Author Topic: False Postive. I Can't send emails whith Tunderbird. (Read 7360 times)

mbianchi · « **on:** August 27, 2009, 11:13:09 AM »

Hi, first of all, sorry for my bad English.

I have Avast 4.8 in my personal computer. Since a few days avast block my
output mails. I cant't send a email!!!!

The alert say:

26/08/2009 18:42:43 Milton Bianchi 1368 Sign of "HTML:Iframe-inf" has been
found in "C:\DOCUME~1\MILTON~1\CONFIG~1\TEMP\nsmail.eml" file.
26/08/2009 18:43:16 Milton Bianchi 1368 Sign of "HTML:Iframe-inf" has been
found in "C:\DOCUME~1\MILTON~1\CONFIG~1\TEMP\nsmail.eml" file.
26/08/2009 18:53:55 Milton Bianchi 1368 Sign of "HTML:Iframe-inf" has been
found in "C:\DOCUME~1\MILTON~1\CONFIG~1\TEMP\nsmail.eml" file.
26/08/2009 18:56:11 Milton Bianchi 1368 Sign of "HTML:Iframe-inf" has been
found in "C:\DOCUME~1\MILTON~1\CONFIG~1\TEMP\nsmail.html" file.
26/08/2009 19:44:31 Milton Bianchi 1536 Sign of "HTML:Iframe-inf" has been
found in "C:\DOCUME~1\MILTON~1\CONFIG~1\TEMP\nsmail.html" file.
26/08/2009 19:51:36 Milton Bianchi 1356 Sign of "HTML:Iframe-inf" has been
found in "C:\DOCUME~1\MILTON~1\CONFIG~1\TEMP\nsmail.html" file.
26/08/2009 19:54:34 Milton Bianchi 1356 Sign of "HTML:Iframe-inf" has been
found in "C:\DOCUME~1\MILTON~1\CONFIG~1\TEMP\nsmail.html" file.
26/08/2009 19:55:35 Milton Bianchi 1356 Sign of "HTML:Iframe-inf" has been
found in "C:\DOCUME~1\MILTON~1\CONFIG~1\TEMP\nsmail.html" file.
26/08/2009 20:01:02 Milton Bianchi 1356 Sign of "HTML:Iframe-inf" has been
found in "C:\DOCUME~1\MILTON~1\CONFIG~1\TEMP\nsmail.eml" file.
26/08/2009 20:01:40 Milton Bianchi 1356 Sign of "HTML:Iframe-inf" has been
found in "Correo saliente 'ssadasd' De: Milton Bianchi
<mbianchi@softpoint.org>, Para:..

And this file are Temporary files created by Thunderbird when sending a
message; this file not are a virus!!!!

What can I do to continue working with avast and Thunderbird???

Thunderbird version: 2.0.0.23
SO: Windows XP Professional with SP3.

Thanks in advance

silvertones · « **Reply #1 on:** August 27, 2009, 02:18:07 PM »

I have the identical setup with never a problem. Better check it out further.

DavidR · « **Reply #2 on:** August 27, 2009, 03:43:49 PM »

So are you using iframes in your email ?

As the Sign of "HTML:Iframe-inf" is an indication of an injected iframe in the source of the email.

Check the source code of the emails and see if there is an iframe tag and what are the contents of that tag, e.g. where is it pointing ?

Note:
When posting URLs to suspect sites, change the http to hXXp so the link isn't active (clickable) avoiding accidental exposure.

mbianchi · « **Reply #3 on:** August 28, 2009, 12:52:04 PM »

I found a virus o similar that include this tags in html files;
how can i remove the virus/malware?? The avast don`t find a virus!!!

DavidR · « **Reply #4 on:** August 28, 2009, 02:56:35 PM »

It may be hidden or undetected, so you could start by trying these options.

If you haven't already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).

1. MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
2. SUPERantispyware On-Demand only in free version.

Don't worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.

Mr.Agent · « **Reply #5 on:** August 28, 2009, 04:26:02 PM »

Tracking Cookies wouldnt be worried so if you want u can only do a scan with Malwarebytes as in my eyes they are both got the same option if im not wrong.

DavidR · « **Reply #6 on:** August 28, 2009, 05:24:00 PM »

Yes you are wrong.

I said not to worry about tracking cookies, but that isn't the only thing SAS looks for so 'both' scans should be done otherwise I wouldn't have bothered to include both.

Mr.Agent · « **Reply #7 on:** August 28, 2009, 05:26:40 PM »

Well i only got Malwarebytes and its done more great than SAS. So in my term its not so usefull. Malwarebytes is still can catch some and Avast! can do his bootscan after that for see if there some. Also like me i can also do a scan with Windows Defender if he find something.... For be sure.

Like i can see Malwarebytes and SuperAntiSpyware is about all the same also for my use. And i wont worry even if i didnt got SAS. I got Avast! with MBAM and its all i can say i need. And for sure MBAM alone can own a lot too.

Mr.Agent

DavidR · « **Reply #8 on:** August 28, 2009, 05:33:07 PM »

We are not talking about what you may or may not have found, but what might be on the original posters system. So if you haven't even got SAS how can you offer any advise on it one way or another.

That is why when giving advice to someone else it is best not to use supposition.

If avast doesn't find it in a conventional scan it is hardly likely to find it on a boot-time scan using the same signatures.

Mr.Agent · « **Reply #9 on:** August 28, 2009, 05:37:35 PM »

Well that why i say if Avast! didnt find it for sure now a day i can say i got Malwarebytes and Windows Defender as backup. Even if Windows Defender later is ended i got Malwarebytes also. I did see in their web that its about the exact job that SAS do like Malwarebytes on demand. And SAS Interface for me look really not friendly and hard to configure. So that why i use Malwarebytes its really nice and fast. So i can say im enought happy to what i got and i know u didnt talk about what i should got or no. But me i can say 1 or 2 of them or both its the choice of the user to decide.

You understand ?

Mr.Agent

DavidR · « **Reply #10 on:** August 28, 2009, 05:55:09 PM »

Look I couldn't care less, what we are trying to do is help the original poster not take this in a different direction off-topic.

YoKenny · « **Reply #11 on:** August 28, 2009, 07:05:37 PM »

Quote from: Mr.Agent on August 28, 2009, 05:37:35 PM

Well that why i say if Avast! didnt find it for sure now a day i can say i got Malwarebytes and Windows Defender as backup. Even if Windows Defender later is ended i got Malwarebytes also. I did see in their web that its about the exact job that SAS do like Malwarebytes on demand. And SAS Interface for me look really not friendly and hard to configure. So that why i use Malwarebytes its really nice and fast. So i can say im enought happy to what i got and i know u didnt talk about what i should got or no. But me i can say 1 or 2 of them or both its the choice of the user to decide.

You understand ?

Mr.Agent

Typical French-Canadian logic!

Agree with me because I was here first and this is my domain.

There are more experts here than you can comprehend so start to listen instead of declaring one application is the best and only thing you need!

Mr.Agent · « **Reply #12 on:** August 29, 2009, 12:17:48 AM »

I can agree we can suggest something with Avast! but we wont decide for them for sure because it his cpu

DavidR · « **Reply #13 on:** August 29, 2009, 01:21:59 AM »

What are you talking about, the CPU (Central Processing Unit, the main computer chip) has nothing to do with this.

We aren't suggesting something with avast but trying to ensure that if there is a possibility of other malware we run multiple applications to ensure the best possible chance of detection, relating to his Reply #3.

When you are in a hole it is best to stop digging.

Mr.Agent · « **Reply #14 on:** August 29, 2009, 02:02:39 AM »

Yeah like me i use Avast! with Malwarebytes so Malwarebytes can tell me sometime some great news for what Avast! did not find.