No, I do not think Proxomitron is the problem. The first computer I noted ashquick.exe connecting does not have proxomitron installed. My second testing computer does. But Proxomitron is a local web proxy only. No email capabilities. I doubt that avast went out and just found this local proxy sitting there on port 8999 all by itself, and taught it how to handle SMTP protocol, without any help on my part. :wink: And even if it did, I would not have experienced any firewall popups since Kerio is configured to allow Proxomitron out to any address, any port. Sorry, just playing around a little here. :slight_smile: Bottom line - the initial computer that alerted on ashquick.exe did not have Proxomitron installed. I probably shouldn’t have even mentioned Proxomitron in the first place since it’s only installed on one computer and I now have two exhibiting the same behavior.

The problem is, why Kerio is asking for this access if no other firewall do?
That's the million dollar question. But Kerio is not asking for any access. It's just alerting me that ashquick.exe is asking for access. I think it's all related to the way I'm starting my scanning. Right-click on the file eicar.com, and select "scan with avast" from the popup context menu. I believe it's that right-click triggered single file scan that runs ashquick instead of ashserv.
Whatever circunstances is the problem here... your configuration could be different that the default ones. I've already said that I use avast fore almost 2 years and [b]only avast.setup[/b] for updates and [b]ashMaiSv.exe[/b] the avast email scanner have asked for Internet connection.
I guess my config may very well be different, although this is a brand new computer with a clean W2k install and very few other programs in place. avast works well in my config. I think I've decided on my planned course of action to handle the firewall rules, so this thread is more becoming an intellectual exercise in fine tuning our understanding of how avast works. Which is great, by the way. So continuing on in the discussion...

Do you have email alerting set up? That’s what I believe is triggering the access. avast finds a virus (eicar), and is trying to send me an email telling me about it’s discovery. This is a seperate thing from scanning of normal incoming and outgoing email. This is avast CREATING an email on it’s own (per my configuration).