POP TLS connection stalls when AVG mail scanner running

Posted on 2009-05-05
Last Modified: 2013-11-22
Request: Can anyone help me setup my AVG email scanner to work with Thunderbird accessing an email account that uses TLS?

OS - Windows Vista Ultimate
Anti-virus: AVG Free 8.5.325
Email Client: Mozilla Thunderbird
Email sever: Zimbra POP3 server - over which I have very little control, but if someone can tell me any setting that need to be adjusted on the server I can submit a request.

Problem: I  installed AVG Free three days ago.  Since then I have noticed that one of my email accounts has not being receiving mail - this particular account negotiates a TLS connection and have realised that since installing AVG, the email client connects to the server but never gets past the TLS connection.  Eventually (after 600 seconds) the TCP connection dies.  If I turn off the email scanner options in AVG free, the mail client connects normally and terminates normally (after downloading mail if any)
Below are two TShark dumps, with the mail server IP replaced by x.x.x.180.  The first examples shows a successful connection with the email scanner activated.  The second shows the same connection WITH the email scanner de-activated.

Additional Information:
Thunderbird server settings:
Server Type: POP Mail server
Server name: Port 110
User Name:
Security Settings: Use Secure connection TLS, if available
Use Secure authentication:- NOT selected
Server settings: No sever settings selected

Thunderbird Security settings:
No certificates or Encryption options selected.

With AVG Email scanner active: (Note 600 seconds of inactivity after packet 8)

  0.000000 -> x.x.x.180 TCP 49460 > 110 [SYN] Seq=0 Win=8192 Len=0 MSS=1260 WS=2 TSV=17385299 TSER=0

  0.256385  x.x.x.180 -> TCP 110 > 49460 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1452 TSV=3514443520 TSER=17385299 WS=7

  0.256488 -> x.x.x.180 TCP 49460 > 110 [ACK] Seq=1 Ack=1 Win=17472 Len=0 TSV=17385325 TSER=3514443520

  0.512457  x.x.x.180 -> POP Response: +OK Zimbra POP3 server ready

  0.517997 -> x.x.x.180 POP Request: CAPA

  0.777562  x.x.x.180 -> TCP 110 > 49460 [ACK] Seq=54 Ack=7 Win=5888 Len=0 TSV=3514443650 TSER=17385351

  0.777925  x.x.x.180 -> POP Response: +OK Capability list follows

  0.973338 -> x.x.x.180 TCP 49460 > 110 [ACK] Seq=7 Ack=163 Win=17308 Len=0 TSV=17385396 TSER=3514443650

600.800473  x.x.x.180 -> TCP 110 > 49460 [FIN, ACK] Seq=163 Ack=7 Win=5888 Len=0 TSV=3514593650 TSER=17385396

600.800562 -> x.x.x.180 TCP 49460 > 110 [ACK] Seq=7 Ack=164 Win=17308 Len=0 TSV=17445379 TSER=3514593650

No Email Scanner Active: Note whole transaction complete in 5 seconds

  0.000000 -> x.x.x.180 TCP 49454 > 110 [SYN] Seq=0 Win=8192 Len=0 MSS=1260 WS=2 TSV=17365859 TSER=0

  0.257058  x.x.x.180 -> TCP 110 > 49454 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1452 TSV=3514394921 TSER=17365859 WS=7

  0.257162 -> x.x.x.180 TCP 49454 > 110 [ACK] Seq=1 Ack=1 Win=17472 Len=0 TSV=17365884 TSER=3514394921

  0.513003  x.x.x.180 -> POP Response: +OK Zimbra POP3 server ready

  0.703620 -> x.x.x.180 TCP 49454 > 110 [ACK] Seq=1 Ack=54 Win=17416 Len=0 TSV=17365929 TSER=3514394985

  1.019210 -> x.x.x.180 POP Request: AUTH

  1.311944  x.x.x.180 -> TCP 110 > 49454 [ACK] Seq=54 Ack=7 Win=5888 Len=0 TSV=3514395176 TSER=17365961

  1.312291  x.x.x.180 -> POP Response: -ERR mechanism not specified

  1.316545 -> x.x.x.180 POP Request: CAPA

  1.682771  x.x.x.180 -> POP Response: +OK Capability list follows

  1.691405 -> x.x.x.180 POP Request: STLS

  1.947000  x.x.x.180 -> POP Response: +OK Begin TLS negotiation

  1.960657 -> x.x.x.180 POP Request: \026\003\001\000\226\001\000\000\222\003\001\000\002\245\225 \311\026\355\220\232|\250\f%\323\264\366b|\271\207h\370E\036w\303[~\030\002u\000\0008\300

  2.228589  x.x.x.180 -> POP Continuation

  2.231638  x.x.x.180 -> POP Continuation

  2.231692 -> x.x.x.180 TCP 49454 > 110 [ACK] Seq=174 Ack=2716 Win=17472 Len=0 TSV=17366082 TSER=3514395412

  2.491021  x.x.x.180 -> POP Continuation

  2.493185  x.x.x.180 -> POP Continuation

  2.493266 -> x.x.x.180 TCP 49454 > 110 [ACK] Seq=174 Ack=4925 Win=17472 Len=0 TSV=17366108 TSER=3514395479

  2.502879 -> x.x.x.180 POP Request: \026\003\001\000f\020\000\000b\000`\316vV;\355\273\263\322\346\330\330\366jS?\374\276,\367\261\316\355\355\017\211\324`\017\226\254\222\244\345\261\337,D,\3032%\337k\3667\206a\314A\225X\303\333\267\350\362'\301\2275\214\265J'A\341m\353v\340_9?\303\333Zh\246\244\v\362Ej\324qr\004\252\376\213G\270>\352\241m\024\003\001\000\001\001\026\003\001\0000GX#\030E\243\373\277\024|\214~\035\036\032h\215\273\273\234\016\341\217:\265\243rz\a\270*E\306\276\276;\301\234\2718[\217r\353\260\365\231\323

  2.765868  x.x.x.180 -> POP Continuation

  2.964752 -> x.x.x.180 TCP 49454 > 110 [ACK] Seq=340 Ack=4931 Win=17464 Len=0 TSV=17366155 TSER=3514395548

  3.227486  x.x.x.180 -> POP Continuation

  3.229354 -> x.x.x.180 POP Request: \027\003\001\000 \342F\367T\203\213\354\177

  3.486224  x.x.x.180 -> POP Continuation

  3.489983 -> x.x.x.180 POP Request: \027\003\001\000 MJ

  3.746227  x.x.x.180 -> POP Continuation

  3.750814 -> x.x.x.180 POP Request: \027\003\001\0000\374PT\353

  4.007085  x.x.x.180 -> POP Continuation

  4.021543 -> x.x.x.180 POP Request: \027\003\001\000@\031\2526\370\355\264\212\305\332\002\246\316\242+\353E\023U\341\242C(M\303\332\240\347~_\225\225`\271\205\262{h[\322\256\362#\372\004V[\316\022\312\334>\230\027c}\310F\326\037\236*\276\316\017

  4.284250  x.x.x.180 -> POP Continuation

  4.301080 -> x.x.x.180 POP Request: \027\003\001\000 \375\036\343\331\2275\225M\311\222\261\202\334\302\346Zk\275\002\361\340\271;#cX1\025\004\272/\025

  4.558686  x.x.x.180 -> POP Continuation

  4.585215 -> x.x.x.180 POP Request: \027\003\001\000 sy\324D\031\336\376P\340\225c\307\214\032\332\356\255T\027fo\362\333\3020Y\020\205P\237\344\305

  4.841129  x.x.x.180 -> POP Continuation

  4.841541  x.x.x.180 -> POP Continuation

  4.841606 -> x.x.x.180 TCP 49454 > 110 [ACK] Seq=610 Ack=5468 Win=16928 Len=0 TSV=17366343 TSER=3514396067

  4.854393 -> x.x.x.180 TCP 49454 > 110 [FIN, ACK] Seq=610 Ack=5468 Win=16928 Len=0 TSV=17366344 TSER=3514396067

  5.112080  x.x.x.180 -> TCP 110 > 49454 [ACK] Seq=5468 Ack=611 Win=7936 Len=0 TSV=3514396135 TSER=17366344

Open in new window

Question by:red_nectar
  • 3
  • 3
LVL 16

Expert Comment

ID: 24305391
Do you have any firewall installed??

Author Comment

ID: 24308785
No firewall - and a correction regarding the code snippet - corrections in BOLD:
The first examples shows a FAILED connection with the email scanner activated.  The second shows the same connection WITH the email scanner de-activated.
LVL 16

Accepted Solution

warturtle earned 500 total points
ID: 24308860
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline


Author Comment

ID: 24321877
Open the AVG Free User Interface application
Select Tools->Advanced settings (See diagram below)
In the list on the left hand side, select E-mail Scanner->Servers.  On the right hand side you will see a button to [Add new server]
Click on the [Add new server] button, and give the server a name (eg and leave the type as POP3
Now this is where things get tricky, (because of a bug in the AVG interface).  We actually want to specify the Type of Login as USER/COMPUTER, but (here's the bug) if you select the USER/COMPUTER option right now, you won't be able to type in your user/computer details at the prompt. So, the work-around is to select Type of login as Fixed host, enter a host as user/server:port (eg red_nectar/ THEN select Type of login as USER/COMPUTER.
In the Additional settings section, leave the local port as 10111 and set the Connection to SSL default.
Finally , make sure that under the E-mail client POP3 server activation, the checkbox is ticked to Activate this server and use it for receiving e-mail
Now, in Thunderbird, select Tools-> Account Settings, and for the account you want AVG to scan, select the Server Settings option in the left hard window. (See other diagram below). In the right hand window, set the Server Name: to and the Port to 10111 (to match the settings in AVG free).  Enter your User Name: in standard format (eg and under security settings, select TLS, if available.
The next time you check for mail, you should be prompted for your password, and so long as you get that right, you shoulod find that your email gets scanned and then ends up in your inbox where you wanted it.


Author Comment

ID: 24321898
Thanks for the lead warturtle - it put me on the right path to come to a solution which I have posted above in case anyone else needs to repeat the exercise.
LVL 16

Expert Comment

ID: 24323526
Thats good stuff, I am adding it to my knowledgebase so that I can help others in a similar situation. Thanks for the feedback and the points.

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Suggested Solutions

12 Steps to a more secure Internet experience ( Everyone who is a licensed driver initially had to pass a driving test that consisted of taking:    1. a written test    2. a road test    3. a vision test Le…
For those of you actively in the Malware fightling business, we now have available an amazing new tool in the malware wars (first recommended to me by rpggamergirl (, the Zone Advisor for the Virus and …
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now