Function setifaceUpdatePackages() has failed

[imaintain]

I am running Avast! 4.8HE on W95.  After I recently updated the program and database it is not working well. 

The Warning Log Viewer shows the following two items:

12/18/2008 4294920763 Function setifaceUpdatePackages() has failed
Return code is 0x000004C7, dwRes is 000004C7

12/19/2008 4294572667 Function setifaceUpdatePackages() has failed
Return code is 0x000004C7, dwRes is 000004C7

These may have been caused by my choosing NO to a Suspicious Activity Warning a couple of times during the installation processes.  I think I should have chosen Ignore.

The Chest is empty and there has been no indication of a malware attack.  I find that there are no new updates available.

Please advise.

[DavidR]

These are I would say totally unrelated to what you mention, they are verbose messages not very useful to the user more helpful to a developer when trying to debug a problem. These particular messages can safely be ignored.

I don't go looking in the logs unless I experience a problem an avast 'error' message displayed to the screen.

What was the suspicious activity ?
That should be recorded in the same log viewer, warning section.

The chest would be empty unless you specifically choose Send to Chest as the option on an alert.

[imaintain]

Thanks for your reply.

I have not received any error messages or alerts and the only other entries in all the logs are three in the Notice Log.  Two of them on 12/18 stating a new program update is available, and one on 12/20 advising a new virus database is available.  These updates were installed.  Twice during the installations there was a popup warning of Suspicious Activity, specifically about writing to a program on the C/ drive (I think it was to Avast), and I was confused and chose NO. 

One concern I have is there are two indications that my internet mail is not being scanned: contrary to the settings, the a-ball does not rotate while scanning, and the messages do not contain a tag.  The other concern is whether the computer is actually being scanned, since the a-ball is still during that process too.

I am using OE5.5 as my mail program and the proxy server seems to be set up OK since it passes the connection test.

[DavidR]

Notice is a very low level and normally of little value to a user, mostly they are confirmation of actions taken and importantly in this case they show auto updates taking place, see image. So the absence of entries it bad news in a way as it indicates auto updates aren't happening, it is may be related to the update failure message.

Try a repair of avast. Add Remove programs, select 'avast! Anti-Virus,' click the Change/Remove button and scroll down to Repair, click next and follow.

What is your firewall ?

I don't know if there any essential differences in win95 with the animation of the icon, but check the on-access protection detailed view for the Last scanned and scanned count, these should be updated when scans occur. You can also check the email headers they should have an indication they have been scanned.

[Lisandro]

I won't worry that much... verbose of the logs...

[imaintain]

The update options are currently set to Ask, for convenience.

I have not yet tried a repair.

The firewall is Sygate, and all four of the Avast items are allowed, viz. AV service,  e-Mail Scanner Service, and  updates of  \avast.setup and \setup.ovr.

I have checked the on-access protection detailed view of Internet Mail.  It shows that the provider is currently running, but the Last scanned space is empty and the scanned count is 0.  I checked the Email headers and they do not show that the mail has been scanned.

[Lisandro]

The update options are currently set to Ask, for convenience.

I suggest you let the virus database update on Automatic.

I have not yet tried a repair.

So... go ahead

The firewall is Sygate, and all four of the Avast items are allowed, viz. AV service,  e-Mail Scanner Service, and  updates of  \avast.setup and \setup.ovr.

Maybe uninstalling Sygate and installing again or, at least, remove the avast entries in the programs settings of Sygate and allow it to connect again when Sygate make access questions.

I have checked the on-access protection detailed view of Internet Mail.  It shows that the provider is currently running, but the Last scanned space is empty and the scanned count is 0.  I checked the Email headers and they do not show that the mail has been scanned.

Which is your email program?

[DavidR]

The update options are currently set to Ask, for convenience.

I have not yet tried a repair.

The firewall is Sygate, and all four of the Avast items are allowed, viz. AV service,  e-Mail Scanner Service, and  updates of  \avast.setup and \setup.ovr.

With it set to Ask this is effectively a manual update, e.g. you initiate it and manual updates aren't recorded in the log as I believe since you initiate it you don't need a report of it. So that is why there are no auto update entries in your log.

As Tech said set the virus database to Auto as avast uses an incremental update and they are measured in KBs rather than MBs and last seconds rather than minutes.

A repair if nothing else would confirm avast is working correctly and the problem is likely to lie outside.

Delete the entry for avast.setup in sygate and do a manual update, that should force it to ask again.

[imaintain]

I have repaired Avast and set the updates to automatic.  Also, the firewall is functioning OK as far as I can tell.

I don’t think I have any problems with updating or with the logs.  At this point my concern is with Email not being scanned.

My Email program is Outlook Express, and I think I have found where the problem is, but I don’t know how to fix it.

The Email program connects to the server on secure (SSL) connections, through local ports 995 and 465.  The firewall indicates is that ASHMAISV is listening to IP address 127.0.0.1 on ports 110, 25, 143, and 119.

[Lisandro]

I don’t think I have any problems with updating or with the logs.

Well, ok then... you can check Warning/Notice sessions of the avast logs and see if avast is being correctly updated.

At this point my concern is with Email not being scanned.
My Email program is Outlook Express, and I think I have found where the problem is, but I don’t know how to fix it.
The Email program connects to the server on secure (SSL) connections, through local ports 995 and 465.  The firewall indicates is that ASHMAISV is listening to IP address 127.0.0.1 on ports 110, 25, 143, and 119.

First of all, it's not possible because Gmail uses SSL (Secure Socket Layer) connections. Avast mail scanner doesn't support SSL (Secure Socket Layer) connections. But take a look here: http://forum.avast.com/index.php?topic=10428.0 to see how to set up secure email with avast!.

There is an explanation of this here: http://forum.avast.com/index.php?topic=28150.msg229981#msg229981

Since SSL/TLS e-mail is encrypted and decrypted in the client, external virus scanners (including avast!) can't read or scan it.
The solution is to pass e-mail in and out un-encrypted from your client (Outlook Express, Thunderbird, ...) to a proxy program (Stunnel) that does the actual ssl or tls encryption/decryption of the pop3/smtp e-mail and communicates directly with the ISP server on the appropriate ports. Download here: http://www.stunnel.org/download/binaries.html

[DavidR]

We aren't really concerned about 'if' the firewall is functioning OK, there are times when even though an application is apparently allowed to connect it is somehow unable to do so. Hence the suggestion to delete the entry and force sygate to ask again.

[imaintain]

I think the work-around is beyond my capability.  So my question is whether the On-Access Scanner will provide protection from viruses contained in Email.  I know that some people argue against using an Email scanner as a supplement to an antivirus program.

[DavidR]

The email scanning isn't a supplement to an AV but an integral part of it. avast scans incoming email before they are saved in your inbox, etc. So it has time to alert you and effectively block it being saved in your inbox, which some AVs have difficulty removing an infected email from an email database file.

If you receive non-SSL emails yes avast will scan them, for the SSL emails they aren't scanned, but this applies to all emails - never click on links or open attachments in unsolicited emails. If the email contains an attachment and you believe the email legit, save the email attachment to your hard drive.

Depending on the file type, .exe, .com, etc. avast would scan it automatically but you can also scan it manually, by going to where you saved it too, right click on it and select Scan selected areas for viruses.

If you set the Internet Mail provider to High it can detect multiple identical outbound emails in a period of time. This could provide an early indication of a hidden or undetected spambot, which you can get help with.

[imaintain]

I thank you very much for all the helpful information and advice.  I think you’ve answered all my questions.

[DavidR]

You're welcome.