Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Drazick on November 18, 2004, 04:32:21 PM

Title: Why AvAST think Shareaza Sends mails? Is It the P2P Shield?
Post by: Drazick on November 18, 2004, 04:32:21 PM

Since I upgraded to the latest version (4.5.523) AVAST keeps showing the scaning (as if it scans for mail) every 5 min.
The icon won't response to a rightqleft click.
The yellow tip baloon shows IP addresses.
I guess it connects to the net for something... Update maybe?
What is it?
How can I stop it?

Pic attached. Look at the red circle.

Title: Re:Doing something over and over
Post by: Drazick on November 18, 2004, 06:59:04 PM

Here's the file...
No mail client, messeging nothing...
Only IE.

Title: Re:Doing something over and over
Post by: Vlk on November 18, 2004, 07:07:06 PM

It must be a local process sending or receiving email, really. Let's see which one it is, maybe it will be an interesting discovery.

First, turn on verbose logging for the Mail Scanner. To do this, add the following line to the [MailScanner] section of <avast>\data\avast4.ini file:

Log=20


Then restart the Internet Mail provider.

Next, wait for the icon to reappear (i.e. wait for the connection to be made). Finally, go to <avast>\data\log, open the file aswMaiSv.log, and find a line with something like

--POP command REDIRECT

followed by some numbers. The last number on the line is the PID (Process ID) of the process that's making the connection. Use the Processes tab of the Task Manager to find out which process corresponds to this PID (enable the PID column first by using the View -> Select Columns command).


Hope this helps,
Vlk

Title: Re:Doing something over and over
Post by: Drazick on November 18, 2004, 08:07:49 PM

Done it.
Found out it's mt P2P software - Shareaza.
How come? Shareaza doesn't use pop/smtp service in order to work...

Title: Re:Why AvAST think Shareaza Sends mails? Is It the P2P Shield?
Post by: RJARRRPCGP on November 19, 2004, 01:45:18 AM

Looks like Avast has a bug that when programs are using port 25, it  thinks that it's sending E-mails, even when it's not sending E-mails. That's the same type of problem ZoneAlarm has.

Title: Re:Why AvAST think Shareaza Sends mails? Is It the P2P Shield?
Post by: Eddy on November 19, 2004, 01:52:05 AM

port 25 is assigned for use with SMTP.

I would say applications that are trying to use this port for other things are the "bugged" ones since they do not comply to international standards.

Title: Re:Why AvAST think Shareaza Sends mails? Is It the P2P Shield?
Post by: Vlk on November 19, 2004, 09:14:13 AM

Well... I've read the FAQ and I must really say I'm surprised. Random port numbers, why not, but haven't these guys ever heard about system (<1024) versus regular ports?

In linux, and most other Unix'es as far as I know, only root can listen to ports < 1024.

Allowing ShareaZa to listen on those ports is IMO a very bad design... :(


Anyway, let's see what we can do.

Cheers
Vlk

Title: Re:Why AvAST think Shareaza Sends mails? Is It the P2P Shield?
Post by: peterfu on November 19, 2004, 02:51:37 PM

Quote from: Vlk on November 19, 2004, 09:14:13 AM

Allowing ShareaZa to listen on those ports is IMO a very bad design.

an in my opinion a very clear RFC violation  >:(

hmm, as many ISP's block port 25 for their users (except to access ISP mail server) ot might not be a good idea to use it

br
Peter