Norton flagged an e-mail with a virus and quarantined my entire Inbox, which now can't be recovered.
Last night Norton flagged an e-mail with a virus. When I clicked on "fix" to quarantine the virus I got a warning that the file is too big and once quarantined cannot be recovered. I thought this meant the infected file attached to the e-mail. Turns out it was my entire Inbox. Now I can't access any of the old messages. They come up blank. Also on the hard disk there is a file "Inbox" but no folder "Inbox". Is there any way to recover the lost Inbox? Thanks much.
الحل المُختار
Your unresponsive script is also most likely Norton. Personally I don't think anti virus programs need to be trawling through and scanning Thunderbird's data files and suggest that the profile folder be excluded from on access scanning or all scanning.
When your mail comes in Norton scans it, why do they need to repeat that process over and over? Well my experience is to find that virus they just installed a definition for that you received weeks ago. It did nothing to your system when it arrived as Thunderbird sanitizes HTML, prevents scripts and Flash. Now they need to rip the thread out. Like having a gun under your bed, never hurt anyone or anything unless someone consciously does something with it.
Read this answer in context 👍 1All Replies (9)
This is a question for Symantec. I have been laughed at for years on their forums for saying their product and the take no prisoners approach is utter rubbish. Perhaps they would care to work with you to repair the damage their cavalier approach has wrought. Recovery will be very difficult and may take a skilled person hours. From what you say our and not skilled so perhaps Symantec has a skilled person to fix their mess.
Contacting Symantech was the first thing I did. Waste of time. I did however recover the lost e-mails (on my own - no thanks to the idiots at Symantech) using a deep-scan recovery software. The only problem now is I don't know how to stick them back into my Thunderbird inbox. The e-mails were recovered into a folder named Inbox with each e-mail in a separate .eml file. Do I simply move the folder into the Mail folder of Thunderbird? Or is there another more intricate procedure? I don't want to do anything before I am positive it won't mess things up further.
go to the folder with the EML file in windows explorer select all (ctrl+A) drag them into Thunderbird and drop them in the folder you want them in.
Thunderbird will take care of converting the EML files into it's own MBOX format and storing them.
The reverse is also true. Drag a mail from Thunderbird to the file system and Thunderbird creates an EML file
Oh, cool! Thanks for the advice! Before I do that I'd like to clarify one thing. So, I still have e-mails showing in my inbox - but they are blank. When I click on an e-mail they come up blank including the message source. Should I delete them first? And then move the recovered e-mails into the empty Inbox folder? Thank you for your help.
File menu (alt+F) > compact folders.
That should remove your blank emails.
It worked. Thanks so much for your help, Matt! Of course the files got corrupted somewhere along the way and the dates are all messed up now but at least I have what looks like all the e-mails (which will need to be thinned down from 40K to a few thousand and then put in their respective folders).
To recap for those with a similar problem... I used Recuva free deep-scan software to scan the drive where my Thunderbird folders are (not C) to find the deleted Inbox. Recuva recovered the e-mails in the .eml format into a .zip file. Unzipped the files into the Windows folder, selected all and dragged them into the Inbox. Took forever. Kept getting "slow running script" message and had to click "continue" like 40 times... But it got done. Once again props to Matt for being extremely helpful.
الحل المُختار
Your unresponsive script is also most likely Norton. Personally I don't think anti virus programs need to be trawling through and scanning Thunderbird's data files and suggest that the profile folder be excluded from on access scanning or all scanning.
When your mail comes in Norton scans it, why do they need to repeat that process over and over? Well my experience is to find that virus they just installed a definition for that you received weeks ago. It did nothing to your system when it arrived as Thunderbird sanitizes HTML, prevents scripts and Flash. Now they need to rip the thread out. Like having a gun under your bed, never hurt anyone or anything unless someone consciously does something with it.
Agreed. I will exclude Thunderbird from Norton, thanks. It will still scan an attached file if I try to open it, right? (not that I would click on a suspicious file but I do have kids...) And it will still block a malicious website if I click on a link in an e-mail, correct?
It is a matter of understanding what happens. An attachment is stored and transmitted in an email in what is called MIME encoding. Basically it is reduced to text. So in a mail client you see an attachment and a file name, the reality is at that time the file simply does not exist.
You double click the attachment to open it and on the fly the text mime encoded document is converted back to it's original binary representation. This assembly obviously occurs in memory, but for say word to open the file it has to exist somewhere in the file system. So the file is written to the Temp folder and word is passed the file location as a part of it's startup.
Looking at this process we have. Memory assembly (Nortons claims to be constantly scanning memory for virus code/Signatures) Write to disk (Nortons claim to scan all files before they are written. Open from Disk by Word (Nortons claims to scan all files as they are opened.)
So even without email scanning Nortons, by their own marketing claims, have had three opportunities to scan this unknown and malicious file. I have no doubt that the read and write scans do occur. That is what makes for the timeout messages in Thunderbird.
This is all void if the attachment is password encrypted. But email scanning does not save you then either. as the content is not unencrypted for anything to scan it until after you enter the password.
Now for a last item. Check the entry in Tools menu > options > Security > anti virus has a tick. So any incoming mail is written to the temp file in the temp folder before it goes into your mail store. Just another check really.
Modified