E-mail False Alarms

[RaLX]

Hi, I noticed that Avast4 constantly show false alarms on e-mail that I recieve from a distribution list.

I had to uncheck "HTML Structure Check" and "Subject Structure Check" because is one of these options that cause the false alarm. It Says something about "IFrame Tag" and show me the subject of the mail that is from Yahoogroups: "[nombre-grupo] Subject".

Check that detail and Keep up the good work!!  

[Vlk]

RaLX,

Hi, I noticed that Avast4 constantly show false alarms on e-mail that I recieve from a distribution list.

I had to uncheck "HTML Structure Check" and "Subject Structure Check" because is one of these options that cause the false alarm. It Says something about "IFrame Tag" and show me the subject of the mail that is from Yahoogroups: "[nombre-grupo] Subject".

Well, this is an issue we're already aware of, and it's quite tricky. The problem is that those mails really contain the <iframe> tag (most often for some kind of advertisement) and there is basically no general way how to distinguish this more or less 'safe' URL from a potentially malicious URL...

We're currently working on a solution that would let you specify an exception list for the URL present in the iframe, thus giving you the possibility to inhibit these warnings...

Vlk

[cyberjones98]

I'm also getting false alarms on emails from distribution lists.  It Says something about "IFrame Tag" on mail that is from Yahoogroups.

Any progress on a solution that would let you specify an exception list for the URL present in the iframe?

[DavidR]

They aren't false alarms as all they are alerting you to is a suspicious email not an infected email.

The iFrame tag is more commonly used in web pages to import data into the iFrame (and in emails usually for ads), it can also execute programs/code in these iFrames and as Vlk said there isn't an easy way to determine the intention of what is to be loaded into the iFrame.

So they are a very powerful tool that can be used for good or evil.

You also get a choice as to what to do upon receipt of these suspicious emails, if you haven't a clue who or where there from or they are unexpected, then deletion is the safe option. However if you know who it is from (and that information can be faked) then you can allow it. So if you are expecting these emails from distribution lists and they appear to be from that source let them through. You can add the URL of the destination of the remote iFrame (where it is getting the data from, see image), this is a little bit of a problem if the remote source is always changing, but often it will be the same.

[buttoni]

Gosh, I get bunches of emails from YahooGroups distribution lists daily.  Have had Avast installed for a month, but I have not gotten the aforementioned warnings to date.  I know my mail scanner provider is working, because my a-ball spins everytime I open an email. 

[DavidR]

That would depend on cyberjones98/your Internet Mail settings, especially the Heuristic settings and whether or not those emails had an iFrame in them. So it is a little more difficult to compare.