সহায়তা খুঁজুন

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

আরও জানুন

How to localize and delete the attachment from Inbox folder file?

  • 2 উত্তরসমূহ
  • 1 এই সমস্যাটি আছে
  • 5 দেখুন
  • শেষ জবাব দ্বারা ptyborow

more options

Hello,

My name is Piotr Tyborowski and I'm the Technical Support Engineer in Doctor Web. I have got such suport request - one of our customers has problem with viruses in Thunderbird's Inbox folder - our antivirus scanner has found two Trojans in one file located in Inbox file and moved the whole Inbox file to quarantine. We know that these files are located here:

>>C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part is ZIP archive C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part\KeyDLL.dll - infected with Trojan.KeyLogger.6153 C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part\KeyDLL.dll - infected >>>C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part\svhosts.exe - packed by UPX C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part\svhosts.exe - infected with Trojan.Click.27588 C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part\svhosts.exe - infected C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part - infected archive

I'm not very familiar with Thunderbird, so my question is - is is possible to get to this 12145.part file and to delete it permanetly, even with the message which cointains it inside?

Thank you in advance and Best Regards,

Piotr Tyborowski Doctor Web

Hello, My name is Piotr Tyborowski and I'm the Technical Support Engineer in Doctor Web. I have got such suport request - one of our customers has problem with viruses in Thunderbird's Inbox folder - our antivirus scanner has found two Trojans in one file located in Inbox file and moved the whole Inbox file to quarantine. We know that these files are located here: >>C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part is ZIP archive C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part\KeyDLL.dll - infected with Trojan.KeyLogger.6153 C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part\KeyDLL.dll - infected >>>C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part\svhosts.exe - packed by UPX C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part\svhosts.exe - infected with Trojan.Click.27588 C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part\svhosts.exe - infected C:\Users\Renatrix\AppData\Roaming\Thunderbird\Profiles\4dhjzo2v.default\Mail\Local Folders\Inbox.sbd\Konto WP\12145.part - infected archive I'm not very familiar with Thunderbird, so my question is - is is possible to get to this 12145.part file and to delete it permanetly, even with the message which cointains it inside? Thank you in advance and Best Regards, Piotr Tyborowski Doctor Web

সমাধান চয়ন করুন

Piotr,

If it is practical, the absolutely safest approach is to delete the entire profile folder 4dhjzo2v.default while TB is shut down.

If the person is using IMAP, or POP with the option of leaving emails on the server, there should not be a loss of emails (except in local folders).

If there are significant emails in local folders, and they are not infected, they could be exported to a storage medium and later inported to the new profile. There is an add-on to TB which allows import and export of emails in various formats.

The instructions on how to download and install it can be found at http://barryduggan.info/exportMail.php

প্রেক্ষাপটে এই উত্তরটি পড়ুন। 👍 1

All Replies (2)

more options

চয়ন করা সমাধান

Piotr,

If it is practical, the absolutely safest approach is to delete the entire profile folder 4dhjzo2v.default while TB is shut down.

If the person is using IMAP, or POP with the option of leaving emails on the server, there should not be a loss of emails (except in local folders).

If there are significant emails in local folders, and they are not infected, they could be exported to a storage medium and later inported to the new profile. There is an add-on to TB which allows import and export of emails in various formats.

The instructions on how to download and install it can be found at http://barryduggan.info/exportMail.php

more options

Hello,

Thank you for answer. The problem is already solved - fortunately the user was able to localize this infected e-mail. She has deleted it, purged TB cache and temp files and after that the anti-virus scanner stopped finding any threats in the system.

Anyway, thank you for your help.

Best Regards,

Piotr Tyborowski Doctor Web