NIS 2010 Protection for Thunderbird

DaveAlexander · ‎03-16-2010

This is my first time out here, thanks in advance for your wisdom and guidance.

My question, though the overall topic is rather well documented in earlier threads, remains unanswered. Are my Thunderbird incoming and outgoing e-mails being scanned by NIS 2010?

I am running Windows XP Pro, SP2. I was using Eudora 5.2 EMail Client with NIS 2010 and getting little pop-up messages (near the icon tray) stating that outoging e-mails and/or attachments were being scanned. (As Lynn noted in an earlier post, incoming e-mails get no message.) I switched to Thunderbird v3.0.3 and those little outgoing scan-messages ceased. So, no messages about scan progress in either direction, left my mind to wondering -- am I protected? Any scans happening at this level?

To clarify a bit further... I still have a functional version of Eudora and the pop-up message still happens. I also have a little program that, supposedly, sends encrypted e-mails; it for sure sends regular e-mails and the pop-up message also appears. So it is only Thunderbird that somehow gets ignored, at least does not trigger the affirming scan message.

So, how do I know that I am getting scans and protection at the e-mail level? (I realize that AutoProtect covers me a layer deeper.)

Thanks again, Dave...

SendOfJive · ‎02-07-2009

Hi DaveAlexander,

I am also using Thunderbird 3.0.3 and I do get the email scanning verification pop-up when sending mail, so there is indeed something amiss with your setup. In Thunderbird, is your outgoing server set for port 25?

DaveAlexander · ‎03-16-2010

Hello SendOfJive,

No, I am among those whose provider (earthlink) shifted them to port 587 (though many folks out here refer to 578). Still, Thunderbird sends and recieves e-mail just fine, and NIS 2010 clearly monitors the port because two other e-mail clients trigger the pop-up.

THANKS for helping, Dave...

SendOfJive · ‎02-07-2009

Hi DaveAlexander,

I am not sure why you are getting Norton outbound scan verifications with your other two email clients. You shouldn't if they are configured to use port 587. Norton does only scan traffic on ports 25 for outgoing and 110 for incoming. My ISP allows either port 25 or 587 for sending, so as a test I just tried both in Thunderbird by forwarding a message with an attachment to myself. I successfully received the message using both ports, but Norton only scanned and alerted to the scan when port 25 was used. So I believe that is what you have encountered.

DaveAlexander · ‎03-16-2010

Thanks SendOfJive,

After I wrote you, I had a similar thought -- I do not know what ports the other programs use, so change my Thunderbird Port to 25 and give it a go. I messed up the first time (forgetting to turn off Silent Mode), but got it right the second time and the scanning message appeared loud and long and clear. Thanks!

On a stranger note, however, two things....

When I messed up that first time the attachment may NOT have been scanned. There was almost no CPU usage compared to when it really did it (~14% cpu reading on svchost.exe when in Silent Mode compared to ~90% when Silent Mode was off.) I cannot tell if the message itself was scanned, it was too small. I sent the exact same message with the exact same attachment both times.

So while I was at it, Silent Mode off, outgoing Port 25, I sent the e-mail and attachment back to myself. Again, there was almost no CPU activity on svchost.exe, only about 14% again. Seems illogically weird unless it requires almost no effort to scan, but a big effort to hold the message pop-up on the screen with an active progress bar within it. Could be I suppose.

Thanks again, I am very well informed now, Dave....