Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: justnet on July 08, 2004, 10:03:56 AM

Title: Vlk, I cannot send the infected mail (Eicar.test)???
Post by: justnet on July 08, 2004, 10:03:56 AM
Vlk, not to be angry with me  :)  
I wanted to send a presumed virus (IRC Trojan) to you for examination  but I have discovered another problem of avast  (4.1.418, VPS428-0).
I have tried with two PC, Win200prof SP4 and WinXP prof SP1 end eicar.com test file.
The mail that contains a virus as attached cannot be sent.  
I have tried all the options of Internet Mail provider.  
Particularly, if I disabled SMTP/ Scan outbound mail, the letter with attached virus doesn't go out of the PC.  ???
Even if I close completely all the providers (Stop On-Access Protection and Exit), the mail with enclosure the virus (Eicar.com) cannot be sent.  
Vlk, can you verify this? Thanks.  
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: Stephan123 on July 08, 2004, 11:28:12 AM
I think that your ISP scans on viruses
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: justnet on July 08, 2004, 11:36:57 AM
Unfortunately no, I have tried with two PC connected to two different ISPs.  
(through the same ISPs they arrive to me so many viruses) :-\
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: Eddy on July 08, 2004, 11:45:12 AM
Some more information could be usefull, like what is the exact error you are getting, what do you use to send mail and things like that. Just saying "I can not send" isn't much to go on.
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: justnet on July 08, 2004, 11:48:28 AM
OE6 as client and any signalled error  ???
Message departs, from OE it results expeditious but on the other side it doesn't arrive anything.  ???
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: Stephan123 on July 08, 2004, 11:55:07 AM
maybe have that person on his ISP Antivirus and maybe doesn't send the isp any message of a virus
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: justnet on July 08, 2004, 12:04:33 PM
maybe have that person on his ISP Antivirus and maybe doesn't send the isp any message of a virus

To try I send the massages to myself.  
From the other PC, with the same ISP, that doesn't use Avast I can send test eicar.com without problems.
Proposal:  
To facilitate the discourse you can try to send an eicar.com to yourselves?  
Do you use Avast on Win2000 or WinXP?  
We see if from you it works.
Thanks
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: Eddy on July 08, 2004, 12:16:02 PM
"Message departs, from OE it results expeditious but on the other side it doesn't arrive anything."

So the mail is send but not received, right? If so, do you get it back with a mail notification?
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: justnet on July 08, 2004, 12:25:30 PM
"Message departs, from OE it results expeditious but on the other side it doesn't arrive anything."
So the mail is send but not received, right?
Right.
Quote
If so, do you get it back with a mail notification?
Not.
I think that the mail is delivered to the address 127.0.0.1 (control Avast) but from it doesn't depart them?
P.S. You excuse for my English. :)
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: Eddy on July 08, 2004, 12:35:41 PM
Looks like somehow the mail gets lost along the way. Try this:

- Disable Avast
- set the smtp server to the one your isp provided.
- try to send the mail

See if it works then. If not it may tell us something more about what is going on/where it goes wrong.
If you get an error, write it down and let us know.
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: justnet on July 08, 2004, 01:08:43 PM
I have tried again and now it works.  
What have I changed ?
Instead of sending file "eicar.com" I have sent "eicar_com.zip".  
This means that my ISP eliminates the messages with "eicar.com" and no those with same compressed file. Because?  ??? ???
Tonight I will try with other PC (win XP) and I make you know.  
PS. Now I send a presumed virus to Avast team for examination.
Regard, to the next one. :)
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: Lisandro on July 08, 2004, 01:44:23 PM
This means that my ISP eliminates the messages with "eicar.com" and no those with same compressed file. Because?  ??? ???

Well, could be that the ISP 'antivirus' detects only the .com and do not scan archives  ::)
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: DavidR on July 09, 2004, 04:11:23 PM

This means that my ISP eliminates the messages with "eicar.com" and no those with same compressed file. Because?  ??? ???

Because they use dumb anti-virus tools and block file types, like .com, .exe, .vbs, .pif, etc. regardless of the fact that the file is legit or not infected.

I had a similar problem with my smtp mail provider, they refused to send an email with an attachment with an .exe file type. I sent a windows update patch (which is a self-extracting [.exe] file) to a friend with a problem. XP Pro wouldn't let me zip the .exe file.

At lease they had the common sence to at least tell me they had blocked it.

I got around the problem by moving the .exe file to a temp folder and zipping that and low and behold no problem with the zip attachment, so dumb antivirus policy.

David
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: justnet on July 09, 2004, 04:30:21 PM
Thanks for details explanation.  
To me has happened for the first time and I have been amazed.  
On three ISPs that I use two they stop me the files .com.
Justnet
Title: Re:Vlk, I cannot send the infected mail (Eicar.test)???
Post by: bob3160 on July 09, 2004, 06:12:30 PM
justnet
Remember, they are only trying to prevent the spread of viruses. Please don't get to mad at your ISP.
There's always more than one way to skin a cat.... :)