Avast and localhost port 110 email

[alanrf]

I have recently installed Avast 4.5 Home edition.  I have conducted a number of tests of the email scanning function on my system (XP Pro SP2) using my mail client Thunderbird (1.0).

All tests of "standard" POP3 mail where I specify the "name" of the mail server (eg mail.comcast.net) with the default port 110 shows that Avast is scanning the email during download.  I get warnings on deliberately infected messages (eg EICAR virus) and, having turned on the "add scan text", I see the added text that the messages have been scanned by Avast appended to those email messages.

I have also conducted tests using various opensource functions that provide POP3 equivalence of downloading mail from webserver mail functions (such as Yahoo and Hotmail).    

These opensource functions use the mail "source" as "localhost" and either default to port 110 or allow that port to be selected.  

I have tested with the following opensource offerings:

YahooPops
FreePops
MrPostman

in each case accepting the default of port 110 or adjusting the product to use port 110 (via their standard interfaces).

For each of these opensource products my email is successfully downloaded by the Thunderbird client.  However it is clear that for all of these "localhost port 110" sources that the email is NOT being scanned by Avast.  All infected messages (EICAR) get through without objection and none of the messages have the appended scanned text of Avast.  

Has anyone else experienced or heard of such a condition or does anyone have any pointers on how to further identify the cause of the problem?

[Lisandro]

I have also conducted tests using various opensource functions that provide POP3 equivalence of downloading mail from webserver mail functions (such as Yahoo and Hotmail).

Hotmail/Yahoo is not a pop3 email service (unless you pay for pop service), it is web based (so the Internet Mail provider doesn't directly protect it). Web based email is simply your email being viewed in the same way you browser the internet. The pages (that display your email) are downloaded into your Temporary Internet folder, just like regular web pages and displayed on your browser screen.

The Standard Shield will scan your files (as they are downloaded into your Temporary Internet folder) when sensitivity is set to High. You can round this 'problem' using 3rd party applications to download the Hotmail messages through the pop3 server (PopHotmail, for instance).

In each case accepting the default of port 110 or adjusting the product to use port 110 (via their standard interfaces). For each of these opensource products my email is successfully downloaded by the Thunderbird client.  However it is clear that for all of these "localhost port 110" sources that the email is NOT being scanned by Avast.  All infected messages (EICAR) get through without objection and none of the messages have the appended scanned text of Avast.

Can you check your avast4.ini file against the explanations on 'Settings' in my signature?
See section [MailScanner], problably values:
PopListen=127.0.0.1:110
AutoSetProtection=1
AutoRedirect=1

[alanrf]

Technical, I do not wish to appear ungrateful for your reply but it was not very helpful.  You have sent to me as to others in this forum your canned message about Yahoo and Hotmail not being POP3 mail servers.  You then refer to "HotPopmail" which only (as far as Google searches go) leads to a pornographic website.  

I think my original posting was very clear that I know that Yahoo and Hotmail require the use of a third party application to provide the mail client with POP access to Yahoo or Hotmail.  That is why I specified three of those applications that I have tested with (YahooPops, FreePops and MrPostman).  These are very similar in function to Poppeeper and Hotmailpopper that are referenced in other current threads in this forum that also seem to be going nowhere.

Avast! 4.5 says very clearly that "no special setup" is required for scanning POP email.  It seems that a number of us (Andyslogos for example) are using our email clients set to read POP3 mail where the mail server is localhost and the port is 110. The mail client is very successfully reading that POP3 mail but Avast! is NOT scanning this mail for us.  

I would appreciate knowing if anyone has successfully used Avast! 4.5 to scan email being received via localhost and port 110.  

Any guidance on how to further investigate or alleviate the problem would be most welcome too.

[Lisandro]

You then refer to "HotPopmail" which only (as far as Google searches go) leads to a pornographic website.

 

PopHotmail and not HotPopmail  

Avast! 4.5 says very clearly that "no special setup" is required for scanning POP email.  It seems that a number of us (Andyslogos for example) are using our email clients set to read POP3 mail where the mail server is localhost and the port is 110. The mail client is very successfully reading that POP3 mail but Avast! is NOT scanning this mail for us.  

I would appreciate knowing if anyone has successfully used Avast! 4.5 to scan email being received via localhost and port 110.  

Any guidance on how to further investigate or alleviate the problem would be most welcome too.

Sorry, I can't help you more as you can see...  
I think that this is by design.
In 4.1 worked this way: mail server > spam killer or email popup > avast > mail client
In 4.5, on contrary, this way: mail server > avast > spam killer or email popup > mail client

So, I don't know why avast is not scanning your email.

[alanrf]

Technical, thanks for your response.  

In other threads here I found a couple of clues.

In one thread it said that Avast! 4.5 ignores request to localhost ports.  All of the third party apps to provide POP3 mail from Yahoo/Hotmail etc. require that the mail client use localhost to activate the application.  

In another thread it was suggested to add to the mailscanner section of the avast4.ini file the parameter IgnoreLocalhost=0.  

I added this line to the ini file and tried again with the FreePops application.

This time my Yahoo mail was read in and scanned by Avast!  It detected the EICAR test virus and appended the "scanned and clean" text appropriately to all the messages.  

The only problem was that downloading terminated before all the messages had been read.  A subsequent attempt downloaded the rest.  So that is the next issue for me to investigate but at least it appears to be some progress.

[Lisandro]

In another thread it was suggested to add to the mailscanner section of the avast4.ini file the parameter IgnoreLocalhost=0

Could it be AutoRedirect=0?
See [MailScanner] section at avast4.ini file ('Settings' on my signature).
I never heard about IgnoreLocahHost value    

The only problem was that downloading terminated before all the messages had been read.  A subsequent attempt downloaded the rest.  So that is the next issue for me to investigate but at least it appears to be some progress.

Did you try changing the timeouts (both on avast and on your email client)?
Are the remaining emails that big to timeout?

[alanrf]

Technical it is strange that you never heard of the IgnoreLocalhost value since you referenced it yourself in a post on December 16.  

I slightly increased the timeout value on my mail client and downloaded all 25 messages in my Yahoo mailbox again without any problem. The  test EICAR ivirus was detected by Avast! and all messages had appropriate "scanned text" appended.

As to the timeout issue - the application that reads the Yahoo mail has to make http transactions to Yahoo to get the raw mail messages and turn them into POP3 messages before they then are held up a little by Avast! to scan them before they finally get back to the mail client.   You probably know that web accesses to Yahoo & Hotmail can subtimes be subject to delays.    

[alanrf]

Technical, just to refresh your memory a little further.  You discussed exactly the fix I have discovered today with Vlk on November 13.  

Vlk recommended precisely this fix under the title "Avast 4.5 and POP3 webmail proxies".   You went on to ask him about Autoredirect and no answer appears in the thread.  

 

[alanrf]

Just one more comment.

It is somewhat misleading for Avast! to claim that with 4.5 no setup is needed for scanning POP3 mail when, by default, it excludes POP3 mail delivered by webmail proxies.  A clear disclaimer should be included.  Better yet it should be possible to include localhost scanning via the gui as an advanced option.

Finally my thanks to Technical for taking the time to respond to my posts - I appreciate it.

[Lisandro]

Technical it is strange that you never heard of the IgnoreLocalhost value since you referenced it yourself in a post on December 16.

 

Technical, just to refresh your memory a little further.  You discussed exactly the fix I have discovered today with Vlk on November 13.  
Vlk recommended precisely this fix under the title "Avast 4.5 and POP3 webmail proxies". You went on to ask him about Autoredirect and no answer appears in the thread.

So, I remember... I'll change my avast4.ini file.
Anyway, as you can see, I get no answer about it from Alwil

I slightly increased the timeout value on my mail client and downloaded all 25 messages in my Yahoo mailbox again without any problem. The  test EICAR ivirus was detected by Avast! and all messages had appropriate "scanned text" appended.

As to the timeout issue - the application that reads the Yahoo mail has to make http transactions to Yahoo to get the raw mail messages and turn them into POP3 messages before they then are held up a little by Avast! to scan them before they finally get back to the mail client. You probably know that web accesses to Yahoo & Hotmail can subtimes be subject to delays.    

In earlier avast versions mail were routed through the localhost (127.0.0.1) and this would pass through very quickly and/or possibly form a buffer that masked any timeout settings. So, I thought you won't have them but, in fact, you got  :'(