I’m using avast (lastest version) on XP Pro SP1, all patches applied. My newsreader is xnews.
Yesterday the following happened: I told xnews to open a newsgroup with about 8200 articles. Usually this should take about 45 sec and maybe 4 or 5 MB of data should be transferred. This time I interrupted the operation after about 10mins and 45MB of transferred data.
Now my question is: where does all the data come from? From my understanding, the reader downloads only the headlines (at least it is configured to do so) and the scanner should get active when an article is opened. Does the NNTP-scanner try to download the entire newsgroup to scan it in advance? Will the patch that was mentioned here a couple of times resolve this problem? Or do I have to turn off the NNTP-scanner? I have 1GB of traffic per month free and if opening a large newsgroup consumes 45+X MB I’d prefer to go without the protection. Nonetheless a cool feature.
The NNTP scanner only scans articles downloaded by the newsreader, it does not initiate any extra downloads. I don’t know where did that data come from, maybe the newsreader tried to reload the headers, as it had received no response in an usual amount of time. If this was so, it would be solved by the patch.
I conformed that Internet mail provider is doing the newsgroup reading with Thunderbird and then looking at my Sygate firewall traffic log.
AshMaiSv.exe is getting a log entry to remote client TCP port 119.
To have a more firm confirmation, you can open the Customize window and tick the checkbox ‘Insert note into the clean inbound news’ in the NNTP-tab.
Something like this will be written to the new messages: