Incoming clean message not on all emails

[alanrf]

xpjohn,

thanks for the clarification. 

On the outbound messages - you cannot see the outbound scanned text in the messages in the sent folder because the scanning of the message and the adding of the outbound text only happens after the mail has been sent by Thunderbird.  So the outbound scanned text is only seen by the recipient of the message. 

On the inbound side - as =YLAP= says there are circumstances where the message format appears to confuse avast and prevent the insertion of the "cleaned" status information.  A short time ago I researched a case where a third party program involved in mail delivery added some of those X- headers that upset avast and stopped all insertion of scanned information.  In that case I managed to get the program modified so that the avast messages worked again.

I am wondering if your ISP is adding something to the message such that in a simple plain text message, avast misses whatever it is in the message that triggers avast to add the "scanned text". 

Here's the source of a small message I just sent to my POP3 account from my Hotmail account.  You may want to compare with yours and see if there any major differences. 

From - Tue Nov 15 13:28:33 2005
X-Account-Key: account1
X-UIDL: 20051115212720r2200dckvue0004rt
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Received: from hotmail.com (bay103-f6.bay103.hotmail.com[65.54.174.**](misconfigured sender))
          by rwcrmxc22.comcast.net (rwcrmxc22) with ESMTP
          id <20051115212720r220043vpue>; Tue, 15 Nov 2005 21:27:20 +0000
X-Originating-IP: [65.54.174.**]
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
         Tue, 15 Nov 2005 13:27:20 -0800
Message-ID: <BAY103-F66840C096B36F7F2228A3EA5D0@phx.gbl>
Received: from 65.54.174.200 by by103fd.bay103.hotmail.msn.com with HTTP;
        Tue, 15 Nov 2005 21:27:20 GMT
X-Originating-IP: [67.166.143.**]
X-Originating-Email: [alanxxx@hotmail.com]
X-Sender: alanxxx@hotmail.com
From: "Alan *******" <alanxxx@hotmail.com>
To: alanxxx@comcast.net
Bcc:
Subject: A small text message.
Date: Tue, 15 Nov 2005 13:27:20 -0800
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
X-OriginalArrivalTime: 15 Nov 2005 21:27:20.0299 (UTC) FILETIME=[5C4D4BB0:01C5EA2B]
X-Antivirus: avast! (VPS 0546-2, 11/15/2005), Inbound message
X-Antivirus-Status: Clean

Some text.

_________________________________________________________________
Don’t just search. Find. Check out the new MSN Search!
http://search.msn.click-url.com/go/onm00200636ave/direct/01/



---
avast! Antivirus: Inbound message clean.
Virus Database (VPS): 0546-2, 11/15/2005
Tested on: 11/15/2005 13:28:33
avast! - copyright (c) 1988-2005 ALWIL Software.
http://www.avast.com

[xpjohn]

Thanks alanrf,
Did that and emails are very similar from my hotmail account and incoming clean message was inserted by Avast. I dont seem to have any trouble with hotmail emails but th ones from gmail and my friend.
I alson sent myself an email from gmail with just plain text and the incoming clean message is not on the email.
I compared the 2 source information of the emails and the only real difference I can pick is the email from hotmail states the email content as   text/plain format=flowed
and gmail states content of email as  multipart/alternative

I got no idea what is hapening. guess I will have to live with it.

[alanrf]

xpjohn,

I just conducted some tests sending messages from my gmail account to my pop account and I see what you are describing.

When I send a small text message from gmail to my pop account it is displayed without the avast "scanned clean" text.

When I send the same small text message plus an attachment (in this case a jpg file) the displayed message shows the small text message followed by the picture followed by the avast "scanned clean" text. 

What is happening?

Gmail sends the simple small text message as multipart/alternative.  That means the message actually has two parts inside it, one where the text is presented as plain text and a second where the text is presented in html format.  This is done so that those mail clients that can render html (like Thunderbird) will display the message as it was sent (with colour/fonts etc) while older mail clients which do not render html will display the plain text section only.

avast is actually inserting the "scanned clean" text but is putting it into the plain text section of the message only.  Your Thunderbird setting in View > Message body as > is almost certainly set to "Original HTML".  If you set it to "Plain Text" and look at the Gmail text message again you will see the avast "scanned clean" text.

Now in the case of the text message with an attachment Gmail sends the message as multipart/mixed.  It still contains the multipart/alternative sections for the text but it has an extra body part for the attachment.  In this case avast does not put the "scanned clean" text inside the plain text section but creates an entirely new body part for the "scanned clean" message.  So, Thunderbird then displays the html message text as before, then the attachment and finally the avast "scanned clean message".

Probably the same sort of thing is happening with the messages from your friend's ISP. 

It would appear that there is a slight inconsistency here but I think in the multipart/alternative case there can only be the two parts and so avast has to modify the plain text section.  In the multipart/mixed there is no limit on the number of parts and avast is free to add an extra part containing the "scanned clean" text. 

Hope this helps explain what you are seeing (or not seeing).   

[Lisandro]

Alan, does this occur with the X-Antivirus headers too?
I know it's not the solution but won't be easier just checking the hearders?

[alanrf]

The X-antivirus headers are there in all cases, but they are not seen in a normal message display.

The situation is confusing since in the multipart/alternative messages the avast clean message is only seen in a plain text display.  If the mail client renders html as the preferred choice (as most modern clients do) then the avast clean is not displayed.

So this appears to the user as avast failing to comply with the settings the user has selected.



 

[Lisandro]

Thanks Allan. Very useful explanation.

So this appears to the user as avast failing to comply with the settings the user has selected.

Maybe Alwil team find a way to solve this...

[alanrf]

It could be done but I think it would mean that avast would have to re-write the whole message as multipart/mixed, imbed the multipart/alternative and then add a body part for the avast clean message. 

That's a lot more complex than the way they have chosen to do it. 

[xpjohn]

Thanks a million alanrf, you were absolutely right and when I changed it from original html to plain text the incoming message was in the email that I sent myself from gmail.

this led me to experiment the same way with the emails I get from my friend. incedentally, she uses Outlook Express.
I did the same thing with her emails but still didnt see the message, however, I observed that when I checked simple html or plain text in view/message body as, an attachment called Blank background gif was attached to all the text emails she had sent. Hadnt noticed it before, and I knew she had not included any attachments herself. This attachment icon did not show up in original html.
And there lies the problem with her emails.
I opened up my copy of Outlook Express and tried to simulate the problem that I was getting in her emails. I found  that by going to Tools/options/compose in outlook express and ticking the mail check- box under the heading when composing new html messages the following stationery fonts will be used, I caused the same problem. No ingoing or outgoing clean messages.
And when I reversed this by going back to Tools/options/compose and unticking the mail check- box, the emails now carry the incoming and outgoing clean messages.
It would appear the gmail thing and my friends emails problems was somewhat unrelated and the problem with her emails was with her settings in Outlook Express.

Just thought I would pass this on in case somone else is having similar problems.

Hope I have made this clear.

Thank you so much for your support and indulgence with this problem Alan, you certainly steered me in the right direction and led me to the solution of the problem. Wouldn' have had a clue without your advice.
I appreciate your explaination, certainly helps me to understand a lot more and
a big thanks to everyone else who gave their valuable input to this post. Thanks guys.

John