Scaning .PST files with Avast - size increases

[spica]

I have recently scanned a load of .PST files (created from various versions of Outlook) using Avast 4.8.1368 and with only a couple of exceptions, all the files have increased in size by something like 10%. Thankfully I had a backup, so I was able to open up the original and the updated files in Outlook, and it seems that in the process of scanning the PST file, Avast has "added" in a couple of extra mail folders, like "Inbox", "Outbox" and "Sent Items" where they didn't exist before - I presume this is the source of the increased size because the actual messages in the PST files don't appear to have changed.

I'd like to ask why Avast is doing this? Its annoying for several reasons:
1. I've just spent a couple of hours panicking that something has messed up/infected all our PST files (which are effectively backups of email) - it took me a while to realise it was Avast in the first place...
2. As these files are email backups, I really don't like the idea that they have been modified in some way by a 3rd party product, plus they have all grown and used up another couple of GB on our storage device
3. The date/time stamps have all been updated on all the PST files, so I've lost the record of when the files were created in the first place.

I will of course, restore from backup, but is this normal behaviour? Can a request be submitted for a change in future products to stop this? And how do I avoid this right now? Do I add the PST extension into the Blocker page of the Standard Shield? Does this cover scheduled file scans too?

Thanks,
Durwin

[igor]

The scanning of PST files is done through the MAPI subsystem installed on your machine... avast! doesn't add any folders intentionally.

If you're using the Professional version of avast!, I suggest to disable the MAPI unpacker.
Or, you can put the PST files (as *.pst) into the list of on-demand exclusions in avast! settings.

[spica]

Thanks for the quick reply - but its strange that opening the original PST file in Outlook (a MAPI program) doesn't do the same thing - it does update the date/time but doesn't add the additional folders.

We have the professional version; so, removing the MAPI unpacker will only affect file-level scans, is that right? I.E. it won't scan inside PST files when launched from a scheduled or on-demand scan? But Avast will continue to scan all other activity inside Outlook? I presume if we open a PST in Outlook that has an infected message and we try to open it, Avast will then catch it?

I just want to make sure we stay protected without unnecessary additional problems!

Thanks

[igor]

We have the professional version; so, removing the MAPI unpacker will only affect file-level scans, is that right?

Changing the configuration (i.e. removing the MAPI unpacker) will affect whatever task you change this way.

I.E. it won't scan inside PST files when launched from a scheduled or on-demand scan?

When launching a scheduled or on-demand scan, you are launching a particular task - so that's the task where the MAPI unpacker should be disabled.

But Avast will continue to scan all other activity inside Outlook? I presume if we open a PST in Outlook that has an infected message and we try to open it, Avast will then catch it?

If you are using the Outlook plugin (i.e. the Outlook/Exchange resident provider), it's completely unrelated to the MAPI unpacker - so yes, it will still be protected. The MAPI unpacker is only for the "file-level" scans.

[spica]

I checked the default tasks in the Enhanced interface:
Scan: interactive selection - does not have MAPI selected in the list of packers, I added *.pst as an exception
Scan: local disks - does not have MAPI selected in the list of packers, I added *.pst as an exception
Resident protection/Standard Shield - does not have MAPI selected in the list of packers, , I added *.pst as an exception in the Advanced section
Resident protection/Outlook/Exchange - has all packers selected, so I have removed MAPI from here, no option to exclude PST files

To be clear, I'm right-clicking a PST file and selecting "Scan xxx.PST" - I'm not sure which task is running at this point, but it appears to be overriding the above tasks because its still happening... I don't want to do a local scan every time to test, it takes about 2 hours!
Any further advice would be grateful
Many thanks!

[igor]

I checked the default tasks in the Enhanced interface:
Resident protection/Standard Shield - does not have MAPI selected in the list of packers, , I added *.pst as an exception in the Advanced section

Not necessary, if MAPI packer isn't activated.

Resident protection/Outlook/Exchange - has all packers selected, so I have removed MAPI from here, no option to exclude PST files

Well, that would only have effect on .pst files that someone sent you by e-mail (as an attachment)

To be clear, I'm right-clicking a PST file and selecting "Scan xxx.PST" - I'm not sure which task is running at this point, but it appears to be overriding the above tasks because its still happening... I don't want to do a local scan every time to test, it takes about 2 hours!

That would be the "Explorer Extension" task. To see it, you'd have to check the option Show Special Tasks in Settings / Enhanced User Interface.

Anyway, maybe I wasn't completely clear about the exclusions. You can put the exclusion to every task separately, but an easier way would be to put it into the list in Settings / Exclusions - that will affect all on-demand tasks (and for the resident protection, it's not necessary anyway).
Also, once you have the exclusion there, it's probably not necessary to disable the MAPI unpacker - it's either the first one, or the second one, doing both is superfluous (except for special cases when somebody renamed the .pst file to something else - in which case disabling the MAPI unpacker would be "stronger").

[spica]

Perfect - I forgot about the global exclusion list, so I've added *.PST there. It works, so I'll leave it at that for now. I also wasn't aware the Explorer extension and Screen saver tasks existed, the screen saver task could be very useful for ongoing local disk scans...

Thank you
Durwin