Today my Kerio Personal Firewall showed me two alerts, one by one, telling that the avast! Internet Mail scanner application has been replaced by another application with the same name, and asking for action - accept this replacement or decline. I choosed to accept in both cases, just automatically, without thinking too much. But now, it looks strange, because usually Avast always inform about program components update, and I’m really not sure was this Avast or Internet intrusion? Can the Avast do the self-checking?
Does the Internet Mail stil appear to be working, scanning emails, etc. ?
e.g. Scanned count: and Last scanned: fields in the Internet Mail detailed view should be changing, check email headers and there should be a x-antivirus section showing avast has scanned the email, etc.
What are the file properties of the ashMaiSv.exe, see image do they match, file size, modified, etc. ?
It has an MD5 of 36088ba16e85c081d7bc48725872d540
To see if avast! is scanning emails, check one of these points:
-
Is the avast icon (the special one of email scanning) be shown in the system tray?
-
Is your email header with the lines X-Antivirus: avast! (VPS XXXXXX-X, XX/XX/2007), Inbound message and X-Antivirus-Status: Clean? (Right click the message, choose Properties and Details)
-
Are clean notes added at the bottom of the email? (Internet Mail provider settings)
[b]You can test the security of your email system here: http://www.gfi.com/emailsecuritytest/[/b]
To see the Standard Shield and other protection:
- Is the ‘a’ blue icon swirling?
- Right click the icon once and see what are the ‘last scanned files’…
- Use eicar virus test.
Go to Control Panel > Add/Remove programs > avast! antivirus > Remove. Then choose Repair function in the popup window (Repair).
I did not find any notes about avast! antivirus in message Internet headers. (I use Outlook)
There is otner Internet headers: ‘X-Virus-Scan: Scanned by ClamAV 0.91.2 (no viruses);’, but this added by my hosting mailserver, not by Avast.
I am not sure how avast! scan inbound mails - though in the Internet Mail > resident task settings > ‘Scan inbound mail’ box is checked, and even have checked ‘Insert note into clean message’ - but nothing is inserted.
I use 5 modules(providers) from 7 (I do not use 2 plugins, Outlook/Exchange and Script Blocking, so have it permanently disabled). There are only two Avast icons on IE quick launch taskbar, Avast On-Access Scanner itself and VRDB Generator. Main icon rotate periodically, when browsing URLs, opening programs, etc.
Ashmaisv.exe file size is correct, 241KB (247,160bytes), the Digital Signature information of Ashmaisv.exe file is also OK.
Most of avast program files has data/timestamp Created: December 13, 2007, Modified: December 04, 2007
Are you using MS Outlook (not express) ?
If so then you need to enable the avast Outlook/Exchange provider, that is what covers the MS Outlook email client.
Yes, I use MS Outlook as mail client. I disabled avast Outlook/Exchange provider because currently, there is no necessity for using it.
It’s not clear why personal firewall showed these alerts about replacement avast Internet Mail scanner by another application with the same name.
Could be:
- an avast program update.
- another port is being checked (a spam tool, a mail checker, etc.).
- a firewall issue (lost settings, etc.).
Whilst I don’t use MS Outlook, if I did I would be using the Outlook/Exchange provider. Why, because it works within the email client as a plug-in; it purpose made to give greater flexibility and configurability in the actions to take upon detection; it can scan SSL/TLS secure email because it is operating ‘inside’ the email client (the Internet Mail can’t scan secure email without a third party application).
I would also say the greatest reason is the fact that you want a clean note inserted and this plainly isn’t working and based on your saying there is no x-antivirus info in the email header, I’m not even sure it is being scanned as you didn’t answer the most important bit of the question I asked earlier.
Does the Internet Mail stil appear to be working, scanning emails, etc. ? e.g. Scanned count: and Last scanned: fields in the Internet Mail detailed view should be changing,
If these aren’t constantly changing when email is scanned then your email isn’t being scanned by the Internet Mail provider.
Does the Internet Mail stil appear to be working, scanning emails, etc. ? e.g. Scanned count: and Last scanned: fields in the Internet Mail detailed view should be changing,
I’m not sure how to determine: it still seems to be working, but I’m not sure it works for email scanning. If open avast! On-Access Scanner interface, in ‘Internet Mail’ tab, there is no details about last scanned objects:
Last scanned:
Last infected:
Scanned count:
and so on
but ‘Run time’ constantly changes, so it appears to be working.
I’m not use Outlook/Exchange provider, since I have large mail DBF file, and sometimes, some antivirus plugins may cause DBF file damage or corruption, it requires a lot of work to restore DBF.
Right after 2nd alert(one by one), it was shown also 3rd alert, ‘incoming connection alert’: someone tries to send ICMP packet to my pc. I cannot exclude the possibility of a firewall issue (lost settings, etc), however.
If there are no details then your email isn’t being scanned.
The MS outlook file is .pst and if you ever get notification that there is an infection in there, take no action. Report it on the forums and we will guide you how to remove it manually.
The trouble/work is directly related to your back-up and recovery strategy, to restore anything is down to backing up data you don’t want to lose. I use OE6 and I back-up all my .pdf files at least once a day, should have a problem I can replace the effected folder in seconds.
The outlook/Exchange as I said is designed for use with MS Outlook, so I feel your are less likely to experience a problem because of that. Not to mention the additional configurability on what action to take on any detection.
Your system your choice, I’m done trying to persuade you, now the decision is yours.
Does ashMaiSv.exe really has been replaced with new one or not?
I gave you the file details of my ashMaiSv.exe to compare with your version, does it match ?
Personally I believe this is a firewall hiccup I have had it in the past for some files that I ‘know for a fact’ hadn’t changed.
Why not?
Your email won’t be scanned.
Don’t forget that you will not see the inserted note in the ‘Sent Items’ folder of your mail program, because avast adds the note after the mail leaves the mail program.
Yes, ashMaiSv.exe file details match your file. So, probably it was a firewall issue.
Not fully clear, what protect avast ‘Internet Mail’ resident provider: it run, but which mail it protect? As I said, I have Outlook/Exchange module disabled.
Internet Mail provider protects all POP3/SMTP email clients like Outlook Express, Thunderbird, Incredimail and so on.
If user not use Outlook Express, ‘Internet Mail’ probably can be disabled.
Not if he/she uses another program like Thunderbird…