View Full Version : Threatfire flagging Avast's email scanner
Firebytes
July 28th, 2008, 09:12 PM
Has anyone else who uses Threatfire and Avast had TF start flagging Avast's email scanner as having performed a malicious action? When I try to send an email TF pops up that the Avast email scanner has performed a potentially malicious action. I am assuming it is due to changes that Avast has made in recent updates but I don't know that for sure.
Firebytes
July 28th, 2008, 10:16 PM
Update; my father just did an Avast iAVS (signature) update and now TF flags his email scanner too. This avast update also asked him for a reboot, which neither I nor he had ever had happen before. A reboot request usually only happens after doing a program update.
dw426
July 28th, 2008, 11:31 PM
{QUOTE-> Update; my father just did an Avast iAVS (signature) update and now TF flags his email scanner too. This avast update also asked him for a reboot, which neither I nor he had ever had happen before. A reboot request usually only happens after doing a program update. <-QUOTE}
It's probably due to some change made by Avast. Avast made me reboot too so they must have changed the program slightly. When I first saw the post and looked at the screenshot it reminded me why I removed TF, everything was a friggin malicious action. But further reading makes me believe Avast changed something and TF got its feathers ruffled about it. If your system is clean of viruses and such I wouldn't put any further thought into it.
Tarq57
July 29th, 2008, 06:58 AM
I would imagine this detection will be put right quite quickly.
There's also a post concerning this at the PCTools forum. The next update (or 2) should do it.
Hasn't happened to me, (yet.)
BTW, there's nothing untoward about a behaviour blocker flagging a malicious action. In this case, it's not malicious, of course.
What protection level is selected in TF?
Firebytes
July 30th, 2008, 12:43 PM
{QUOTE-> I would imagine this detection will be put right quite quickly.
There's also a post concerning this at the PCTools forum. The next update (or 2) should do it.
Hasn't happened to me, (yet.)
BTW, there's nothing untoward about a behaviour blocker flagging a malicious action. In this case, it's not malicious, of course.
What protection level is selected in TF? <-QUOTE}
I know there was nothing wrong with TF flagging a potentially malicious action. That's why I have it. What I wanted to know was what changed to cause it to start flagging Avast's scanner as it had never done it before.
I have TF set to the default level of three, as always, and I run XP home. I applied the latest updates to both TF and Avast today but still got the alert from TF when I attempted to send an email. For now I have just set TF to allow the process and remember the answer so I won't get anymore alerts until this issue is resolved.
{QUOTE-> When I first saw the post and looked at the screenshot it reminded me why I removed TF, everything was a friggin malicious action. <-QUOTE}
I have had very good luck with TF myself regarding false positives. There have only been two alerts that I can remember that could be considered erroneous. This alert on Avast, and an alert for a program that was performing an action that really could be considered malicious many times (copying itself) but that is just a part of how that particular program works and I was expecting it to copy itself.
Firebytes
July 30th, 2008, 02:42 PM
OK, after applying the latest signature updates for Avast and TF after I arrived home today, I was still having TF flag the Avast scanner. I had not rebooted after the updates at the time as neither program asked for one.
Anyway, I decided to remove the always allow setting in TF that I had set up for the Avast scanner and tried rebooting. Now TF is no longer flagging Avast's scanner. Very strange stuff, I don't get it, but hey the two programs are back to working along side each other as usual now.
vBulletin® Copyright ©2000-2009, Jelsoft Enterprises Ltd.