Hello! I’m trying to get Avast to work with Thunderbird enough to replace my existing AV product (Symantec Endpoint Protection), but I’m having a problem.
Avast refuses to see malware inside an MBOX format file (Thunderbird), but it will scan for new malware as emails are downloaded. SEP refuses to integrate with Thunderbird, but will find the malware in the MBOX file.
This is the result of scanning a copy of the same MBOX file. Avast: http://imgur.com/FfXN6GW SEP: http://imgur.com/EESHJJG
I need to be able to both stop threats from coming in, and ensure there are no latent threats on my network, ya know?
upload and test the file at www.virustotal.com if tested before, click new scan
post link to scan result here…
Ok. I had to trim a chunk out of the mailbox to make it fit, but I left the giblets (Infected).
Scanning the big file (3k Messages, 24MB):
https://www.virustotal.com/en/file/b6899fdd972fc2c6aeec0abae5c639fa7fe393ddc026b1380f641ef88eb7f5ca/analysis/1404314858/
Scanning a different MBOX file (1 Message, 104kb):
https://www.virustotal.com/en/file/bca4af371dc84ae3e54aa62286adc8f910b14a3a188ecae138d502f8be41db1a/analysis/
So. Yeah.
EDIT: Despite what Virustotal says, when I scan the 24MB file locally with SEP, it comes up with infections and starts cleaning.
are you running avast and symantec at the same time?
Why Using Multiple Antivirus Programs is a Bad Idea
http://blog.kaspersky.com/multiple-antivirus-programs-bad-idea/
if Symantec detect and remove, then there is nothing left to detect…
seems to be very new
First submission 2014-07-02 15:27:38 UTC ( 6 minutes ago )
First submission 2014-07-02 15:22:23 UTC ( 12 minutes ago )
you can send undetected samples to avast using one of these options
You can upload files and report issues to avast here : http://www.avast.com/contact-form.php (select subject according to Your case)
You can use mail
send to virus@avast.com in a password protected zip file
mail subject: False Positive / undetected sample (select subject according to your case)
zip password: infected
or you can send files from avast chest
how to use the chest. http://www.avast.com/faq.php?article=AVKB21
The 24MB file contains emails from months ago. Why I have it is another debate entirely.
I am not running Avast and SEP on the same PC- I have a second computer running SEP. I made a copy of the MBOX file (Junk), and scanned the copy on both the Avast PC and SEP PC.
I know that in tests like these, you don’t run them off the original. (Just like data recovery! ;D)