Web Shield - HTTP traffic in Thunderbird

[system]

@CharleyO post:20

Somehow, I am missing the problem. Most of my email is html enriched. When I open each email & downloading begins, the “a” is constantly spinning until downloading is completed. I am sure it is Web Shield checking all that is downloaded. And, as lukor points out, what about the protection Standard Shiled provides?

The “a” is constantly spinning because the Standard Shield is scanning the content in that particular case.

Web Shield does scan the HTML within the e-mail itself, but does not scan the contents that the HTML pulls from the Internet which is typically just images. However, those images would be scanned by the Standard Shield anyways.

So I suppose that, after all, the Standard Shield would catch any virus that were to come in this way. Only exception being a compressed archive, but that would be scanned upon opening/executing whatever is in it anyways.

Thanks everyone!

[system]

how do i post screenshots?

[DavidR]

Start here http://forum.avast.com/index.php?topic=8982.0

[alanrf]

Quotes from the last post of DaveD in response to CharleyO:

The "a" is constantly spinning because the Standard Shield is scanning the content in that particular case.

Web Shield does scan the HTML within the e-mail itself, but does not scan the contents that the HTML pulls from the Internet which is typically just images.

Sorry - both comments are just plain wrong.

The “a” is mainly spinning because the Internet Mail scanner is scanning your mail as it is being downloaded, message body and attachments. The Standard Shield is only scanning the email executables and the existing mail files as they are being read (in a default avast setting).

Webshield plays no part whatsoever in scanning email - as it is being downloaded (because that is POP3 and not http) and, unfortunately, as it is being displayed by your mail client or to use the technical term rendered. I say rendered because for most of us these days much of our email comes in the form of html email. This email is not just displayed (as old fashioned plain text would be) but the image on the screen is created by obeying (or rendering) the html commands that make up the email. Effectively these emails are displayed by a browser engine (if you use a Microsoft mail client then it uses the same code as Internet Explorer; if you use Thunderbird then it uses the same code as Firefox). As these html commands are executed they use browser functions to go out to the Internet to retrieve pieces of the email that are then executed on your system to produce the display you see.

The issue that is being discussed here (CharleyO are you on board now?) is that because this code is not being executed under the “process name” of a list of browsers that is included in the VPS file of avast, but instead are being executed under the process name of your email client then avast does not scan these files as they are downloaded.

For DaveD - there is a lot more than just images in the files downloaded.

I am happy to accept the assurance of Lukas that the execution of these files will be intercepted by the Standard Shield though I would appreciate formal confirmation that all files so executed are scanned by the Standard Shield prior to any involvement in execution.

By the way, I should add (as I have mentioned above in the thread but just to reinforce it):

If you happen to use an email account that can be displayed in your browser (such as Yahoo, Hotmail, Gmail etc) then, simply because you are displaying that email in the browser then avast will perform a scan of every element of the email as it is being retreived which it will not do for the same email displayed by your mail client.

I suppose the moral of this story is - if you want a higher level of security from avast then if you can read your email in your browser, not in your email client.

If you use a mail client then the Internet Mail Scanner is still pretty good for checking attachments.

[alanrf]

Lukas,

my sincere thanks for responding again in this thread. Though I try your patience I appreciate it very much.

My responses in this forum are not based upon my own needs. I merely suggest that I know how to use the excellent features built into avast and available to experienced users to configure avast to my needs.

I am trying to put myself in the place of and represent the needs of the average home user of avast. Since I support a number of such users who are using avast on my recommendation I hope you will understand that I consider this my duty. It is not my wish to be contentious but, as an avast supporter, I want your product to be the best it can be. If my opinions have to suggest you are not being the best … then so be it.

So Lukas … on to my response:

What about the Standard Shield?

Are you professionally content to stand behind the Standard Shield? I’m sorry while I understand it is the foundation of avast - you have introduced so much more since I first encountered your product. I do have to wonder though if you have not developed cold feet and whether certain moves mean that you are planning to exit recent forays such as mail scanning.

we have implemented a WebShield to further reinforce the protection for one type of applications - Web Browsers

What is a Web Browser? It seems that you now wish to define this as a specific group of applications that are recorded in the VPS file - again - I am sorry to note - after developing cold feet about your ability to scan http accesses in a more general fashion when you first introduced this feature. I cannot know the feedback your support teams experienced (though I ask you to believe me I have been there in all the ungodly hours of the morning) but I still believe that this would be better based on exclusion of anomalies rather than inclusion of acceptances. I know that the latter is much easier to explain to your management (and heavens! do I know what explaining to corporate management means).

You know and I know that what we are talking about is not the scanning of email during download. Readers of this thread may think we are - but that is an irrelevance. What we are really talking about is the rendering (displaying) of email which is a completley separate issue (in a mail client) from downloading the mail. I have covered this in my previous post in this thread and I will not bore everyone with it again.

I do accept that it not too easy for avast to understand the difference between an email client using http to download (in certain restricted instances) mail from the mail store and the incredibly frequent use of http by email clients in displaying html based email messages. What is does mean though is that you have avoided the mail download issues of the few mail clients and ignored the issues of retrieving http files that is an essential part of displaying the content of a huge proportion of today’s email.

There are not too many mail clients that use http to download mail from a Webmail mailstore to a client.

I have to confess at this point that I believe that you have thrown a certain amount of FUD (for those reading the thread and not knowing the acronym - Fear Uncertanity and Doubt) across the path here.

There are (to the best of my knowledge) two types of http access to Webmail:

1. WebDav access to appropriately enabled Hotmail clients. This is supported in an IMAP fashion by Outlook Express and Outlook (2001 and later editions). As far as I can tell (and you should have tested it far better than I can) the avast WebShield has no negative affect on either of these products.

There are other third party solutions that provide WebDav to POP3 conversions. These include HotPop (a paid solution) and the Thunderbird Webmail extensions. My testing with avast, so far, indicates no problems with either of these offerings.
Somewhere in this area falls IncrediMail and so,while here, I will admit there may be many other mail clients in this field that I have not tested (there’s a get-out if ever you needed one).

2. There are also a number of programs that provide access to WebMail mail stores through http by what are know as screen-scraper solutions.

I have tested avast fequently with MrPostman and with FreePops (well known free offerings in this area) with no ill effect. (In the unlikely case you care to check - you will find a sticky under my id in the AVG email forum advising users how to scan WebMail using these products).

In short Lukas, I am merely suggesting that the problems you raise are not that large. I am very familiar with (and have worked with developers to reduce) the instances of re-download of mail (see my id in the FreePops and Mr Postman forums). I think - just think - that if the majority of users had to choose between downloading unscanned malware to their systems over a re-download of email then they would agree with me …

you bet your a$$ what I would choose!!!

I simply want what is best for the majority of avast users who could not give a d*mn about the details of this post and … honestly … why should they? They rely on you guys to make the best decisions for this product. The defaults must be the best for the majority. I’m sure that is your view too. Some of us sometimes do not agree with the view coming from avast central and I hope you will accept our input.

Sincerely,

Alan

[system]

---

Ok, alanf … I’m on board now.

---

[system]

As of the 4.7 release (or possibly through recent VPS update) the HTTP scanning of HTML-based e-mail in Thunderbird is now being scanned. This is very nice to see.

Thanks Alwil Team!