YAHOO SECURITY UPDATE PROBLEMS!

[SCORPIONINBLUE]

Hello -
I'm having a problem with Avast and Thunderbird 2, below is a security update that I received from Yahoo yesterday.  Naturally I wasn't pleased to see it since I KNEW there would be a problem and I sure have one now!  After making the changes Yahoo specified according to their manual instructions, it seems that Avast won't scan my mail.  I went into the Internet mail scanner and changed the POP AND STMP configurations there to what Yahoo stated, and the mail scanner was completely blocking all incoming mail.  I could see the icon as being active, but no mail was in my box.  I went and did a repair, and rebooted hoping that everything would be OK, but alas, no such luck.  Now I had to terminate the Avast module, and upon doing so started receiving my mail.  Naturally I don't have Avast protection.  What should I do to make the mail scanner compatible with these Yahoo changes?  Attached below is the message from Yahoo, I tried to use the Self support tool, but it wouldn't work, so I made the changes manually.

    _________________________________________________________________________________


Email security enhancements — action required

Dear AT&T Yahoo! Member,

We're making some security improvements to your AT&T Yahoo! service. These changes will affect members who send or receive email from a desktop or mobile client program, such as Microsoft Outlook, Microsoft Outlook Express, Eudora, Apple Mail, or Thunderbird.

To help us ensure the security of your email, you will need to change the settings on your desktop or mobile email client program. Please choose one of the three options:

    Make the Changes Automatically: To automatically make the required changes to Outlook Express, use the AT&T Self Support Tool.

        * If you already have the AT&T Self Support Tool installed on your computer, simply select Cannot send/receive email from the Self Support Tool Main Interface to run an email settings check. When prompted to change your email settings, select Yes.


        * If you do not have the AT&T Self Support Tool installed, download it and then follow the instructions above.

    Make the Changes Manually: To manually make the required setting changes in Outlook and Outlook Express, please view the detailed instructions here.

    Alternatively, you may take the following steps to change the settings on your desktop or mobile email client program:

       1. Open your email client program.
       2. Locate the email account settings for your particular client.
       3. Change the POP server to pop.att.yahoo.com.
       4. Change the SMTP server to smtp.att.yahoo.com.
       5. Check the option labeled Use an encrypted connection (SSL) and change the SMTP port to 465.
       6. Check the option labeled Use an encrypted connection (SSL) and change the POP3 port to 995.
       7. Confirm the above settings then click OK.

The web-based version of AT&T Yahoo! Mail is not affected by these changes and will continue to be available at http://mail.yahoo.com.

Thanks for your cooperation.

Sincerely,
AT&T Yahoo! Customer Care
1-800-ATT-2020

[DavidR]

I went into the Internet mail scanner and changed the POP AND STMP configurations there to what Yahoo stated, and the mail scanner was completely blocking all incoming mail.

Wrong, avast can't intercept and scan SSL/TLS secure encrypted email, so you have to leave the original ports the same.

See these Topics as you need to have a third party interface 'STunnet' for avast to scan these ports, whilst the majority relate to gmail, it should be enough to be able to set it up.

Redirecting multiple SSL accounts
Gmail and Avast Providers
Solution: Using GMail with Avast and a SPAM filter

Stunnel now comes as an installer which installs Open SSL and Stunnel so now you just have to download the installer version from here http://www.stunnel.org/download/binaries.html

[alanrf]

Or you can just rely on the virus scanning of mail by Yahoo that is performed when you use their POP/SMTP servers.

As a Thunderbird user you can retrieve/send your Yahoo mail also via the Thunderbird Webmail extensions (as I do).  With this method you can have avast scan your Yahoo mail with a single check of one box in the Internet Mail interface.

Since you do have POP/SMTP server access to Yahoo I would recommend you continue to use it and rely on the virus scanning performed by Yahoo for you.  If you really want to go down the STunnel route ... that is your choice.

[SCORPIONINBLUE]

I found a simple solution to this dilemma, I called Yahoo Tech, and asked the woman was it absolutely necessary to make these changes, after explaining my problem.  She more or less said no!  I restored my Thunderbird and Avast setting to what they were before, and I'm not having any problems whatsoever so far!!  Who knows what may happen down the road in the future, but now I'm a firm believer in the old expression "If it ain't broke, don't fix it"!

[alanrf]

Remember this though for the day (it will come) you find out that they meant what they said.

[SCORPIONINBLUE]

I know!  I  called Yahoo again and got a really knowledgeable tech., he told me that I have to make the changes due to the fact that they are upgrading their servers and my failure to do so will result in no mail!!

I'm so annoyed that I won't have Avast scanning my mail, and I'm now at the mercy of Yahoo/Norton.  Well all I can do is keep my fingers crossed and schedule my boot-scans weekly.

[DavidR]

Or go through the steps of setting up STunnel to act as a go between so avast can still scan your email. See the links above for general information.

[Lisandro]

If you need further help with Stunnel configuration, just let us know.

[SCORPIONINBLUE]

No thanks, but I'm grateful for the offer.  I looked at what's involved and I'll pass, it's beyond my level of 'expertise' and I don't want any serious problems with this machine.  I've only gotten to this level of confidence with the help of great guys like 'Techie' and Stunell is beyond me at this moment in time.  I'm a very firm believer in the old saying "better safe, than sorry!" So I'm just going to let it be!  Thanks again!!

[Lisandro]

At least, don't open emails that you don't trust the sender.
Do not open *any* attached file if you don't scan it before with avast.

[SCORPIONINBLUE]

Hey thanks Tech, I thought I wouldn't be able to do that with the mail scanner disabled now.  So I can still right click the attachments in my emails and scan them?  Well that's a relief to know!  Thanks again!!

[Lisandro]

So I can still right click the attachments in my emails and scan them?

No. You'll need to save the file to your disk to do so.
I'm not sure that if you right click your extensionless Thunderbird mailbox file (Inbox) you'll be scanning the attached file.

[SCORPIONINBLUE]

t
Thanks for the clarification.

[Lisandro]

t
Thanks for the clarification.

I'm not sure about it. Someone with more knowledge must post. Maybe Alanrf.

[alanrf]

Avast does not know how to scan Thunderbird mail files.  It thinks it a simple .eml file and can scan the first message in the file only. 

It would be fairly easy for the avast team to recognize, by content, the the file as a Thunderbird mail file (as other antivirus products do) but they have not done so.

I again remind the original poster that the setup to read/send the Yahoo mail using the Thunderbird Webmail extensions is easy to set up and then with one click of the avast interface those messages will be scanned by avast.