Avast Free and scanning email attachments

Avast Free Antivirus / Premium Security
1

Hi there Avast community

My issue is with Avast not finding viruses or malware in it’s scanning of email attachments.

I have Windows 10 x64, Avast Free Edition 2015 10.4.2233 and use Outlook 2013 with IMAP email.

I also have a 2nd PC with the same setup but the only difference is it’s Windows 7 x64 and ESET Nod AntiVirus.

The Avast free edition doesn’t seem to pick up any of the malware or viruses in my Junk folder in Outlook whereas ESET does find them?

Perhaps I have not got it setup correctly?

I have the Mail Shield enabled scanning inbound and outbound email, with SSL Scanning enabled also. Could it be the way mail certificates are handled in Avast? They are self-signed so perhaps this is the stumbling block for Avast.

Any guidance would be appreciated.

2

You don’t have latest avast version…

What does ESET detect … Malware name?

You may post eset scan log

3

Hi there

I’m not at the desktop computer with ESET installed as yet - maybe tomorrow.

I’ve now updated Avast Free to 2016 version today and rebooted my laptop with it.

I’ve checked the troubleshooting menu and it is set to scan 587 SMTP and 993 IMAP ports as it should.

ESET is set to scan mail on those ports too and scan my mailbox. When I open the Junk folder with ESET where all the emails are with word or excel attachments. ESET then labels them as ‘Trojan Downloader’ etc.

I believe Avast used to do this but I haven’t seen it happen in ‘a while’. (Maybe over a month.)

I will see how the next 24 hours go with the new version and report back.

4

remember, no AV have 100% detection or zero false positive, so if this is a new malware it may not be detected by avast or it can be a false positive from ESET

you may upload and test those mail attachments here www.virustotal.com if scanned before, click rescan for a fresh result
post link to scan result(s) here

5

Hi Pondus

On the Avast laptop…

Perhaps a mistake on my part also - just realised that I have ‘Silent / Gaming Mode’ switched ON therefore I would not be notified ? I have now un-ticked.

Also just checked my ‘Virus Chest’ - the last 'Other:Malware-gen-[Trj] was found Dec-16th. Nothing since that date.

6

Hi Pondus

ESET appears to clean all the infected files as when I submit them they all appear to be ok on the virus total website.

Here is the ESET log with my work email addresses removed. Note the dates on the left-hand side as how often I have received them recently.

13/01/2016 09:38:32 Email filter - Outlook email message from: Johnathon Cantrell to: ****************************************** with subject SPAMLattitude Global Volunteering - Invoice - 2E7314 VBA/TrojanDownloader.Agent.AOH trojan contained infected files PCNAMEHERE
13/01/2016 09:38:30 Email filter - Outlook email message from: Corinne Young to: ****************************************** with subject SPAMSales Invoice SIN040281. From Charbonnel et Walker Limited VBA/TrojanDownloader.Agent.AOJ trojan contained infected files PCNAMEHERE
13/01/2016 09:38:29 Email filter - Outlook email message from: Corinne Young to: ***************************************** with subject SPAMSales Invoice SIN040281. From Charbonnel et Walker Limited VBA/TrojanDownloader.Agent.AOJ trojan contained infected files PCNAMEHERE
11/01/2016 16:16:06 Email filter - Outlook email message from: Leslie Faulkner to: ****************************************** with subject SPAMInvoice from DSV 389B1EDF , ARIA (U K) LTD, 05055543, Customer ref: ALEX MUNRO, SE/GB VBA/TrojanDownloader.Agent.AOE trojan contained infected files PCNAMEHERE
11/01/2016 16:16:05 Email filter - Outlook email message from: Dana Burt to: ****************************************** with subject SPAMKaseya Invoice - 2165741F VBA/TrojanDownloader.Agent.AOE trojan contained infected files PCNAMEHERE
11/01/2016 16:16:04 Email filter - Outlook email message from: PC World to: ***************************************** with subject SPAMWe are processing your PC WORLD order (PCW1521248708) VBA/TrojanDropper.Agent.ES trojan contained infected files PCNAMEHERE
11/01/2016 16:16:03 Email filter - Outlook email message from: PC World to: ****************************************** with subject SPAMWe are processing your PC WORLD order (PCW1521248708) VBA/TrojanDropper.Agent.ES trojan contained infected files PCNAMEHERE
11/01/2016 16:16:02 Email filter - Outlook email message from: Yvette Suarez to: ****************************************** with subject SPAM:Invoice No 39830 from CHEVRON ALARMS LTD A/C LA FEFED3E4 VBA/TrojanDownloader.Agent.AOE trojan contained infected files PCNAMEHERE
11/01/2016 16:16:01 Email filter - Outlook email message from: Francisca Padilla to: ****************************************** with subject SPAM:Invoice No 39830 from CHEVRON ALARMS LTD A/C LA C879398D VBA/TrojanDownloader.Agent.AOE trojan contained infected files PCNAMEHERE
11/01/2016 16:16:00 Email filter - Outlook email message from: PC World to: ****************************************** with subject SPAMWe are processing your PC WORLD order (PCW1521248708) VBA/TrojanDropper.Agent.ES trojan contained infected files PCNAMEHERE
11/01/2016 13:32:58 Email filter - Outlook email message from: Garret Allen to: ****************************************** with subject SPAM:Invoice-205611-35722702-CROSSHILL SF VBA/TrojanDownloader.Agent.ANR trojan contained infected files PCNAMEHERE
11/01/2016 13:32:57 Email filter - Outlook email message from: Willa Wilkerson to: ****************************************** with subject SPAMYour Latest Documents from Angel Springs Ltd [32D5A0D6] VBA/TrojanDownloader.Agent.ANT trojan contained infected files PCNAMEHERE
11/01/2016 13:32:55 Email filter - Outlook email message from: Christoper Franco to: ****************************************** with subject SPAMInvoice 04062438 19/12 ?4024.80 VBA/TrojanDownloader.Agent.ANT trojan contained infected files PCNAMEHERE
11/01/2016 13:32:54 Email filter - Outlook email message from: Dane Barber to: ****************************************** with subject SPAMInvoice 12269907 19/12 ?4024.80 VBA/TrojanDownloader.Agent.ANT trojan contained infected files PCNAMEHERE
11/01/2016 13:32:52 Email filter - Outlook email message from: Joseph Freeman to: ****************************************** with subject SPAMInvoice 57872267 19/12 ?4024.80 VBA/TrojanDownloader.Agent.ANT trojan contained infected files PCNAMEHERE
11/01/2016 13:32:51 Email filter - Outlook email message from: Gabrielle Benjamin to: ****************************************** with subject SPAMClose Invoice Finance Limited Statement 1/1 VBA/TrojanDownloader.Agent.ANT trojan contained infected files PCNAMEHERE
11/01/2016 13:32:47 Email filter - Outlook email message from: UKFast Accounts to: ***************************************** with subject SPAMYour latest invoice from UKFast No.1228407 VBA/TrojanDownloader.Agent.AOC trojan contained infected files PCNAMEHERE
11/01/2016 13:32:46 Email filter - Outlook email message from: UKFast Accounts to: ****************************************** with subject SPAMYour latest invoice from UKFast No.1228407 VBA/TrojanDownloader.Agent.AOC trojan contained infected files PCNAMEHERE
11/01/2016 13:32:44 Email filter - Outlook email message from: Andrew Williams to: ***************************************** with subject SPAME-Service (Europe) Ltd Invoice No: 10013405 VBA/TrojanDownloader.Agent.AOC trojan contained infected files PCNAMEHERE
11/01/2016 13:32:30 Email filter - Outlook email message from: Andrew Williams to: ****************************************** with subject SPAM:E-Service (Europe) Ltd Invoice No: 10013405 VBA/TrojanDownloader.Agent.AOC trojan contained infected files PCNAMEHERE
11/01/2016 13:32:28 Email filter - Outlook email message from: Andrew Williams to: ****************************************** with subject SPAME-Service (Europe) Ltd Invoice No: 10013405 VBA/TrojanDownloader.Agent.AOC trojan contained infected files PCNAMEHERE
21/12/2015 10:52:50 Email filter - Outlook email message from: Melissa O’Neill to: ****************************************** with subject SPAMScan as requested VBA/TrojanDownloader.Agent.AJW trojan contained infected files PCNAMEHERE
21/12/2015 10:52:49 Email filter - Outlook email message from: orders@abcam.com to: ****************************************** with subject SPAMAbcam Despatch [CCE5303255] VBA/TrojanDownloader.Agent.AJW trojan contained infected files PCNAMEHERE
21/12/2015 10:52:44 Email filter - Outlook email message from: Lucie Newlove to: ****************************************** with subject SPAM Invoice Document SI528880 VBA/TrojanDownloader.Agent.AJZ trojan contained infected files PCNAMEHERE
21/12/2015 10:52:43 Email filter - Outlook email message from: Reception at Winthrop Village Dental Centre to: ****************************************** with subject SPAMpayment receipt VBA/TrojanDownloader.Agent.AJZ trojan contained infected files PCNAMEHERE
21/12/2015 10:52:42 Email filter - Outlook email message from: Ivan Jarman to: ****************************************** with subject SPAMInvoice VBA/TrojanDownloader.Agent.AKB trojan contained infected files PCNAMEHERE
21/12/2015 10:52:33 Email filter - Outlook email message from: scan************************************* to: ****************************************** with subject Message from mibser_00919013013 VBA/TrojanDownloader.Agent.AKN trojan contained infected files PCNAMEHERE
21/12/2015 10:52:18 Email filter - Outlook email message from: Industrial Cleaning Materials (ICM) to: ****************************************** with subject SPAMICM - Invoice #2393 VBA/TrojanDownloader.Agent.ALE trojan contained infected files PCNAMEHERE
21/12/2015 10:52:10 Email filter - Outlook email message from: Kerry Richardson to: ***** with subject SPAMInvoice #CS-15277043 JS/TrojanDownloader.Nemucod.CF trojan contained infected files PCNAMEHERE
21/12/2015 10:51:45 Email filter - Outlook email message from: Sharon Samuels to: ‘******************************************’ with subject SPAMInvoice No. 317026 VBA/TrojanDownloader.Agent.AMP trojan contained infected files PCNAMEHERE
21/12/2015 10:51:44 Email filter - Outlook email message from: Susan Franklin to: ***** with subject SPAMYour account has a debt and is past due JS/Kryptik.AYQ trojan contained infected files PCNAMEHERE
15/12/2015 17:25:14 Email filter - Outlook email message from: Annmarie Griffin to: ***** with subject SPAMInvoice Attached VBA/TrojanDownloader.Agent.AMM trojan contained infected files PCNAMEHERE
10/12/2015 09:59:56 Email filter - Outlook email message from: Kathleen Cleveland to: ***** with subject SPAMYour order #65690832 - Corresponding Invoice #C905B5D0 JS/TrojanDownloader.Nemucod.CI trojan contained infected files PCNAMEHERE
19/10/2015 13:05:49 Email filter - Outlook email message from: Ray White to: ****************************************** with subject [Scan] 2015-10-14 5:29:54 p.m. VBA/TrojanDownloader.Agent.AEU trojan contained infected files PCNAMEHERE
19/10/2015 12:58:15 Email filter - Outlook email message from: customerservices@ocado.com to: ****************************************** with subject SPAMYour receipt for today’s Ocado delivery VBA/TrojanDownloader.Agent.AEU trojan contained infected files PCNAMEHERE

So not sure what else to try for Avast to pick them up - it has missed all of the above!

7

Here is my AVAST Free log - note it hasn’t found much!

Avast did tell me that it found malware today that I had downloaded manually (a Word doc) from one of the dodgy emails to my desktop a couple of days ago - and the File System Shield found it - just not via the email scanning!

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Saturday, August 01, 2015 1:57:28 PM

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Saturday, August 01, 2015 2:24:59 PM

02/08/2015 11:35:37 Incoming email 'SPAM:UPS information ’ From: “florian”, To: <*****************************>|>Bill_number_0207522695.doc#3716973861 [L] VBA:Downloader-JB [Trj] (0)
File was successfully moved to chest…

  • Shield stopped: Sunday, August 02, 2015 10:05:33 PM

  • Run-time was 1 day(s), 7 hour(s), 40 minute(s), 40 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Monday, August 03, 2015 8:57:57 AM

  • Shield stopped: Tuesday, August 04, 2015 11:37:53 PM

  • Run-time was 1 day(s), 14 hour(s), 39 minute(s), 39 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Wednesday, August 05, 2015 9:14:02 AM

  • Shield stopped: Wednesday, August 05, 2015 7:57:07 PM

  • Run-time was 10 hour(s), 43 minute(s), 43 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Wednesday, August 5, 2015 8:12:09 PM

  • Shield stopped: Monday, August 10, 2015 10:02:10 PM

  • Run-time was 5 day(s), 1 hour(s), 50 minute(s), 50 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Monday, August 10, 2015 10:02:34 PM

  • Shield stopped: 30 August 2015 19:53:30

  • Run-time was 19 day(s), 21 hour(s), 50 minute(s), 50 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Sunday, August 30, 2015 8:50:10 PM

  • Shield stopped: Monday, August 31, 2015 10:07:08 AM

  • Run-time was 13 hour(s), 16 minute(s), 16 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Monday, August 31, 2015 10:53:28 AM

  • Shield stopped: Monday, August 31, 2015 10:55:02 AM

  • Run-time was 1 minute(s), 1 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Monday, August 31, 2015 10:55:23 AM

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Monday, August 31, 2015 11:13:38 AM

  • Shield stopped: Friday, September 4, 2015 1:00:34 PM

  • Run-time was 4 day(s), 1 hour(s), 46 minute(s), 46 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Friday, September 4, 2015 1:00:58 PM

  • Shield stopped: 04 September 2015 14:02:21

  • Run-time was 1 hour(s), 1 minute(s), 1 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Friday, September 4, 2015 2:02:37 PM

  • Shield stopped: Thursday, September 10, 2015 12:30:28 PM

  • Run-time was 5 day(s), 22 hour(s), 27 minute(s), 27 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Thursday, September 10, 2015 12:30:54 PM

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Sunday, September 13, 2015 3:44:19 PM

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Wednesday, September 16, 2015 12:38:22 PM

  • Shield stopped: 05 October 2015 03:31:00

  • Run-time was 18 day(s), 14 hour(s), 52 minute(s), 52 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Monday, October 5, 2015 3:31:26 AM

  • Shield stopped: Monday, October 12, 2015 10:46:22 AM

  • Run-time was 7 day(s), 7 hour(s), 14 minute(s), 14 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Monday, October 12, 2015 10:46:45 AM

  • Shield stopped: 22 October 2015 09:45:47

  • Run-time was 9 day(s), 22 hour(s), 59 minute(s), 59 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Thursday, October 22, 2015 9:46:13 AM

  • Shield stopped: Thursday, October 22, 2015 5:21:26 PM

  • Run-time was 7 hour(s), 35 minute(s), 35 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Thursday, October 22, 2015 5:21:45 PM

25/10/2015 14:31:23 Incoming email ‘SPAMcleaning invoice’ From: “deborah Sherer” thesherers@westnet.co.uk, To: "''" <>|>Cleaning022958.doc#3753756751 [L] Other:Malware-gen [Trj] (0)
File was successfully moved to chest…
27/10/2015 10:12:43 Incoming email ‘SPAMcleaning invoice’ From: “deborah Sherer” thesherers@westnet.co.uk, To: <*****************************>|>Cleaning022958.doc#2245333712 [L] Other:Malware-gen [Trj] (0)
File was successfully moved to chest…

  • Shield stopped: Tuesday, November 3, 2015 7:46:02 PM

  • Run-time was 12 day(s), 3 hour(s), 24 minute(s), 24 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Tuesday, November 3, 2015 7:46:27 PM

  • Shield stopped: Friday, November 13, 2015 10:41:53 AM

  • Run-time was 9 day(s), 14 hour(s), 55 minute(s), 55 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Friday, November 13, 2015 10:42:20 AM

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Friday, November 13, 2015 1:13:35 PM

  • Shield stopped: 13 November 2015 13:21:00

  • Run-time was 7 minute(s), 7 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Friday, November 13, 2015 1:35:56 PM

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Tuesday, November 17, 2015 3:28:21 PM

  • Shield stopped: Friday, November 20, 2015 10:01:11 AM

  • Run-time was 2 day(s), 18 hour(s), 32 minute(s), 32 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Friday, November 20, 2015 10:01:35 AM

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Friday, November 20, 2015 3:47:54 PM

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Saturday, November 21, 2015 5:33:23 PM

24/11/2015 11:50:38 Incoming email ‘SPAMScan as requested’ From: “Melissa O’Neill” adminoldbury@newhopecare.co.uk, To: <*****************************>|>20151009144829748.doc#3314553797 [L] Other:Malware-gen [Trj] (0)
File was successfully moved to chest…

  • Shield stopped: Wednesday, November 25, 2015 4:49:21 PM

  • Run-time was 3 day(s), 23 hour(s), 15 minute(s), 15 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Wednesday, November 25, 2015 7:34:58 PM

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Thursday, November 26, 2015 8:16:48 AM

  • Shield stopped: Thursday, November 26, 2015 8:19:32 AM

  • Run-time was 2 minute(s), 2 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Thursday, November 26, 2015 9:46:00 AM

26/11/2015 11:34:34 Incoming email ‘SPAM Invoice Document SI528880’ From: Lucie Newlove lucie@hiderfoods.co.uk, To: ""<>|>SI528880.xls#2477533601 [L] Other:Malware-gen [Trj] (0)
File was successfully moved to chest…
26/11/2015 13:05:32 Incoming email ‘SPAMpayment receipt’ From: “Reception at Winthrop Village Dental Centre” reception@winthropvillagedental.co.uk, To: <*****************************>|>CCE19102015.doc#572128651 [L] Other:Malware-gen [Trj] (0)
File was successfully moved to chest…

  • Shield stopped: Thursday, November 26, 2015 11:10:57 PM

  • Run-time was 13 hour(s), 24 minute(s), 24 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Friday, November 27, 2015 9:47:15 AM

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Monday, November 30, 2015 10:01:28 AM

  • Shield stopped: Tuesday, December 1, 2015 10:54:07 PM

  • Run-time was 1 day(s), 12 hour(s), 52 minute(s), 52 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Wednesday, December 2, 2015 8:16:15 AM

  • Shield stopped: Wednesday, December 2, 2015 8:19:14 AM

  • Run-time was 2 minute(s), 2 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Wednesday, December 2, 2015 7:53:38 PM

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Friday, December 4, 2015 11:13:58 AM

  • Shield stopped: Friday, December 4, 2015 4:36:16 PM

  • Run-time was 5 hour(s), 22 minute(s), 22 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Tuesday, December 8, 2015 1:57:26 PM

08/12/2015 14:20:50 Incoming email ‘SPAM:Transglobal Express - Shipping Documentation (TG-1569311)’ From: sales@transglobalexpress.co.uk, To: <*****************************>|>1569311-1Z2X12A50495162278.doc#3458717885 [L] Other:Malware-gen [Trj] (0)
File was successfully moved to chest…

  • Shield stopped: Tuesday, December 8, 2015 2:31:28 PM

  • Run-time was 34 minute(s), 34 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Tuesday, December 8, 2015 2:31:47 PM

  • Shield stopped: Friday, December 11, 2015 4:38:23 PM

  • Run-time was 3 day(s), 2 hour(s), 6 minute(s), 6 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Friday, December 11, 2015 4:38:50 PM

16/12/2015 21:41:23 Incoming email ‘SPAMInvoice No. 317026’ From: “Sharon Samuels” sharons393@brunel-promotions.co.uk, To: "''" <>|>IN317026.xls#2859944301 [L] Other:Malware-gen [Trj] (0)
File was successfully moved to chest…

  • Shield stopped: Tuesday, December 22, 2015 10:39:39 AM

  • Run-time was 10 day(s), 18 hour(s), 0 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Friday, January 1, 2016 2:34:10 PM

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Tuesday, January 12, 2016 12:51:53 PM

  • Shield stopped: 15 January 2016 01:11:32

  • Run-time was 2 day(s), 12 hour(s), 19 minute(s), 19 second(s)

  • Avast Real-time Shield Scan Report

  • This file is generated automatically

  • Started on: Friday, January 15, 2016 1:11:51 AM

8

Please attach your log files. Do not copy and paste. :slight_smile:

9
So not sure what else to try for Avast to pick them up -[b] it has missed all of the above![/b]
If so you sould be able to upload attachments to virustotal from the avast computer (dont open attachment)

do you not have spam / virus filter on the mailserver? … so it is stopped before arriving at your computer

you can test mail security here
http://www.emailsecuritycheck.net/
http://www.aleph-tec.com/eicar/index.php

10

Hi again

Sorry about the log files, I’ll do that next time! ::slight_smile:

The virus/malware files are being assigned as SPAM by the mail server but the attachments are not being removed - I can query with the IT manager.

In my desktop PC that has ESET Nod installed - in Outlook 2013 there is the Add-In installed and there are some options I can configure from within Outlook itself such as scan email folder, or scan selected email only.

But on my laptop with Avast there is no Avast Mail Add-In option to configure? The Avast Add-In is installed under File > Options > Add-Ins however. Should there not be an option in here or is this only available on the paid for version of Avast?