Author Topic: Avast mail scanner ?  (Read 13291 times)

0 Members and 1 Guest are viewing this topic.

Roadkill

  • Guest
Avast mail scanner ?
« on: April 08, 2006, 09:08:15 PM »
Hi all, ;)
        recently the avast mail scanner icon is frequently showing up in the tool bar as often as every couple of minutes, but I am not using any email applications.
When i put the mouse on it it says: Avast Mail Scanner user-39002 wfd86a.dsl.pol.co.uk 
None of this resembles the email accounts when sending and receiving.
Any ideas ???

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: Avast mail scanner ?
« Reply #1 on: April 08, 2006, 09:19:52 PM »
Is it this one?
http://forum.avast.com/index.php?topic=19794.0;topicseen

These could be simpthoms of infection...
Better if you run a boot time scanning of avast AND an ewido + a-squared scanning for cleaning trojans.
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: Avast mail scanner ?
« Reply #2 on: April 08, 2006, 09:20:18 PM »
Does this resemble your ISP, pol.co.uk ?
If so are you using a P2P program ? - Azureus perhaps ?

Do you have a firewall, if so what ?
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Roadkill

  • Guest
Re: Avast mail scanner ?
« Reply #3 on: April 08, 2006, 11:46:36 PM »
Does this resemble your ISP, pol.co.uk ?
If so are you using a P2P program ? - Azureus perhaps ?

Do you have a firewall, if so what ?
I don't know what the pol stands for.
I use utorrent and it does seem to trigger the event when this is running,but if this is the case why does it say mail scanner and not p2p.
Never used to see the icon flash up.
Using Sygate Personel Firewall at the moment.
« Last Edit: April 08, 2006, 11:50:33 PM by Roadkill »

Roadkill

  • Guest
Re: Avast mail scanner ?
« Reply #4 on: April 08, 2006, 11:49:23 PM »
Is it this one?
http://forum.avast.com/index.php?topic=19794.0;topicseen

These could be simpthoms of infection...
Better if you run a boot time scanning of avast AND an ewido + a-squared scanning for cleaning trojans.

Ran spyware doctor and it found a couple of things which I deleted, although I didn't pay much attention to what they were as I did it before I saw your post.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: Avast mail scanner ?
« Reply #5 on: April 09, 2006, 01:15:48 AM »
Does this resemble your ISP, pol.co.uk ?
If so are you using a P2P program ? - Azureus perhaps ?

Do you have a firewall, if so what ?
I don't know what the pol stands for.
I use utorrent and it does seem to trigger the event when this is running,but if this is the case why does it say mail scanner and not p2p.
Never used to see the icon flash up.
Using Sygate Personel Firewall at the moment.
The pol stands for Planet On Line I believe, I have seen this type of activity in other P2P programs namely Azureus and the reason the mail scanner gets involved is because it or another peer is truing to connect using an email port which avast's email scanner is monitoring. Usually this would cause a connection timeout warning.

I'm sorry I don't use any P2P program, so I have no idea of the set-up for utorrent on communication ports, etc.

Take a look at this thread and see if you can apply the same logic/settings to utorrent.
Check out this Thread http://forum.avast.com/index.php?topic=18105.0
and this post in particular http://forum.avast.com/index.php?topic=18105.msg154105#msg154105

Sygate also has a problem in that it may report localhost proxy activity but not the program that is using the proxy, so there are occasions when it will report the web shield connecting to the internet when it is the browser using the proxy to connect. This masks programs as you allow web shield access so by default anything using the proxy gets through because Sygate only sees the proxy.

How to disable transparent web shield proxy and allow only those browsers you want use it:
In avast! go to Web Shield provider, Customize..., Basic tab, blank the redirected HTTP port field (remove the 80). Now no browser can use web shield unless you manually configure it to use Web Shield.

However, since Sygate is no longer being developed, perhaps it is time to look for another firewall that doesn't have this issue with localhost proxy.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3870
  • Just an avast user
Re: Avast mail scanner ?
« Reply #6 on: April 09, 2006, 03:38:26 AM »
I just installed utorrent (version 1.5) to take a look at it.

It seems it is a popular alternative to azureus apparently because it is "skinnier" and  reportedly faster, mainly due to not being java based (which azureus is).

Unlike azureus it does not offer the user the opportunity to avoid peers who offer connections on "well known ports" such as those intercepted by the avast Internet Mail provider.  While utorrent seems to assign the user's listening port randomly at a high port number the users can connect to peers on other products where - as we know - the "well known ports" are frequently used.

The simplest solution for roadkill and all utorrent users is to edit their avast4.ini file and in the section headed:

[MailScanner]

add a line:

IgnoreProcess=utorrent.exe

Perhaps the avast folks could save them all the trouble and do it for them.

« Last Edit: April 09, 2006, 03:42:15 AM by alanrf »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: Avast mail scanner ?
« Reply #7 on: April 09, 2006, 03:41:32 PM »
Thanks Alan.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Roadkill

  • Guest
Re: Avast mail scanner ?
« Reply #8 on: April 09, 2006, 11:52:05 PM »
Many thanks for all your help. ;)
Altered the ini.
I'l let you know if it does not fix it.
Roadkill 8)

nikits72

  • Guest
Re: Avast mail scanner ?
« Reply #9 on: July 22, 2006, 10:36:24 AM »
Hi all ,

today  this mail scanner icon appeared to my pc too.
I am going to do what alarf suggests editing the avast4.ini file e.t.c.

My question is ,
 by doing that am i leaving any hole for infections e.t.c.  ?

I am newbbie in these matters so forgive me if i ask something obvious or funny.

Thx for reading this...

N.

P.S. I have utorrent ver 1.6 installed but it was not loaded in memory when the problem occured....(and i havent used it yet for today)
« Last Edit: July 22, 2006, 12:08:29 PM by nikits72 »

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: Avast mail scanner ?
« Reply #10 on: July 22, 2006, 01:50:42 PM »
My question is,  by doing that am i leaving any hole for infections e.t.c.  ?
No, you're only bypassing the mail provider to scan utorrent traffic.
utorrent shold be scanned by P2P and Standard Shield providers.  :)
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: Avast mail scanner ?
« Reply #11 on: July 22, 2006, 01:56:04 PM »
Before editing the ini file you have to identify why the email icon is scanning, if it is utorrent and not something else then this is the correct action.

Stopping the email scanners scanning content that isn't in email protocol won't leave you more vulnerable as the email scanner will effectively stall as it is looking for the traffic using email ports to be using email protocol.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

nikits72

  • Guest
Re: Avast mail scanner ?
« Reply #12 on: July 22, 2006, 02:07:17 PM »
1st of all thx for trying to help...

Before editing the ini file you have to identify why the email icon is scanning, if it is utorrent and not something else then this is the correct action.

DavidR is probably right.It seems that it is not cause of utorrent.
If i hover the mouse over the icon i get at least 3 different names (even ip's) and also they change as the time pass by.

strange eh?


« Last Edit: July 22, 2006, 02:08:50 PM by nikits72 »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: Avast mail scanner ?
« Reply #13 on: July 22, 2006, 02:32:29 PM »
Well ignoring utorrent won't harm this current email scanner icon issue, if it is down to utorrent it should stop the occurrence. If not then it could be that you have a spambot on your system, not too likely because of the multiple IPs which sounds more like P2P than email servers, etc.

Again it never hurts to be too sure you could try running Ewido or a-squared (depending on your OS) in safe mode, Ewido anti-spyware If using winXP. or a-Squared free if using win98/ME. If they come up clean (or no serious issues) it is more likely to be utorrent and the change to the ini file may indicate that also if there are no more email icons popping up.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

nikits72

  • Guest
Re: Avast mail scanner ?
« Reply #14 on: July 22, 2006, 03:32:56 PM »
I ve already added the nie you suggested and the problem persists.

So i will scan my pc with avast -since this is the one i have installed right now- and let you know what will happen.

Thx again 4 your much appreciated help.
N.