Avast can't scan incoming POP3 mail error

If Comcast uses SSL, you need to use a solution like Stunnel for GMail.
Without it, it won’t be possible because avast mail scanner doesn’t support SSL (Secure Socket Layer) connections.
Take a look here: http://forum.avast.com/index.php?topic=10428.0 to see how to set up secure email with avast!.
Since SSL/TLS e-mail is encrypted and decrypted in the client, external virus scanners (including avast!) can’t read or scan it. The solution is to pass e-mail in and out un-encrypted from your client (Outlook Express, Thunderbird, …) to a proxy program (Stunnel) that does the actual ssl or tls encryption/decryption of the pop3/smtp e-mail and communicates directly with the ISP server on the appropriate ports. Download here: http://www.stunnel.org/download/binaries.html

If you were using MS Outlook it would be able to do that as there is a plug-in, which effectively has the avast email scanner inside Outlook.

David, I’ve used to say that but Igor teach you that legacy drivers on ControlSet00X only will be used if the user choose the ‘Last known good configuration’ and Windows will ‘clean’ the legacy drivers left behind from time to time. Of course, it would be better to not have these registry keys left behind but, like I think Igor said, they won’t mess the avast installation and good working. The problem will be if the key is under CurrentControlSet keys.

I have researched until I’m frazzled; this problem goes back to 2004 on some forums including Avast!

Avast is scanning outgoing mail and has done so from the start; it has never scanned incoming. I disabled Outlook/Exchange when I
discovered that has nothing to do with OE which is what I use. OE does not show the Avast icon anywhere or any evidence of
scanning in Send/Receive. Perhaps it is in OE that the problem lies. I’m on Comcast and I can send and receive on OE just fine but somehow I have to
fix this error as I could be getting infected mail and not know it.

I’m pretty good on a PC but I let the registry alone because I do not feel competent in that area. I don’t doubt that NIS could still be
somewhere. I’ve found folks on various lists that say they have fixed this problem but they never say how.
Donna

Thanks Tech, I didn’t look to far in the registry to get an example path, just went to the first controlset.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_xxxxxx

  1. since you are able to send and receive emails your settings I would say are correct.

  2. since outbound email is scanned and point 1 above, your firewall doesn’t appear to be blocking ashMaiSv.exe or OE.

  3. I assume that you have checked the ‘Scan inbound mail.’ You know me and assumptions, so can you confirm ?
    If that is ticked and I believe it is, we are back to this message on boot and that I feel has to be in the registry somewhere.

  4. There really isn’t much to worry about doing a search of the registry, it is just like navigating in windows explorer the layout is basically the same, so you click the little + to expand the ‘registry folder’ HKEY_LOCAL_MACHINE, then find the SYSTEM and expand using the + Now do the same with the CurrentControlSet, then the Enum and finally the Root.

Now you can scroll down and see if you can find any legacy Keys relating to Norton, Symantec, NIS, etc. don’t do anything just tell us if you found anything and what you found and we can take the next step.

Wow! Have I found some horrors! Not only Symantec traces but Tenebril Spycatcher and Trend Micro Antispyware.

I’ve made screenshots with WebCapture of the offending areas which I will label origins. How do I insert into message to you?
Donna

If you have made images (crop the bits that are relevant to reduce size) and save them on your HDD. When you post (reply) you will notice Additional Options, click that and you will see Attach:, opposite that a Browse button, from that pop-up navigate to the location you saved the image and select it and click open. That will transfer the path into the attach window, when you post, the image will be uploaded and attached to the post.

I also found a bunch of Legacy files such as SYMEVENT, SYMFW, SYMIDS, SYMIDSCO, SYMLCBRD,SYMDIS

Under Local Machine Software I found NRT (tool) Tenebril Spycatcher and Trend Micro

I did a duplicate by mistake but here are two more that look pretty bad.
Donna

OK lets deal with the LEGACY_SYMxxxxx entries first, before doing anything, you need to be logged on as a user with administrator privileges, the next thing we are going to do is export a copy of each legacy key. We are going to back-up each key (export), change its permissions and then delete the key.

  1. Right click on the first one, LEGACY_SYMDNS and select Export, choose a location (where you can find it again if required) to save it into and give it a meaningful name legacy_symdns is fine.
  2. Right click it again and select Permissions, you will see the Security Tab with two Group or User Names, Everyone and System.
  3. Highlight Everyone in the window below tick allow box opposite Full Control and click OK. This is needed so that you are able to delete this key later.
  4. Right click it (LEGACY_SYMDNS and nothing else) again, select Delete, you will get the usual Confirmation window. This will give you a means to escape if you made any mistake, click Yes to proceed.

Now you need to do that for the remainder of the LEGACY_SYMxxxx keys.

Once you have done that reboot.

All done with your wonderfully clear directions. The files are in my documents in a Legacy folder.

After reboot, I did get a FF error saying it needed to close but that just happens sometimes. The
Avast can’t scan or protect incoming e-mail did appear. I’m replying on IE this time.
Donna

I did get a FF error saying it needed to close but that just happens sometimes.
If you get any errors make a note of them, they may be of help. In that first ff needs to close pop-up there is something like a more information or details, click that and copy and paste that information.

Norton can get really embedded deep into your system and as You can see a real pig to get rid of.

OK now I would suggest doing the same with the Symantec and SymNRT folders/keys (export, permissions, delete and reboot) the sub keys will also be removed BDM, etc.

Watch out for any error messages re. avast, etc. and record, try opening firefox and see if the error is replicated.

Now I would do the same with the Tenebril folder.

Can you recall what the Trend Micro was in relation to did you have their AV installed at one point ro use their on-line scanner Housecall ?

Trend Micro was antispyware by itself; the folder (key?) appears to be empty.

I note that the Tenebril Spycatcher stuff has e-mail and phishing in the breakdown of it.

I’ll get these done ASAP. Does the registry have to be defragged if a good bit is removed? If so how?
Donna

The permissions form is different as in the attached shots. It looks as if I have to go into ADVANCED and click on Donna as admin and
this key and all subkeys. I’m afraid to take a chance without asking about what to check and click since the full control is grayed
on the first form.
Donna

If yu are logged on as Administrators (Donana\Administrators) then you should be able to delete/have full control as can be seen in the first image that has a tick in the Full Control box. In this case (image 1) you shouldn’t need the Advanced settings.

FF just had to close again when I started typing a new message. I may really have something wrong for I’ve never seen the fully updated copy that I run do this so often.

When I set up this computer I am the only user Owner_Administrator and I have not used the log in
message (I think I made it disappear) in ages. After some reading I don’t see why I need it as the
START menu says I am logged on. However that Full Control Command is not checkable although
it does say Donna Administrator at the top.

It may be that Norton’s tentacles have gone in too deep and I suppose I could cause this thing to
crash quite easily so if it’s OK with you, I think I’ll quit for the night other than just seeing if you reply
and put the heavy stuff off until tomorrow. Thanks for your patience and help. You are wonderful! Donna

All traces of Norton, Tenebril, and Trend Micro are removed except for two folders that looked empty.
FF had to close again while I was composing this post on it. Since most security programs do not fully
support it I can’t see why my registry removals would affect it.

That’s the good news. The Avast! mail warning is still present on bootup and is inthe Task Mgr. at the
same time. AshWebSv.exe asks to be allowed on Commodo to act as server at the same time.

I’ve checked the web for possible problems with FF 2.0.0.3. No record of excessive closings. Don’t suppose I could have a virus or other invader. So far IE has not closed though it used to have that problem occasionally. I had no warnings while doing the registry removals.
Is it uninstall time for Avast! and re-install? Configuration check! What?
Donna

Firefox shouldn’t have any issues with security applications as it is a fairly standards compliant browser. It may not be entirely Firefox’s fault, it could be using another module and that is at fault. That is why I suggested clicking the more information, etc. to see more information about the reason.

I’m still using 2.0.0.2, will be updating later today, but it may be better to download the complete latest version of firefox and save it so you can find it later, uninstall the current installation and reboot, then install the latest version. Something else you could try is to run firefox from the Safe Mode link in, Start, All Programs, Mozilla Firefox. This starts firefox without extensions, if you have no problems then it might just be a troublesome extension and that may be pointed out in the ‘more information’ I spoke about.

I’m probably more baffled than you as to why this can’t protect email is displayed on boot, I have exhausted the major reasons this may occur.

I believe you said you have tried the avast reinstall before, what I would suggest is you download the avast! Uninstall Utility, find it here and save it to your HDD so you can find it later. Now uninstall using add remove programs, reboot, run the uninstall utility, reboot and install.

David,
Thanks so much for all your help and I will try the re-install.

If I were you I’d stay right where you are on FF. After more research, 2.0.0.3 is crashing frequently and in truth no one knows why.
On my U3 flash drive I have 1.0.5.11. I just got through surfing on it for an hour or so–NO PROBLEMS at all. The info I found says
it is in the version (shades of IE!). Thankfully all I had to do was upload my bookmarks and my portable surfs beautifully until they
find a fix.

I really like Avast and want to stay with it so I will go through the rigamarole involved. If it still won’t protect the mail then I’ll have to
find another program I guess.
Donna

Well I have just updated to firefox 2.0.0.3 so we will see ;D
That is why it is important to gather as much information when it does crash or have to be closed.

I use MailWasher Pro, primarily for anti-spam and I run mailwasher first, it checks a small part of the email X number of lines (user configurable) and it views that in text mode to make a decision on spam and doesn’t download the attachments. It has a knock on benefit that you can also see the suspicious emails and flag them for deletion, when you click Process Mail, it deletes all those flagged for deletion at ‘the email server’ (you don’t have to even download them) and then calls your email program where you download the remainder of the emails.

There is a free version of mailwasher but that only covers one email account (address) were the pro version covers unlimited email accounts.