STMP failed with 421 EHLO Helo rejected

[T-RHex]

I just installed Avast Pro 5.1.889 (previously had another AV) and I cannot send email with outgoing scans enabled. 

If I uncheck "Scan outbound messages", I can send email.
With "Scan outbound messages" checked, however, my email client (Mahogany) reports the following error:

"SMTP 421 EHLO Helo rejected"

The email client is set to not use SSL, and the list within Avast's Mail Shield has encryption set to "none" for all SSL accounts. 

Any suggestions?

Thanks,
tr

WinXP Pro SP3
Outpost Pro 7.0.4 (newly installed) - webcontrol and anti-spyware modules disabled
Avast Pro 5.1.889 (newly installed)

[sded]

What unencrypted email system are you using?  What AV did you previously have and how did you remove it-many require the use of a special removal tool from the vendor to clean out the remnants?  What SMTP port are you using?  Does it show up properly under settings/troubleshooting/redirect settings as well as under the SSL accounts?

[T-RHex]

Thanks for responding.

By "email system" do you mean ISP or software client?  My ISP doesn't support SSL.  My email client is a freeware app called Mahogany which I've used for many years.

I previously used ESET NOD32 and just did a regular uninstall.  I did not use any removal tools.

SMTP ports are all showing as 25 in the "SSL accounts" page with encyption set to "none". 
In the "redirect settings" of Troubleshooting for mail I see the following:

SMTP: 25,587
POP: 110
IMAP: 143
Ignored addresses: <empty>
Ignore local communication: checked

[sded]

Are you able to receive/scan POP3 and IMAP mail OK?  Since Eset also does mail scanning, it is probably worthwhile to do a little more thorough uninstall than the usual add/remove programs before doing other diagnosis, since you are getting a "service not available" message when you try to use SMTP with Avast!. 
First uninstall Avast! in safe mode using the Avast! Uninstall utility at http://www.avast.com/uninstall-utility
Then from the Eset site, find their uninstaller for the particular version you were using and follow the additional uninstall instructions
Then reinstall Avast! and see if that has cured the problem

[DavidR]

Try running this to ensure all remnants are gone - ESET/NOD32 Uninstall Tool - http://kb.eset.com/esetkb/index?page=content&id=SOLN2116 Make sure you choose the correct uninstaller for your ESET product and your OS (32bit or 64bit version), right click on the link and select Save As or Save File (As depending on your browser), save it to your desktop..

[T-RHex]

I can receive email just fine over both POP3 and IMAP.

I downloaded the ESET removal tool, then boot into safe mode and ran it as instructed by ESET.
After reboot, I tried sending email again .. no luck (same error).
I did a "repair" for Avast from "Add/Remove Programs" and tried sending email again .. no luck (same error).

Do I really need to try uninstalling/reinstalling Avast? 

I recall now (late of course) that a couple months ago I had trialled Avast Pro.  Then I had just uninstalled Nod32, installed Avast, and everything worked fine.  After the trial, I uninstalled Avast and reinstalled Nod32 and everything worked fine.  There was one change since then:  for some reason, my ISP stopped accepting TLS connections over SMTP and I had to change my email client to "don't use SSL" (this was with Nod32).  So when I had trialled Avast previously (and it had worked), it was under slightly different conditions.  Of course that was a few versions of Avast ago too.

Here's an excerpt from my mail.log:

Code: [Select]

1/24/2011 7:25:58 PM 00000FD0:   Connected to SMTP server x.x.x.x 25
1/24/2011 7:25:58 PM 00000FD0:   received (S) 41
1/24/2011 7:25:58 PM 00000FD0:   <-SMTP 220 xxx yyy ESMTP server ready
1/24/2011 7:25:58 PM 00000FD0:   sent (C) 41
1/24/2011 7:25:58 PM 00000FD0:   received (C) 16
1/24/2011 7:25:58 PM 00000FD0:   ->SMTP EHLO localhost
1/24/2011 7:25:58 PM 00000FD0:   sent (S) 16
1/24/2011 7:25:58 PM 00000FD0:   received (S) 24
1/24/2011 7:25:58 PM 00000FD0:   <-SMTP 421 EHLO Helo rejected
1/24/2011 7:25:58 PM 00000FD0:   sent (C) 24
1/24/2011 7:25:58 PM 00000FD0:   connection closed (S) 0
1/24/2011 7:25:58 PM 00000FD0:   --SMTP Finishing connection handler
I did some work with SMTP years ago but using HELO.  I'm not familiar with EHLO; is EHLO (as opposed to HELO) coming from the Avast SMTP proxy?  I presume so since I can send email if I disable outgoing scans.  Could it be that my ISP doesn't support EHLO?

[sded]

One quick thing to try in case you are having a problem with the Behavior Shield.  Go to Programs and Features, select avast/change and uncheck behavior shield, reboot.  But could well be that your server doesn't accept EHLO from avast!, and is getting HELO from your mail client when you use it directly.  Then the only thing to do is turn off mail shield for SMTP until the developers can make a change to try HELO if EHLO is rejected.  Don't redirect port 25, in other words.  I will send this thread to support after you try the BeS removal.

[T-RHex]

I removed the Behavior Shield and sending returned the same error.  I reinstated the Behavior Shield.

I discovered my email client can log connection attempts.  What I found is:

• with Avast not scanning SMTP, my client sends "EHLO <machinename>" which is accepted.
• with Avast scanning SMTP, my client first tries "EHLO localhost" which is rejected, then "HELO localhost" which is ignored; my email client log reports "SMTP hello failure: 421 SMTP connection went away!", must be due to Avast closing the connection.  In the Avast log only the "EHLO localhost" shows up, not the "HELO" and the error is "SMTP 421 EHLO Helo rejected".

Could it be my email client incorrectly using "localhost" instead of <machinename>?  Or should Avast be doing that?

[sded]

I sent the thread to Avast! support as a protocol issue to see what they say.  Avast! is a transparent proxy, so should be passing along what your client says.  Does your client have some kind of proxy settings?  The connection actually goes via port 12025 of localhost to be scanned, but your client shouldn't see that intercept.  I haven't used unencrypted mail for years and have no way to test even with Thunderbird. 

[T-RHex]

Thanks for doing that sded.  I appreciate your help (and yours too, DavidR). 

I don't see any proxy settings for my email client.  I started using it before T-bird had multiple-identity support and it lacks all of T-bird's glitz. As I recall, I used it successfully when I installed Avast Pro as a trial (which I think was 5.0.677).  Unless Outpost is somehow getting in the way for the machine name resolution (under the trial I was using Online Armor).

[sded]

A number of people with unusual problems have been told to go back to build .677 pending a fix-that is another option that might help isolate the problem.  You can download it at http://filehippo.com/download_avast_antivirus/ .  If you have used the Outpost removal instructions there is not much else we can examine there.