Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Jahn on August 16, 2009, 09:35:24 PM

Title: Mail Scanner Alerts on clean exe files
Post by: Jahn on August 16, 2009, 09:35:24 PM

I sent myself some exe's from my beach house to be retrieved from a home system. I know these files are clean, and confirmed it at VirusTotal (http://www.virustotal.com/analisis/7b1493c112ac1835732a644de171159a6a4aa2fd59cc693ce8bb65ea0ca4b88c-1250448599). It appears that the mail scanner is alerting solely due to suspicious file extension, as Ashquick does not alert when the files are scanned manually.

Is the purpose of the alert simply precautionary?

Title: Re: Mail Scanner Alerts on clean exe files
Post by: Lisandro on August 16, 2009, 10:02:37 PM

Sorry, could be stupid, but is avast which is warning?
Some email providers block suspicious extensions.
avast just scan, does not block. The heuristic of mail does not filter by extension, but scans.

Title: Re: Mail Scanner Alerts on clean exe files
Post by: DavidR on August 16, 2009, 10:58:16 PM

avast doesn't alert based on a file type, if it considers something suspicious it says what it found suspicious.

So as Tech asks what is the 'full' alert message.

I doubt that is is alerting on file type alone, there are various checks in the Internet Mail Heuristics checks depending on a) the sensitivity you have it set to and b) if you have made any changes to the Heuristic settings (Customize) ?

Title: Re: Mail Scanner Alerts on clean exe files
Post by: Jahn on August 16, 2009, 11:46:04 PM

Hello again, Tech and DavidR. The alert I got indicates the file extension is suspicious. Thanks for your replies.

(http://i45.photobucket.com/albums/f66/jahnjahn/avast.png)

Edit: Heuristics is at default "Medium" setting.

Title: Re: Mail Scanner Alerts on clean exe files
Post by: DavidR on August 17, 2009, 12:35:36 AM

That's weird as my settings are much higher than that and I have never had that trigger.

I have just tested it and now I get the same alert, you will need to Set the Heuristics to Custom first and then click the Customize button, here uncheck the 'Attachment check (according to name)' try that first and see if that is enough.

Title: Re: Mail Scanner Alerts on clean exe files
Post by: Jahn on August 17, 2009, 01:27:40 AM

Yes, altering the heuristics setting stops the alert, thanks for that. Could this be a new setting or detection? (Re: This Thread (http://forum.avast.com/index.php?topic=47669.0))

Title: Re: Mail Scanner Alerts on clean exe files
Post by: DavidR on August 17, 2009, 01:35:11 AM

You're welcome.

I can't speculate on what it might be as we have no information. In the same way we asked you for more info and once we got it then we can test; so once we get the information we asked for then we will have a better idea.