False Warning

Avast Free Antivirus / Premium Security
1

Running Windows 98SE, Avast Home 4.7.844.

When I SEND an email, I often get a “Suspicious Message” pop up from Avast, complete with the pulsating wheel.

Inbound/Outbound mail is set up to be scanned by Avast.

There is nothing suspicious about it, and a deep scan shows no problems whatever, likewise for Spybot and AdAware. (by the way an Avast deep scan now takes 24 minutes for a 40gb hard drive with 5.3gb of files on it, about double what it used to several months ago - what gives?)

Anyway back to the main point: how can I get rid of this false warning?

2

To whom are you sending emails? One addreess or many?
This message comes from the Heuristic mail scanner. You can set its properties in two tabs of settings.

It won’t harm if:

  1. you run a boot time scanning with avast.
  2. use www.ewido.net too 8)
3

I’m sending them to one person at a time, all friends, and it has also happened on a test message to myself. Hueristics are set to “medium”. It doesn’t happen every time, more like 50% of the time.

4

When the warning pops-up is there more information, e.g. why it is considered suspicious, no subject, iFrame, white space, etc. ?

Are these emails that are deemed suspicious always the same content other than the different To: address and sent in a short period of time ?

Is there anything in common with all the suspicious emails, forwarded/reply to received email, attachments, etc.

What is your email program ?

5

Better will be following David’s advice and know ‘why’ this is happening.
Into Heuristic tab you can choose ‘Custom’ level and uncheck the options you don’t need or want.
The help file for these particular tabs of settings are very instructive 8)

6

Hi, I’m sorry I haven’t posted back. I’m in the middle of moving and it’s taking up nearly all my time and energy, including mental energy.

email is T-bird 1.5.0.4. OS is 98SE. I noticed that I only get the warning when I send a message with no subject and T-bird therefore inserts its own “(no subject)”.

The Avast pop-up says “Suspicious subject of message” and shows no entry, i.e. only blank space, after the Subject heading. It appears that Avast is not picking up on the fact that T-bird is inserting a subject in the the subject header.

7

Hi RF!

So that’s the point then -ppl at forum please correct me if I’m wrong-, avast! is alerting you because lot of spam including viruses are actually send without subject.

Have a nice email :slight_smile:

8

I am using WinXP SP2, while it differs from the originator I doubt that it causes the Internet Mail scanners actions to differ significantly.

I do use exactly the same version of Thunderbird as the originator.

I have to suspect that something more complex must be the cause of the alarm reported. When I send a simple short message from Thunderbird (with inbound & outbound scanning) at “Normal” and at “High” sensitivity in the Internet Mail scanner and with no subject there is no warning from avast.

The messages sent (without subject) do not provoke any warning when they are received either.

9

Update:

I was able to get the warning from avast, but only by customizing the Heuristics tab of the Internet Mail scanner:

Customize > Hueristics tab > Set Level to Custom > Customize > Click on the “Subject structure check”.

Are you running with Customized settings in the Internet Mail scanner?

10

I have heuristics set to Medium and have never played with the settings beyond that, but to check out what you were referring to, I moved the slider down to Custom and opened it up to see what was pre-checked. “Subject structure check” was unchecked.

11

This is the default 8)

12

Then we are back at square one - with no credible explanation for the warning from avast. The warning given for a (no subject) message from Thunderbird - when the Subject structure check box is checked - is identical to that reported by RF.

It is always a bit harder to diagnose those “sometimes happens - sometimes doesn’t” issues.

13

I’m having another problem as well that I discussed in another thread, namely that internet mail, web shield and standard shield won’t keep their “high” settings - after you reboot they revert to “normal” (although the checked settings inside, if accurate, indicate to me that the level of protection is actually “high”). All of this may be interelated and may not benefit from an analytical approach to problem solving. Over the past year, by merely reinstalling the drivers or the program, I’ve solved a printer problem, a Go-Back problem, and an nVidia BSOD problem. When I can find the time I think what I’ll do is disconnect the modem and uninstall/reinstall Avast, re-registering if necessary. Meanwhile the Avast email warning is just a nuisance, and not a serious difficulty.

14

Strange.
What if you change something “real option”, not just the Normal-High slider (like, add an extension to be scanned into Standard Shield, or un/check the “Show detailed into for performed action” in Internet Mail, or something like that) - is it persisted, or reverted to the previous value after reboot?

Also, do you get the mail heursistic warning for all mails with empty subject, or only some?

15

Igor,

I'm sending them to one person at a time, all friends, and it has also happened on a test message to myself. Hueristics are set to "medium". It doesn't happen every time, more like 50% of the time.