I occasionally get a systray icon that looks like two pieces of mail and a blue light but can’t find any documentation about it. I cannot left or right click it, but if I hover over it it gives me an IP address – and not IP addresses that I would have any reason to be connecting to. What is this, what does it mean? I assume it’s part of avast! because it showed up after installing. Help please!
thanks.
There are many threads explaining this icon. It is your avast! mail scanner, and it shows that icon when it’s scanning e-mails
http://forum.avast.com/index.php?topic=8881.msg73352#msg73352
If the icon is only showing up at times when you are running your mail client then it is, most likely, just showing the connection to your mail server (or servers).
Are you noticing the icon at other times?
Alanrf –
Yes! It shows up at other times with IP addresses that do not at all correspond to my mail servers!
S.Z.Craftec -
Sorry, couldn’t find any of them with searches or by self-scanning. 
Thanks,
f
You can enable or disable this icon into Internet Mail and MS Outlook avast providers.
See ‘Advanced’ tab of settings the option ‘Show tray icon when scanning mail’.
Tech,
the user is reporting that the icon shows up when not using the email client.
Why are you telling the user how to hide the fact that something on their system may be sending out emails without their consent?
Isn’t it running in background, not properly closed? Is it listed into Task Manager (ctrl+alt+del)?
I’m not trying to hide nothing. I does not intend nothing but help. I haven’t second intentions.
It could mean that your mail checking utility is occasionally checking for incoming e-mails. That’s how they work. I have POP Peeper and it does its job exactly the same way. Same thing is with PopTray and many other third party mail checking / anti-spam utilities.
What is your mail notification program if you have one ? I don’t mean, mail client, but mail checking utility which occasinally checks for e-mails… depending on the interval you set (IE. to check for mails every 3 minutes, or every 5 mins etc.)
Cheers !
Very good observation indeed… could be this…
Anyway, it would be easier if users come back to their original threads and follow the help we’re trying to give them.
Thanks, Sasha.
Mmmm … maybe.
However the user has reported (twice) that the IP addresses showing up are not related to mail servers of the user. Poppeeper and other such services to not connect to mail servers other than those set up by the user.
Also user never said what is exact IP he saw… could it be that all he saw was 127.0.0.1 by any chance ? Some more info from his end would be greatly appreciated because this looks to me like nothing but shooting in the dark.
A question that maybe someone can answer.
Whenever I do a hover over the avast “blue light” all I ever see is a server name and never an IP address, even though for some of my mail servers I use a psuedonym for localhost (set up in the hosts file) avast always shows that as “localhost”.
I see a number of users here reporting IP addresses showing up when they hover over the “blue light”. What makes avast display differently?
Sorry, I did not mean to highjack this thread but it is slightly relevant while we wait to hear back from aleph.
I believe programs such as MSN messenger can be set up to check your mail without your client being open. I don’t have a msn or hotmail account so I don’t know what is displayed (hovering over the icon)when mail is downloaded from there. (numeric or letters). I do know mine is letters, smtp.xxxxx.xxx for uploads and pop.xxxxx.xx for downloads.
But until more info is posted, all we’re doing is guessing.
MSN/Hotmail and Yahoo are special cases since, to most users, they do not publish a POP3 mail server.
Most of the “tray resident” utilities like Pop-peeper work by using POP3 connections to read the list of email being held on a user’s mail server. There are other utilities that work for MSN/Hotmail and Yahoo by performing a HTTP screen-scrape to get the list of messages held on those servers.
The different thing could be easily because those users are using Windows 98/96/SE/ME. If you remember in their settings instead of those names of pop3 and smtp pserver names, it says 127.0.0.1
Of course avast! performed those changes to be able to intercept those mails, therefore check them before they do any harm (of course if some of those mails/attachments are of malicious nature)
I believe that’s the number he always see.
As I already mentioned before, lack of information from his side will keep us wondering… why people never post some basic information about their systems prior asking those questions ? If we have enough time to spend helping them (again, for free), why don’t they take some time to help us ? If they help us a bit in the beginning, then we can help them much more and much faster… until then, I guess it’s his Windows 98/ME and 127.0.0.1
By using plug-ins your POP Peeper can check Hotmail without any single problem… other thing, it works with gmail just like a charm. In the very near future it will have IMAP support as well (AOL, AIM, FasMail etc.).
http://img486.imageshack.us/img486/2861/untitled91py.jpg
My buddy Jeff (POP Peeper developer) is already working on those things and I am happy to say, 90% of that task is already done and almost ready for upcomming version 3.0
I’ve been other forums with the same problem. Some of them have a topic that stays at the top called “Tips On Posting”. This gives new posters a heads up on what they should include in their posts. ie OS, Cpu, AV’s running, exact error message etc…
Maybe the administrators coud set this up? It sure would help.
Oh yeah, posters should post back results no matter if successful or not.
Sorry to hijack this thread, but it is kinda relevent to the original poster and I can tell that these posts do get read, so admin probably will see this.
No this is not hijacked thread at all, and all those things you said are wonderful and it could help a lot. If just forum moderators see your suggestion I’m sure we could work something out…
Thanks again !
Wow, haven’t check back in a couple days and it seems this tread has been busy.
Answers to a few questions:
This is a new, self-built system. I’ve done a couple reinstalls. Previous installs I noticed the icon up with various different IP addresses. None stayed connected for long enough to be able to write them down. Is there a LOG option somewhere inside avast! where I can track this?
On my present reinstall – running pretty much as I want it. I have imported old emails into outlook express, but I have not established any accounts. I’m still checking email online. I run no memory-resident email prog, and would not.
The last IP, and the one that prompted the creation of this thread was 200.104.22.78
I sat down at my computer and the icon was up with this ip address. It stayed up for a few minutes (maybe 4) then disappeared… Have not seen it again. Wish I could log this IP traffic somehow…
Follows, a list of normally running processes
--------[ Processes ]-----------------------------
ashDisp.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 1024 KB 2816 KB
ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 612 KB 5560 KB
ashServ.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe 4972 KB 24264 KB
ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 760 KB 5884 KB
aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 40 KB 408 KB
CTDetect.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe 384 KB 932 KB
CTsvcCDA.EXE C:\WINNT\system32\CTsvcCDA.EXE 36 KB 356 KB
Explorer.EXE C:\WINNT\Explorer.EXE 5876 KB 14352 KB
firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe 60624 KB 61304 KB
javaw.exe C:\Program Files\Java\jre1.5.0_05\bin\javaw.exe 122 MB 173 MB
jusched.exe C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe 36 KB 504 KB
lsass.exe C:\WINNT\system32\lsass.exe 1332 KB 2404 KB
mqsvc.exe C:\WINNT\system32\mqsvc.exe 760 KB 1848 KB
msdtc.exe C:\WINNT\system32\msdtc.exe 664 KB 1992 KB
msiexec.exe C:\WINNT\system32\msiexec.exe 6584 KB 2008 KB
MsPMSPSv.exe C:\WINNT\system32\MsPMSPSv.exe 44 KB 516 KB
MSTask.exe C:\WINNT\system32\MSTask.exe 244 KB 1088 KB
NOTEPAD.EXE C:\WINNT\system32\NOTEPAD.EXE 3400 KB 836 KB
nvsvc32.exe C:\WINNT\system32\nvsvc32.exe 316 KB 904 KB
PDVDServ.exe C:\Program Files\PowerDVD\PDVDServ.exe 40 KB 596 KB
regsvc.exe C:\WINNT\system32\regsvc.exe 124 KB 272 KB
Rundll32.exe C:\WINNT\system32\Rundll32.exe 128 KB 1580 KB
RUNDLL32.EXE C:\WINNT\system32\RUNDLL32.EXE 156 KB 1564 KB
services.exe C:\WINNT\system32\services.exe 3908 KB 4636 KB
smss.exe C:\WINNT\System32\smss.exe 36 KB 1084 KB
spoolsv.exe C:\WINNT\system32\spoolsv.exe 1152 KB 2528 KB
stisvc.exe C:\WINNT\system32\stisvc.exe 232 KB 1220 KB
svchost.exe C:\WINNT\system32\svchost.exe 1276 KB 10336 KB
svchost.exe C:\WINNT\system32\svchost.exe 1624 KB 1552 KB
svchost.exe C:\WINNT\system32\svchost.exe 2908 KB 3988 KB
taskmgr.exe C:\WINNT\system32\taskmgr.exe 1396 KB 784 KB
tcpsvcs.exe C:\WINNT\system32\tcpsvcs.exe 208 KB 1072 KB
TeaTimer.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe 5160 KB 5700 KB
vsmon.exe C:\WINNT\system32\ZoneLabs\vsmon.exe 11232 KB 14424 KB
winlogon.exe C:\WINNT\system32\winlogon.exe 2288 KB 5972 KB
WinMgmt.exe C:\WINNT\System32\WBEM\WinMgmt.exe 564 KB 1064 KB
zlclient.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe