SMTP Issues

Avast Free Antivirus / Premium Security
1

Hi,

I’ve been having some problems sending emails recently, although curiously one SMTP server works whilst the others do not - I believe the working SMTP server is the one entered in the .ini file from when avast handled SMTP scanning differently.

Anyway, basically what is happening is that when I try to send using one of the ‘problem’ mailservers, is my mail client sits there and looks at me - it is attempting to connect to the server, but never establishes the connection in order to supply credentials. I should point out that the mail server definitely isn’t to blame as the issue occurs with numerous servers, and they are accessible to a friend (who doesn’t use avast) using the same type of connection on the same ISP as myself.

I have also tried to send emails using different mail clients to ensure it isn’t a problem with the mail client I’m using (Calypso); the other mail client I tried was Thunderbird.

What I have found is that when I open ‘On-Access Protection Control’ and ‘Customize’ ‘Internet Mail’ (without actually changing the settings), mails will send whilst I have the dialog box open, or perhaps just when I close it. With it closed it doesn’t work.

I have done this a few times now and I’m near certain this is what’s happening (i.e. it isn’t just co-incidence).

Here’s my specs:
Avast: 4.6.665
VPS: 0527-2

Windows 2000 Pro
AMD 3200+
512 MB RAM

I’ve tried repairing Avast via add/remove programs as I noticed someone mentioned how to go about this in some of the other posts I’ve read on here; that doesn’t seem to have made any difference.

Anyone got any ideas?

2

That is the ‘default’ smtp server, used only to send files to Alwil for analysis, and with quite very few programs that need a ‘default’ server.
It should block any other smtp server to work.

Into the firewall settings, the following program should be allowed to connect: ashMaiSv.exe (avast! e-Mail Scanner Service) (allow email rights)

To know more, maybe you can add the following line to the [MailScanner] section of \data\avast4.ini:
Log=20

Then generate some traffic, simulate the problem (i.e. force the avast mail scanner to time out by sending an email with attachment) and then post here the contents of the file \data\log\aswMaiSv.log or, at least, the last lines of it.

3

Firewall isn’t the issue - I use a hardware based firewall and therefore there is no ‘program by program’ type firewall settings as you discussed, but I can assure you that port 25 is well and truely open for use.

Clearly a firewall issue would also be prevalant for my one working smtp server as they each use the same port.

I have done as you suggest, and interestingly after making the change to avast.ini my first test email went through just fine. My second attempt produced the log entries as follows:

07/10/05 15:18:29 00000514:   SMTP accept connection from: 127.0.0.1
07/10/05 15:18:29 00000514:   Connection handler: 0x0000052C
07/10/05 15:18:29 0000052C:   Ignored PIDs: 1148 1188 
07/10/05 15:18:29 0000052C:   Ignored Addresses: 192.168.0.2:25 127.0.0.1:25 192.168.0.2:110 127.0.0.1:110 72.3.135.203:80 193.243.128.78:80 193.243.128.76:80 62.132.1.234:80 198.200.173.74:80 198.200.173.139:80 127.0.0.1:80 
07/10/05 15:18:29 0000052C:   Ignored Processes: avgemc.exe forx.exe FXMadeEasy.exe aoltpspd.exe waol.exe ypager.exe V3P3AT.EXE bitcomet.exe mpftray.exe ABC.EXE CZDCPlusPlus.ex CRAXY.EXE NETMONSV.EXE SYMPROXYSVC.EXE NAVAPW32.EXE WEBPROXY.EXE EMULE.EXE TMPROXY.EXE isafe.exe SMPROXY.EXE ccLgView.exe ccSetMgr.exe ccPwdSvc.exe ccApp.exe ccProxy.exe ccPxySvc.exe ccEvtMgr.exe winroute.exe avast.setup 
07/10/05 15:18:29 0000052C:   --SMTP command REDIRECT 65.98.75.106:25 1616
07/10/05 15:18:29 0000052C:   Connected to SMTP server 65.98.75.106 25
07/10/05 15:22:30 0000052C:   Timeout - closing connection due to TIMEOUTKILL
07/10/05 15:22:30 0000052C:   --SMTP Finishing connection handler

It seems very intermittent, and I can’t put this down to the servers as it is affecting several not just one.

4

I see in the ignored processes avgemc.exe, are you running two resident AVs?
This can cause conflict between AV programs. This could be what is happening but would require further investigation. Uninstall AVG (if it is installed) boot and try again.

There are known compatibility issues between AVG (mail scanner) and avast.

Edit: Not to mention something that may be to do with Norton NAVAPW32.exe, this may or may not indicate the presence of NAV?

5

I think they may be (possibly) from left over installations that have since been uninstalled; I am only running Avast and have never run any AV installations side by side.

Is it perhaps the case that these values are present by default in Avast?

I have checked my process list and none of those you mention are running - the only AV related processes are Avast ones.

6
Is it perhaps the case that these values are present by default in Avast?
I'm not sure what values you are talking about?

If you are talking about the two entries in your ignored processes, no they aren’t present by default in avast, they are nothing to do with avast. However I have no idea how they get into your ignored processes, normally you would have to add programs to the ignored processes but they could/may also be listed in the VPS updates to avoid conflicts with these programs (if they were installed).

I suppose you could check by doing a registry search from regedit for avgemc.exe and NAVAPW32.exe and see if there is an associated entry for them.

Quite often there is no process running after an uninstall but there may be registry entries left behind. However, I would have though if this was the case it would effect all email and not just some SMTP. Does receiving emails work in both accounts?

I’m not sure if you may not have to set up each calypso account manually. Check the account settings of the SMTP account that isn’t working against the one that does work. Possibly the bit about the account requires authentication (or whatever it is called in calypso). Sorry clutching at straws here, I have no experience of calypso.

7

DavidR,

just some info.

I just ran a Log=20 test on my system using my Thunderbird client. The ignored processes list is identical to that posted by damien and is, I am pretty sure, the default list created by Avast.

8

Yes that what I was beginning to think it must be in the VPS updates.

but they could/may also be listed in the VPS updates to avoid conflicts with these programs (if they were installed).

It is still strange why it would effect only one SMTP account, so there has to be a similar thing to OE’s ‘This Account requires Authentication’ and you can only send to accounts that are either for the same ISP connection or they are totally independent of an ISP (they also require authentication to avoid being used as a spam relay). So I’m a bit stumped on this one.

9

Damien,

it appears that in the test you conducted earlier:

  1. you made the change to avast4.ini to include Log=20

  2. you sent a message on one of the “problematic” accounts and it appeared to be sent successfully (was it actually delivered?)

  3. you sent another message on the the same account as in (2) and it was not successful.

  4. you posted the ashMaiSv log of sending the message in (3).

Have I got that right?

The log shows that Avast connected to the SMTP server. There should then have been some response from the server. There was nothing returned and eventually the connection was timed out.

I am wondering if there may be some issue with the completion of sending the first message that is preventing you from connecting successfully to send subsequent messages.

I assume that the AshMaiSv log must have also contained the details of sending the first (apparently successful) message. Can you post that part too?

10

Hi Alanrf,

Yes - your summary is basically correct. To answer your 2nd point, the email was successfully delivered - I was sending to myself (separate email account/server - and the same one used in all tests successful and otherwise).

From my understanding of the log files, it seems that Avast isn’t receiving (or noticing if it is receiving) the welcome message from the SMTP server. I haven’t actually managed to test this theory via telnet as obviously Avast is picking this up and treating it with the same (potential) contempt as my email client - I presume I can add something like putty.exe to that ignored programs list and then connect via that to check things out further?

I’ve checked my log and can no longer see any successful SMTP attempts; unfortunately I didn’t copy the entries from it into a separate file so they have been overwritten as the log has rolled.
I did however review them at the time, and can tell you that basically after the connection attempt avast logged into the server as ‘dpc’ (my computer name) and did it’s stuff.

The critical difference between the SMTP servers that are not working, and the one that isn’t is the SMTP auth. (via. username/password, non-SSL) - although it seems things are falling over before we get that far so I don’t expect it to be due to that. Even Avast cannot know that it is an SMTP auth. server at the stage it is failing, as the mail client doesn’t attempt to send that info until it has established the connection.

11

In the test you conducted logon to the SMTP server must have been successful for the first message to be sent out.

I’ll admit I am not well versed in the protocol for SMTP authorized sessions, ie their persistance, requirement to logon again for subsequent messages etc.

Unfortunately, I do not have an SMTP server requiring authorization so I cannot check it out any further myself.

I hope that others more knowledgeable/Avast team members will be able to assist you further.

12

Yes Alan - when I was referring to that I was meaning when it fails it fails prior to attempting the authentication step rather than during authentication.

When it did send, it did successfully connect and complete authentication - but my point is that although that is the only real difference between the accounts, it cannot be the reason in itself we don’t get that far before it fails.

Regarding sending multiple messages via an SMTP auth. server; I haven’t actually tried to send more than one message at a time and therefore my local mail queue has always been 1 or 0 - never more than 1. However, if everything was working smoothly, it would connect to the server and authenticate, then send however many messages it needed to, then disconnect - basically the same as you do with POP3 when downloading messages.

13

I’ve emailed support as I need to get this sorted, and unfortunately it doesn’t look like anyone on here has the answer :frowning:

Thanks for trying to help anyway guys - I appreciate that it’s a real head-scratcher!

14

Damien, did support ever get back with you? I seem to be having the same issue.

thanks,