Email scanning finding nothing

Discussion in 'ESET NOD32 Antivirus' started by tcarrbrion, Dec 15, 2007.

Thread Status:
Not open for further replies.
  1. tcarrbrion

    tcarrbrion Registered Member

    Joined:
    Dec 15, 2007
    Posts:
    55
    I have used Kaspersky for almost a year and it regularly found viruses in my email which gets a lot of spam. I had problems with Kaspersky slowing down my windows login. I changed to a trial of NOD32 two weeks ago. All by problems stopped but I have not had a single virus since. Can I be sure it is working? I have a tick against Thunderbird in POP3 scanning and it is not via a secure connection.
     
  2. tcarrbrion

    tcarrbrion Registered Member

    Joined:
    Dec 15, 2007
    Posts:
    55
    I have found the answer - it is not checking my email. I usually just delete all the spam but this time I found one with an attachment and tried to save it. Only then did it spot the virus. Does NOD32 work with Thunderbird?

    Theo
     
  3. Fgh

    Fgh Registered Member

    Joined:
    Dec 14, 2007
    Posts:
    29
    Location:
    France
    Hi,

    Absolutely no problem between Nod and Thunderbird ! ;)


    Fgh.
     
  4. tcarrbrion

    tcarrbrion Registered Member

    Joined:
    Dec 15, 2007
    Posts:
    55
    Any ideas why it would not work for me?
     
  5. ASpace

    ASpace Guest

    Incorrect program settings , may be ?

    I would suggest that you reinstall the program and try again as soon as you reinstall but this time with default settings (which are OK , don't worry):


    1. Download fresh new Eset v3 product from http://www.eset.com/download .
    Make sure that you choose the correct version.
    2. Uninstall your current version from Control Panel -> Add/Remove programs
    3. Reboot the computer when prompted
    4. Delete manually these folders:

    - C:\Documents and Settings\All users\Application data\Eset
    - C:\Documents and Settings\your user\Application data\Eset
    - C:\Documents and Settings\your user\Local Settings\Application data\Eset

    5. Reinstall your ESET smart protection with the file you just downloaded . Use typical install.
     
  6. tcarrbrion

    tcarrbrion Registered Member

    Joined:
    Dec 15, 2007
    Posts:
    55
    Thanks for the help.

    I have done this and I am trying to test it. In the settings I made sure thunderbird was ticked as an email client. I set it to append tag message to received and read email to all scanned messages. I then sent myself an email with an attachment read it in thunderbird and there is no tag to say it has been scanned.

    Is there a test file I can use that nod32 will pick up?

    On my other pc the log shows a instant messenger virus. Msnmsgr is ticked as a web browser but the virus was only found when it was saved to the disk. Is this to be expected

    Theo
     
  7. ASpace

    ASpace Guest

    Yes , eicar test file.
    Read this artcile . It is for v2's IMON but you can try it in v3 . Basically you need to temporary disable protections (from the Setup section) , download eicar from eicar.org , send it to your mail as attachment , immediately enabled protection and send/receive mail so that you receive it . The mail protection should pick it up.
     
  8. tcarrbrion

    tcarrbrion Registered Member

    Joined:
    Dec 15, 2007
    Posts:
    55
    Thank you, I have tried this and it now finds it correctly. I notice another change. Before I had to log in as administrator to be able to change the settings in NOD32. As my normal user it would error as I tried to save them. Now it works as a limited user. Something must have gone wrong the first time I installed it. All the settings look exactly the same now as they did then.
     
  9. ASpace

    ASpace Guest

    You are welcome !

    Enjoy! :thumb:
     
  10. tcarrbrion

    tcarrbrion Registered Member

    Joined:
    Dec 15, 2007
    Posts:
    55
    I received another real virus today and it did not detect it. I tried to save the attachment and it immediately detected it. I them emailed myself the test virus and it was detected in the email. Both came from the same email account. NOD32 is spotting the test virus in the email but not the real one!

    Any ideas?
     
  11. ASpace

    ASpace Guest

    Since it detects Eicar test file , email scanning is working . There is something specific in the file , I guess , or you have different email and real-time file system protection settings .
     
  12. tcarrbrion

    tcarrbrion Registered Member

    Joined:
    Dec 15, 2007
    Posts:
    55
    The two emails are both read with the same settings using the same program from the same email account on the same computer. Could it be the encoding of the attachment is different in the email and NOD32 fails to find it? I don't know much about the structure of emails but the headers are different.

    I have just received another email that NOD32 failed to spot. They are both netsky.q worm. Kaspersky used to pick up lots of these when I was using it.

    Theo
     
  13. ASpace

    ASpace Guest

    I really have no idea why this is happening .
    Since NOD32 real time system protection picks them up , it has signatures for them but I can only guess why it doesn't catch them upon mail downloading
     
  14. tcarrbrion

    tcarrbrion Registered Member

    Joined:
    Dec 15, 2007
    Posts:
    55
    I contacted Eset support about this problem back in December. They asked me to send me the infected emails which I did. Apart from that I have got nothing from them despite several emails. I am still getting viruses undetected. The emails have the message at the bottom to say they have been scanned but the virus is still there in an attachment undetected.

    Has anyone any advice on how to get a response from Eset support?
     
  15. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Is the number of scanned email rising in the counter window?
     
  16. tcarrbrion

    tcarrbrion Registered Member

    Joined:
    Dec 15, 2007
    Posts:
    55
    What counter window?

    I am using Thunderbird with POP3. It finds the eicar test virus if I attach it to an email. I can only think the email structure of the real virus must confuse the scanner so it misses it.
     
  17. ASpace

    ASpace Guest

    Marcos means this one - available only when working in Advanced mode
     
  18. tcarrbrion

    tcarrbrion Registered Member

    Joined:
    Dec 15, 2007
    Posts:
    55
    Yes it is going up. It shows 7 now and I have just had about 7 junk emails, now deleted.
     
  19. juanca1951

    juanca1951 Registered Member

    Joined:
    Dec 26, 2007
    Posts:
    7
    Marcos in my counter window !!always!! appears in "0" the numbers of scanned messages and infected ones.What is the problem with this? I have ticked integration with Outlook Express and Windows Live Mail.
     
  20. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Do you receive email via POP3 on port 110?
     
  21. juanca1951

    juanca1951 Registered Member

    Joined:
    Dec 26, 2007
    Posts:
    7
    Marcos, I dont know on what port I receive e-mails, I use Hotmail in Windows Live Mail.Thanks in advance for your reply
     
  22. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    I for one don't use hotmail, but I doubt it supports POP3. Can somebody confirm or deny my assumption?
     
  23. lucas1985

    lucas1985 Retired Moderator

    Joined:
    Nov 9, 2006
    Posts:
    4,047
    Location:
    France, May 1968
    IIRC, Windows Live Mail allows POP access to Hotmail. Not sure, though.
     
  24. ASpace

    ASpace Guest

    I just created one account in Windows live (previously known as Hotmail) and it seems they don't support POP3 . What they actually support should be: one gives them pop3 server and other account data and WL Mail downloads the other mail and places it in its account place . In some way it manages other POP3 accounts .

    As far as I know Hotmail and WLMails can be access via MS mail client using some HTTP communication (not POP3) . I might well be wrong but ...
     
Thread Status:
Not open for further replies.