Avast breaks mail server - wrong HELO-EHLO command

Avast Free Antivirus / Premium Security
1

Problem is complex. I’ve got hope that I’ll be able to explain it good enough to get help, but please remember that I’m not english native speaker, so if anything is unclear I’ll try to explain it better.

On a computer (Windows XP Pro) we are using Avast Pro Antivirus 6.0.1367. Avast is set to monitor ports 110, 143, 587 and 25 (we are not using it, but it has to be monitored in case that some malicious software would use this port). Mail Shield for inbound and outbound mail is on.

http://i41.tinypic.com/n5hanq.jpg

On the same computer we have application for our mail system - MailServer 5.3.3-B1879. Mail server is running on ports 110 (pop3), 143 (imap) and 587 (smtp). In SMTP settings local hostname is set to mail.mydomain.com welcome banner is set to mail.mydomain.com ESMTP. DNS, rDNS and MX record are also set to mail.mydomain.com. I belive that this settings are correct.

Unfortunately there is a problem with sending mails to some recipients. They reject our mails and mark them like spam. I was able to figure out that it happens, because our server doesn’t sent proper FQDN in HELO/EHLO. Instead of sending mail.mydomain.com (FQDN) it send only local computer name - in this case it just SB1A.

Furthermore I found out, that this is caused by Avast. When I disable mail shield in Avast or disable port 25 monitoring (doesn’t matter if port 587 monitoring is on or off) everything seems to work fine - FQDN is send in HELO/EHLO.

I could leave it like that way, but our server won’t be fully protected.

I tried to reconfigure Avast and hMailServer, but no luck. I also tried to get help on hMailServer forum (http://www.hmailserver.com/forum/viewtopic.php?f=6&t=22159), but there is nothing more that I can do with this application since it’s not it’s fault.

How can I resolve this issue without putting our server at risk by disabling port 25 monitoring?

2

If you don’t mind that mails sent be the mail server will not be scanned by avast you can configure the mail scanner to ignore connections established by the mail server program:
Open the “C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\EmailShield.ini” file in notepad and add this line under [EmailScanner]:
IgnoreProcess=MailServer.exe
(Replace MailServer.exe by the real executable name.)
And restart the ‘avast! Antivirus’ service.

3

Many thanks for this solution. It seems that everything is now fine.

Do I understand correctly:

  • Avast monitors ports 25 and 587 in case that some trojan would use it

  • Avast scans every message sent and recived on this server, when I use Outlook Express on it

  • Avast doesn’t scan any mails that go through hMailServer

If this is correct, then I can leave it this way, because hMailServer has option to run (from commandline) scan on demand - when mails arrive. I’ve checked it already and it works.

4

Yes, correct.

5

Once again thanks for your help

Best Regards.