Thunderbird AOL POP old emails not viewing correctly, possible virus problem
We have a Windows 7 pro with Thunderbird v78.10.2 that's been using TB for many years and a new laptop with Windows 10 TB v92.0 that has the same aol pop account. Just recently some of the old emails, Oct 8 and earlier, most previous read are having display problems. Some of them are blank (viewed in split screen or opened in new window) and some older ones either display the wrong message contents in split screen or show code instead of the message. The Win10 lap top has just a few months of messages but has the same problem with messages Oct 8 and earlier.
I just checked the Norton 360 log and found that it quarantined a file from the inbox on Oct 9. , 3xPM5BwYvQVewuv.exe.
Other AOL accounts on another computer are fine. The Win7 one with the problem has the profile we were going to copy to the new Win10 laptop when she starts using full that after transferring her documents. Is there a way of straightening out this inbox or do we look for are latest Retrospect backup before the problem and replace the bad profile folder contents?
Here is the full quarantine log from Norton 360. it seems you can only attach an image.:
Filename: Inbox Threat name: Compressed threatsFull Path: C:\Users\Donna\AppData\Roaming\Thunderbird\Profiles\zxg20mv2.default-release\Mail\pop.aol.com\Inbox ____________________________ ____________________________ On computers as of 10/14/2021 at 6:29:47 PM Last Used 10/9/2021 at 11:42:07 AM Startup Item No Launched No Threat type: Virus. Programs that infect other programs, files, or areas of a computer by inserting themselves or attaching themselves to that medium. ____________________________ Inbox Threat name: Compressed threats Locate Few Users Hundreds of users in the Norton Community have used this file. New This file was released 15 days ago. High This file risk is high. ____________________________ Source: External Media ____________________________ File Actions 3xPM5BwYvQVewuv.exe [Contained in] New Order.r15 [Contained in] Unknown01C18AB0.data [Contained in] C:\Users\Donna\AppData\Roaming\Thunderbird\Profiles\zxg20mv2.default-release\Mail\pop.aol.com\Inbox Removed ____________________________
File Thumbprint - SHA: Not available File Thumbprint - MD5: Not available
All Replies (6)
PS Searching '3xPM5BwYvQVewuv.exe' returns only a few reports from www.joesandbox.com '
I just checked the Norton 360 log and found that it quarantined a file from the inbox on Oct 9. , 3xPM5BwYvQVewuv.exe.
Inbox is just one mbox file containing all messages. Hence anti-virus software attempting to quarantining individual messages is problematic at best. More often than not anti-virus software corrupts the Thunderbird Inbox file, and you do see the effects as described above. Even though Thunderbird may be able to repair the corruption, this often results in loss of messages as a result of the corruption.
Therefore, if there is a recent backup available I'd restore that, instead of trying to repair the damage.
To prevent anti-virus from corrupting Thunderbird files in the first place follow these generic suggestions.
Create an exception in your anti-virus software for the Thunderbird profile folder, so that the anti-virus real-time scanner will not scan it. https://support.mozilla.org/en-US/kb/profiles-where-thunderbird-stores-user-data#w_how-to-find-your-profile
Don't let your anti-virus software scan incoming and outgoing messages.
Don't let your anti-virus software scan attachments.
Don't let your anti-virus software intercept your secure connection to the server.
Remove any add-ons your anti-virus software may have installed in Thunderbird.
Keep it working. http://kb.mozillazine.org/Keep_it_working_-_Thunderbird
And last but not least, backup your Thunderbird profile on a regular basis. https://support.mozilla.org/kb/profiles-where-thunderbird-stores-user-data#w_backing-up-a-profile
Thanks for the help
I checked Thunderbird settings and 'allow anti-virus clients to quarantine individual incoming messages' was checked. If I exclude my TB profile from Norton scans than how do you prevent an incoming message or one with an inline or attached file from infecting the computer?
I'm assuming that xPM5BwYvQVewuv.exe was suspicious and not a legitimate message attachment because the only reference a search found was on joesandbox.com.
So since Norton moved more that the suspect message and messed up the inbox I would think it would be okay to replace only the Inbox and Inbox.msf files from a backup. This would leave the Local folders, etc. intact as there seems to be no problem with them.
I looked at the links and the Mozilla info seems current but the mozillazine talks about very old versions. I used to have an import/export add-on that was removed many versions ago because legacy support was dropped. I'll have to check for a current one if one exists.
ImportExportTools NG for TB 91:
https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/
Merely having a message with an infected attachment in your mail folder is not a threat unless you attempt to launch it, which should be scanned by the real-time background AV process. The recommendation is to not allow AV scanning of the profile folder or secure connections; the real-time scan should be maintained.
If you save a folder as eml files (select all, Ctrl+S), scan the eml files and see if you can find the message that has been flagged.
If I exclude my TB profile from Norton scans than how do you prevent an incoming message or one with an inline or attached file from infecting the computer?
Even if there is a malicious attachment in an email, nothing will ever happen as long as nobody is silly enough to attempt to open or run it. Even then, you are still protected from malware by your anti-virus software other protection features. With the real-time scan turned on (which should be by default) it will scan all the files and attachments on access and will alert you if there is any infection.
So since Norton moved more that the suspect message and messed up the inbox I would think it would be okay to replace only the Inbox and Inbox.msf files from a backup.
Yes. Delete the existing and potentially corrupted Inbox.msf file. Don't restore the backed up Inbox.msf file, it will be rebuilt automatically when Thunderbird starts.
... mozillazine talks about very old versions.
MozillaZine isn't being updated anymore since quite a while. It's read-only, but it still has lots of useful information. Note, MozillaZine is not affiliated with Mozilla in any way.
I used to have an import/export add-on that was removed many versions ago because legacy support was dropped.
It's now called ImportExportTools NG. https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/
Thanks to all for the help! Norton tech support is lacking.
The person with the inbox problem did remember getting an unsolicited email with numbers and letters a dash, numbers and letters a dash, repeated more than filling the message header bar. This was never opened but put in the trash and then emptied a day or 2 later. Thunderbird used to auto compact a lot more in the past but the last several months it does it rarely. I was wondering if she hadn't compacted manually lately then that could have been the problem email but then again Norton reported it in the Inbox not the trash. Am i correct that even though the trash may be empty the messages are marked and don't actually delete until compacting?
I will delete the Inbox and let it recreate. We have Retrospect incremental backups so I can restore a few profile versions and take the last one that was good and try my old Emailchemy program I bought to transfer AOL emails to Thunderbird. I could then look for any important emails that were lost when the Inbox was corrupted without having to bring the restored Inbox back into Thunderbird.