>>2. I think there's a trend to have them run in the cloud (so in effect all your mail gets intercepted and scanned by a 3rd party). If the connection is encrypted then that might require an SSL cert. well From the image in your last message it looks like that cert is issued by Avast, so you could try installing it. If you do that you might want to manually install it in the Trusted Root store so it has the greatest possible scope. That said, Avast and other AV products are needed most by unsophisticated users, and there's absolutely no way they can be expected to do things like manually install certs.
>
>Tech magazine I consider quite good in technical knowledge reported late last year that virus writers had targeted patterns used to filter "in the cloud" as well as flooded some mail adress extensions - with the net result that cloud filtering was cut back in a large degree.

They probably figured out it's cheaper for them to steal cycles on your PC for scanning, rather than running their own cloud infrastructure to do that :-/

>I currently view mails first on mobile device without downloading, deleting all mails I consider fraudulent with most of them being deleted without their payload ever going inside my net: just from title and adress. Others are checked when mobile device is in a WLAN only accesing my DMZ devices (front rooter mostly, sometimes guests) and delete a few more: less chances of a virus/worm getting into my safe zone.
>Then all remaining mails are loaded into a VM with no other purpose. I hate the effort, but skipped some vectors which hit friend machines.

ISTR you saying you got hit with a serious physical infiltration IRL, so I can't blame you for your emphasis on security. With those e-mail measures in place have you seen any evidence of sophisticated attacks specifically directed at you?