Author Topic: Whitelist for *antivirus scanning* incoming email?  (Read 5089 times)

0 Members and 1 Guest are viewing this topic.

Offline swashbuckle

  • Newbie
  • *
  • Posts: 6
Whitelist for *antivirus scanning* incoming email?
« on: February 24, 2011, 04:24:48 PM »
One of my users *always* gets an alert from avast! when receiving any sort of email from one specific address. No one else gets an alert from this address's emails, and none of the supposedly infected attachments trigger anything on any other computer with any other antivirus. Is there a way to add this address to a whitelist for *scanning*? I see the option for spam but that doesn't seem to be at issue here (and didn't seem to have any effect).

Offline Milos

  • Avast team
  • Super Poster
  • *
  • Posts: 2250
Re: Whitelist for *antivirus scanning* incoming email?
« Reply #1 on: February 24, 2011, 05:09:13 PM »
Hello,
send us (virus@avast.com) the attachement on which is avast! alerting to analyze. Put "False positive" to email subject.

Thank you,
Milos

Offline swashbuckle

  • Newbie
  • *
  • Posts: 6
Re: Whitelist for *antivirus scanning* incoming email?
« Reply #2 on: February 24, 2011, 11:35:56 PM »
Thanks. I sent the attachment about six hours ago. Can I expect some sort of followup in the next few days, either here or by email?

Offline swashbuckle

  • Newbie
  • *
  • Posts: 6
Re: Whitelist for *antivirus scanning* incoming email?
« Reply #3 on: April 15, 2011, 12:16:56 AM »
It's been about a month and a half and I haven't heard back yet. Client is still having issues.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11808
    • AVAST Software
Re: Whitelist for *antivirus scanning* incoming email?
« Reply #4 on: April 15, 2011, 12:37:48 PM »
What exactly does the alert say?
Also, what version of avast! are we talking about?

Offline swashbuckle

  • Newbie
  • *
  • Posts: 6
Re: Whitelist for *antivirus scanning* incoming email?
« Reply #5 on: April 25, 2011, 08:35:08 PM »
The alert says "Suspicious subject of message" and the subject is "PURCHASE_ORDER_<8 digit number>". This particular email was forwarded to multiple people and only this one user's Avast! raised an alert. The version is either 4.8 or 5, I can check and reply back.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 72963
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Whitelist for *antivirus scanning* incoming email?
« Reply #6 on: April 25, 2011, 09:58:26 PM »
The alert says "Suspicious subject of message" and the subject is "PURCHASE_ORDER_<8 digit number>". This particular email was forwarded to multiple people and only this one user's Avast! raised an alert. The version is either 4.8 or 5, I can check and reply back.

Latest avast! version is 6.0.1091.
Tell them to update their avast (if possible)..!
And see, if the problem is solved.
asyn
Win 8.1 [x64] - Avast PremSec 21.11.6787.IBC [UI.683] - EEK - Firefox ESR 91.4 [NS/uBO/PB] - TB 91.4
Avast-Tools: Secure Browser 96.0 - Cleanup 21.4 - SecureLine 5.14 - Driver Updater 21.4 - CCleaner 5.87
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11808
    • AVAST Software
Re: Whitelist for *antivirus scanning* incoming email?
« Reply #7 on: April 25, 2011, 10:38:58 PM »
If the message says "suspicious something", it's not an ordinary detection, but rather the e-mail heuristics.
Doesn't the particular computer have a different setting of Mail Shield / Mail heuristics?

Offline swashbuckle

  • Newbie
  • *
  • Posts: 6
Re: Whitelist for *antivirus scanning* incoming email?
« Reply #8 on: April 26, 2011, 12:51:57 AM »
Latest avast! version is 6.0.1091.
Tell them to update their avast (if possible)..!
And see, if the problem is solved.
asyn

http://www.avast.com/business

It looks like 4.8 is still being sold as the appropriate business edition. Or is Avast! selling licenses to 4.8 and then advising to upgrade to 6? That seems a bit odd.


If the message says "suspicious something", it's not an ordinary detection, but rather the e-mail heuristics.
Doesn't the particular computer have a different setting of Mail Shield / Mail heuristics?

Unless something popped up that the user accidentally clicked (for instance, "mark this email as spam?"), no settings have been changed. On the systems that I deal with regularly that run Avast! I never see such prompts.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 72963
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Whitelist for *antivirus scanning* incoming email?
« Reply #9 on: April 26, 2011, 09:17:59 AM »
It looks like 4.8 is still being sold as the appropriate business edition. Or is Avast! selling licenses to 4.8 and then advising to upgrade to 6? That seems a bit odd.

Well, didn't know you were talking about business edition, as you posted this in the Free/Pro/Suite section of the forum. You're right about version 4.8 for business edition.
asyn
Win 8.1 [x64] - Avast PremSec 21.11.6787.IBC [UI.683] - EEK - Firefox ESR 91.4 [NS/uBO/PB] - TB 91.4
Avast-Tools: Secure Browser 96.0 - Cleanup 21.4 - SecureLine 5.14 - Driver Updater 21.4 - CCleaner 5.87
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline logos

  • Avast Überevangelist
  • Serious Graphoman
  • *****
  • Posts: 9441
Re: Whitelist for *antivirus scanning* incoming email?
« Reply #10 on: April 26, 2011, 09:30:52 AM »
The alert says "Suspicious subject of message" and the subject is "PURCHASE_ORDER_<8 digit number>". This particular email was forwarded to multiple people and only this one user's Avast! raised an alert. The version is either 4.8 or 5, I can check and reply back.

 with such a topic (okay it may be legit) and the fact that the mail is being forwarded to multiple recipient I'm not surprised that Avast sends an alert. Anyway would be nice if the Avast guy who asked you to send him the attachment (if any) would post back here.
w7 - ais7

Offline swashbuckle

  • Newbie
  • *
  • Posts: 6
Re: Whitelist for *antivirus scanning* incoming email?
« Reply #11 on: April 26, 2011, 07:06:08 PM »
Well, didn't know you were talking about business edition, as you posted this in the Free/Pro/Suite section of the forum. You're right about version 4.8 for business edition.
asyn

Oh, my apologies. I find the versioning a bit confusing, should have looked more closely. Our support directory contained "setupengpro4.8.exe" (v4.8.1368.0) and "setup_av_pro.exe" (v5.0.594.0) and I had assumed the latter was simply an upgrade to the former, not that they were entirely separate product lines. So given that, I'm not really sure which version they're running (with regards to the business edition).


with such a topic (okay it may be legit) and the fact that the mail is being forwarded to multiple recipient I'm not surprised that Avast sends an alert. Anyway would be nice if the Avast guy who asked you to send him the attachment (if any) would post back here.

Agreed. I sent it to virus@avast.com as requested by Milos above.
« Last Edit: April 26, 2011, 07:07:46 PM by swashbuckle »