Email scanner scans often with no incoming or outgoing mail being sent

[lee88]

I have the 4.8 home version, outlook express/earthlink and noticed that email is being scanned even when there is no email being transmitted, incoming or outgoing, and sometimes every few minutes (I don't send or receive email more than a few times a day). In the bottom right of screen is the Avast icon and usually says Mail scanner [msimn.exe-pop4.earthlink.net] or sometimes
'MailSvr' instead of msimn.exe. Why is it doing this when there is no incoming or outgoing email being sent and is it cause for concern?  Thanks

[sded]

Does anything show up as being scanned when you go to On Access Protection Control/Internet Mail?  Are you set up to scan pop/smtp/imap/nntp under "customize"?  Are you using a newsreader?  You can also go to the "advanced" tab and ask for details to be shown, or look at the avast! log to see what is happening.

[lee88]

The only mail that shows up as scanned is the last incoming email (spam) that I actually received but that was hours ago and it has shown (by the icon appearing in lower right corner) that scanning occurs many times since then. I have all those things checked under customize (though internet mail is set at 'high' not custom) and do not use a newsreader (if I do I'm not aware of it). I put check mark in 'ask for details' under advanced but don't see anything different and the avast log shows nothing about it under alerts or notices or info. I just noticed that when it says msimn.exe it's pop4.earthlink.net but when it says MailSvr.exe it's pop7, if that means anything. I guess scanning too much is better than not enough but don't know why it's doing it so often.

[sded]

What firewall are you using?  It would be prudent to do a full system scan with avast!, and if that doesn't show anything with an antimalware like SAS ( http://www.superantispyware.com/ ) or MBAM ( http://www.malwarebytes.org/ )  Could be a Trojan or ?  Outlook Express also has a log you can turn on.

[lee88]

I will take your advice and then be done with it (I use SAS and Comodo firewall.) But I just noticed... it does not scan outgoing mail I send at all, just incoming, even though I have it checked to scan outgoing too. It will show what incoming mail was scanned under internet mail but when I send something, nothing, not even the scanning icon. Any idea why it's not doing that?? Thank you.

[sded]

What OS are you using? Are you using gmail or something else that sends encrypted email?  What ports does Outlook Express use for incoming and outgoing mail. If your OE uses unencrypted port 25 for smtp and you have port 25 redirected in Avast!, you should see it scanned.

[DavidR]

Set the Internet Mail provider to High sensitivity, that has a heuristic style check for a number of identical emails in a given period of time.

This should catch if your system is transmitting spam. The two programs suggested by sded may well find and undetected/hidden trojan spambot.

Also see the results of this search, http://www.google.com/search?q=MailSvr.exe
Do you have any of the programs mentioned in this URL http://www.file.net/process/mailsvr.exe.html ?

e.g. C:\Program Files\EarthLink TotalAccess\MailSvr.exe so it seems to be an earthlink file.

[lee88]

I went to OE and saw that my outgoing port was not set at 25 but at 587  I didn't want to mess with my OE settings so I redirected the Avast smtp from 25 to 587 and now it's scanning outgoing mail too. I don't know why the OE port is set at 587 and not 25, is there any reason I should change them to 25 since they both work fine now on 587? Thanks   

[DavidR]

I suspect that that may be because your ISP requires you use SSL/TLS secure encrypted email ?

However, that may well not be the case as if you add a port to the redirects that uses SSL it will fail and this hasn't happened or you would have reported it.

If that port is what your ISP insists on then I would leave it at that as changing it to port 25 in OE could result in email being blocked on that port at the ISP email server. It is something you could test though (or better still ask the ISP why it is so), temp set it to 25 in OE and try to send and email to yourself.

[lee88]

I did as you suggested and port 25 worked fine too for SMTP outgoing mail; I think a long time ago Earthlink instructed users to change to port 587 but they both seem to work. You guys at Avast are MUCH better at responding to issues than Lavasoft ('adaware'), thanks.

[DavidR]

You're welcome, it doesn't come as a surprise about the adaware forum, this forum has always had quick response times

Personally I would lose adaware as it really hasn't kept pace with developments and now I wouldn't give if hard disk space, there are better alternatives such as the two suggested by sded.

[TwoShoes]

How often do you have Outlook Express set to check for new Emails?  Go to tools --> options --> general tab.  About half way down it says "check for new messages every x minutes"  Each time it does this check you will see the icon in the lower right even if you have no mail to send or receive.

[lee88]

TwoShoes, they should hire you. I didn't know that when mail is checked (in my case it's set to check every few minutes), the scanner icon shows up even if there is no actual mail to send/receive. I'm surprised the others didn't mention that, I thought that maybe someone was hijacking my mail program, a big thank you!

[sded]

Interesting.  I don't use OE, but use PopMan to check for new mail, and Avast! doesn't twitch unless there is mail.  Glad it's solved though.

[DavidR]

I'm surprised the others didn't mention that, I thought that maybe someone was hijacking my mail program, a big thank you!

I'm not as we tend to think that you would know if you have email set to check for new emails every x minutes.

I use OE and I have that function disabled,  so it never rears its head to jog my memory. As a dial-up user I keep a tight reign on what I allow to connect.

Would you believe this is the first time in almost 5 years on the forums I have seen this, so it isn't too common.