast! Überevangelist
  • Certainly Bot
  • *****
  • Posts: 69233
  • Gender: Male
  • No support PMs thanks
    • Personal Message (Offline)
Re: AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????
« Reply #7 on: March 23, 2010, 05:06:42 PM »
Since I'm not convinced that the issue is related to avast, I can't say if it would.
Core2Duo E8300/ 4GB Ram/ WinXP ProSP3/ avast! free 2014 9.0.2018/ Outpost Firewall Pro9.1/ Firefox 28.0, NoScript, RequestPolicy/ MailWasher Pro/ DropMyRights/ MalwareBytes AntiMalware Premium 2.0.1/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security

Offline Cognus

  • Newbie
  • *
  • Posts: 10
    • Personal Message (Offline)
Re: AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????
« Reply #8 on: March 23, 2010, 07:55:24 PM »
David
could you read/evaluate the avast mail log for me?

Offline DavidR

  • avast! Überevangelist
  • Certainly Bot
  • *****
  • Posts: 69233
  • Gender: Male
  • No support PMs thanks
    • Personal Message (Offline)
Re: AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????
« Reply #9 on: March 23, 2010, 08:50:17 PM »
I'm not very familiar with it.
Core2Duo E8300/ 4GB Ram/ WinXP ProSP3/ avast! free 2014 9.0.2018/ Outpost Firewall Pro9.1/ Firefox 28.0, NoScript, RequestPolicy/ MailWasher Pro/ DropMyRights/ MalwareBytes AntiMalware Premium 2.0.1/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security

Offline olddog

  • Poster
  • *
  • Posts: 567
  • Gender: Male
    • Personal Message (Offline)
Re: AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????
« Reply #10 on: March 23, 2010, 09:43:55 PM »

Tell me this if you know:  if I uninstall AVAST 5 using the tool provided, do you think it has any chance of affecting this issue?

Rather than uninstalling the whole AV, you could try just temporarily uninstalling the mail shield module. In XP Control Panel->Add or Remove Programs-> Avast! Free Antivirus->Change/Remove then highlight change (should default to this), click on Next then untick the mail shield box and click on Next. Reverse this procedure to reinstall the shield.

I too use Outlook Express and have not experienced any problems with Avast blocking or disappearing any mail.
3.4Ghz Intel i7, 8Gb Ram, GeForce GTX560, Win 7 Pro 64 bit, Dual 1920x1080 monitors, Avast 2014, Firefox 26, Malwarebytes Pro, Paragon 14

Offline Cognus

  • Newbie
  • *
  • Posts: 10
    • Personal Message (Offline)
Re: AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????
« Reply #11 on: March 24, 2010, 12:54:36 PM »
thanks, oldog and david -
do either of you know why, on two machines that are pretty much identical, on one I see a frequently updated mail.log [Alwil-mail] and in the other I find no such file.
I put AVAST on there myself, and did not use any diff steps on one versus other....

That aside, I suspect that one machine in the bunch is the root of the evil, but how it manages to trip the other clients into blocking/deleting/disappearing messages from one another has me completely beaten. I feel like an idiot...  :(

Offline DavidR

  • avast! Überevangelist
  • Certainly Bot
  • *****
  • Posts: 69233
  • Gender: Male
  • No support PMs thanks
    • Personal Message (Offline)
Re: AVAST 5 Free: CANNOT FIND WHITELIST AND BLACKLIST ????
« Reply #12 on: March 24, 2010, 01:30:53 PM »
Where are you seeing this mail.log (file location) ?

I have created my own custom file and location, E:\Data\avast_report_files\mail_shield.log but there is effectively nothing in it other than when the Mail Shield was started each day, but I don't get much email as I filter out the junk at server level (not an avast filter).

The generation of a report file is disabled by default so all I can think is that you have set this option on one but not the other system, even then it rather depends on the answer to the question I asked above.
Core2Duo E8300/ 4GB Ram/ WinXP ProSP3/ avast! free 2014 9.0.2018/ Outpost Firewall Pro9.1/ Firefox 28.0, NoScript, RequestPolicy/ MailWasher Pro/ DropMyRights/ MalwareBytes AntiMalware Premium 2.0.1/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security

 

Google Chrome

AVAST recommends using the FREE Google Chrome™ browser.

Download Google Chrome Now