Author Topic: Detect .mht like a virus  (Read 6561 times)

0 Members and 1 Guest are viewing this topic.

rrd_1984

  • Guest
Detect .mht like a virus
« on: June 29, 2012, 04:25:18 PM »

Before I want to say sorry if my english is not good. I've a little problem, all days I receive  a email with attach an archive, this archive is in format .mht

The Avast show this message

"[avast! heurística - ADVERTENCIA]   "----------" [avast! heuristic - WARNING]  "

The program delete the archive and me can't open the file.

Could someone help me, please?

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Detect .mht like a virus
« Reply #1 on: June 29, 2012, 05:09:34 PM »
Could someone help me, please?

What do you want to know..??
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: Detect .mht like a virus
« Reply #2 on: June 29, 2012, 05:40:09 PM »
The .mht format is an archived copy of a web page, it contains all of the images and scripts, etc, and can be dangerous when opened as these would be executed. It is also a bit strange when used in emails.

Do you know the source of this email and why they would attach an mht file (?), if either of these answers is no or don't know, then you shouldn't open this attachment anyway. Essentially avast is saying it is suspicious not infected as such.

If you can answer yes to both (and it is easy to fake the source, from address) and you accept the associated risk, you can modify the Mail Shield, Expert Settings, Mail Heuristics, Attachment check, but that would have an impact on all attachments.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

rrd_1984

  • Guest
Re: Detect .mht like a virus
« Reply #3 on: June 29, 2012, 05:50:22 PM »
Yes, I know the source of this email and the reason.

My version is 7.0.1451

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: Detect .mht like a virus
« Reply #4 on: June 29, 2012, 06:51:44 PM »
Then it is your choice/risk to disable that check and have them send the email again as the original will have had the attachment removed (I believe).
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

rrd_1984

  • Guest
Re: Detect .mht like a virus
« Reply #5 on: July 02, 2012, 08:00:46 PM »
I don't understand your request. What have to do for put this sender on a "clean" list. I know that the archive is safe.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: Detect .mht like a virus
« Reply #6 on: July 02, 2012, 09:05:21 PM »
I have not told you how to put the sender in a white list as there is no white listing in the avast free mail shield.

The only white listing is in the avast Pro/AIS versions and that is in the anti-spam module, which I don't believe would effect the standard mail shield alerts.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

rrd_1984

  • Guest
Re: Detect .mht like a virus
« Reply #7 on: July 03, 2012, 07:25:09 PM »
Ok thank so much for your answer.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: Detect .mht like a virus
« Reply #8 on: July 03, 2012, 07:36:53 PM »
The only option is what I said in Reply #2 last paragraph, but that effects all emails with attachments not just .mht ones, this could mean a little more risk.

But you should never open an attachment directly from an email, save to the hard disk and scan it before ever opening it reduces the risk slightly. But as I said a .mht file "is an archived copy of a web page, it contains all of the images and scripts, etc, and can be dangerous when opened as these would be executed.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline sandhill

  • Jr. Member
  • **
  • Posts: 31
Re: Detect .mht like a virus
« Reply #9 on: June 13, 2013, 12:44:05 PM »
If Avast Premier has blocked an incoming email mht attachment is it possible to retrieve it without asking for it to be re-sent?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: Detect .mht like a virus
« Reply #10 on: June 13, 2013, 04:45:53 PM »
It most cases it isn't possible to retrieve it (if you mean from the chest) as it may not be able to insert it into the email file folder (depending on the email program in use ?).

So essentially you will have to take the actions already outlined in this topic and have the email resent. The other difference being that in the Premier version you may be able to add the email address to a white list, but that may only be in the anti-spam module rather than the mail shield (I don't use the Premier version) and as such may not stop the detection.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline sandhill

  • Jr. Member
  • **
  • Posts: 31
Re: Detect .mht like a virus
« Reply #11 on: June 14, 2013, 01:19:32 AM »
Thanks the Avast email [avast! heuristic - WARNING] does not give the time sent, only the time processed locally, so it makes it harder to ask for a re-send.

The email does not seem to be in the virus chest with the viruses.

I had done a submission on line and wanted to email the page of my submission to a third party. I attached the mht page to a Thunderbird message and when I tried to send there was some sort of warning about difficulty sending but eventually the message was in my sent box. However it had not been received. I found I was later able to send it by stopping Premier mail shield. It got through AVG at the receiving end. But a copy I sent back to myself could not get through back to me.

I think more warnings are in order.

What should I have known?
« Last Edit: June 14, 2013, 01:41:35 AM by sandhill »