virus in email - found in temp first

[hegedusa]

Avast doesn't appear to be behaving normally on my machine - I'm sure it's changed.

I've set the properties of the "outlook/exchange" task in the resident scanner to always just silently delete any email with a virus. This used to work. Now I've noticed it's behaving differently.

When an email comes in with a virus (both real and eicar test viruses), the following happens:

1. Avast detects a virus in local settings\temp folder
 (usually something like AV0519D.TMP)
2. I click "delete" (most people would click delete when a virus is found)

3. The virus is deleted (from temp), but the attachment stays in the email

So the email isn't deleted and the attachment stays with the email, which is certainly not what I want to happen. I'm fairly safe, because Avast will stop access to the email attachment if I go to the email again, and even if I double click on the email, outlook blocks access to executables.

I found that if I click "OK" instead of "delete" in step 2 above, Avast does then silently delete the email as I would expect.

I have also found that if I get sent a virus in a zip file, this is correctly handled by avast and the entire email is silently deleted as I expect. However, if I tell the standard shield to check zip files, the virus is found in the temp folder first. If I click "OK" instead of "delete", the email is NOT deleted, and stays there as an attachment, which is odd, because if the standard shield does not check zip files, avast does correctly silently delete the entire email.

Does anyone know why the behaviour is like this? Is it something that outlook express is doing?


I'm using Avast Pro and windows XP PRO SP2, and outlook 2003

Thanks

Anthony Hegedus

[lee16]

Hi hegedusa,

Avast on silent mode should put the infected mails in the virus chest, not delete them, however it shouldn't be leaving them in your mail.

So if you go to avast on access panel/scanner > Outlook/Exchange >customize > Inbound Mail, what happens in you set it to 'discard it unconditionally'.

Also just to make sure, you are using Outlook and not Outlook Express right?

--lee

[hegedusa]

Hi

It is already set to discard unconditionally. And yes, I am using Outlook, not outlook express.

It's almost like the standard shield is getting there first, or as if outlook is actually opening the attachment automatically, causing the standard shield to pick up the attachment.

I am running microsoft antispyware, maybe it's doing something stupid with attachments. I'll turn it off and check what's happening.

Thanks
Anthony

[Lisandro]

Maybe it's better continue just here: http://forum.avast.com/index.php?topic=11817.0;topicseen