This is what your image tells me, so I will try to explain.

The C:\Users\User name\AppData\Roaming\Thunderbird\Profiles\'profile name' folder is where your profile folder is by default created. It contains all the mail accounts you created. You have an IMAP mail account in Thunderbird because it is in the 'ImapMail' folder

Imap accounts synchronise their folders with the server folders, so they can display whatever is on the server. The 'INBOX' contains some downloaded emails. One of those emails appears to have a Subject 'Order Confirmation ' email. That same email contains an attachment. In this instance I would be wary because it is an .exe file. You are correct to never open any attachment if you are not certain what it is and never open anything that has .exe as extension. This email is a scam and not trustworthy. Your Anti-virus did a good job letting you know about it.

However - Antivirus Programs do not understand that the 'INBOX' mentioned is not a folder - it is an mbox file. The Anti-Virus correctly identified a bad email - but do not let the Anti-Virus fix the problem because it is likely to delete everything in the 'INBOX' mbox file or cause bad corruption to that file, so you could lose any other email in the Inbox and because you have an imap account, that means if you lose emails, then they could also get deleted off the server.

Info: When emails get downloaded to the 'imap account 'Inbox' - they get added to a text file - not a folder. So the mbox text file is a simple text document where the email is added one after the another. New downloaded emails get added to the document.

So, what do you do ? In Thunderbird, locate that email which might be in the 'INBOX' or in the 'SPAM' folder and delete it. You might have already deleted that email. However, that is not enough. All emails that get 'moved' or 'deleted' will appear in the folder they are moved to, but the original email is still has a copy in the original folder. It is now hidden and marked as deleted. It is possible that the Anti-Virus has located a previously deleted email.

Periodically, you should let Thunderbird perform some basic housekeeping to help maintain files and folders and this is called 'compacting'. You need to compact the Inbox folder in order to fully remove all hidden traces of the email.

• Right click on INBOX folder and select 'Compact'.

This will completely remove any hidden traces of a previously moved or deleted email. It will completey resolve the problem and your computer will be safe.

You can also set up the account to auto compact the 'Inbox' when you exit Thunderbird.

• Right click on imap mail account name in Folder Pane and select 'Settings'
• Select 'Server Settings'

Under 'Message Storage'

• Select 'Clean up (Expunge) Inbox on Exit'

Here is some additional info to help you with 'Compact' https://support.mozilla.org/en-US/kb/compacting-folders

re :Attachments getting saved to PC, despite not opening them.

The attachments are part of the email. They are not saved separately. It is just a downloaded file. The AntiVirus has detected it. The fact that it appears to be downloaded to your computer is correct. But it does not mean it has been opened nor saved outside of Thunderbird. It simply means you have an imap mail account and it downloaded emails.

All of these are 'Folders': C:\Users\User name\AppData\Roaming\Thunderbird\Profiles\vipg1yrh.default-release\ImapMail\mail.accountname But 'INBOX' is a file. 'Order Confirmation 4500159299.r15' is the 'Subject' of an email which is in the 'INBOX' file. If you have any emails downloaded and in the INBOX folder shown in Folder Pane then all of them will be in the same 'INBOX' mbox file. 'Order Confirmation 4500159299.exe' is the name of an attachment which is attached to the above email.

Basically - do not panic. All is OK. If Anti-Virus ever detects a bad email, then delete it in Thunderbird, followed by compacting and you will be ok.

Thanks for explaining about the "compact" feature, I didn't know about that one. However, some things that you have said don't exactly add up with my own research and observation results.

'Order Confirmation 4500159299.r15' is the 'Subject' of an email

No it is not, it's a file itself, an archive of some sort. I've seen many attachments in emails, whose extensions are something like .r2 .r5 .r15 etc.

However - Antivirus Programs do not understand that the 'INBOX' mentioned is not a folder - it is an mbox file. The Anti-Virus correctly identified a bad email - but do not let the Anti-Virus fix the problem because it is likely to delete everything in the 'INBOX' mbox file or cause bad corruption to that file

This also appears to be wrong, as I let antivirus do it's job, it deleted the bad file and left everything else alone. My guess is, INBOX is some sort of compressed folder or, again, an archive, that contains files, images of recieved emails.

re: My guess is, INBOX is some sort of compressed folder or, again, an archive, that contains files, images of recieved emails.

No it is not. It is your Inbox mbox file and it contains all your emails that you see in the Inbox folder located in the Folder Pane.

You can easily locate your profile to see for yourself. It is the same location where you would go to create a backup.

In Thunderbird Menu app icon > Help > More Troubleshooting Information Under 'Application Basics' - half way down - Profile Folder - click on 'Open Folder' see image below as guide.

A new window opens showing the contents of your 'profile name' folder called 'vipg1yrh.default-release' in this location:

• C:\Users\User name\AppData\Roaming\Thunderbird\Profiles\vipg1yrh.default-release

Exit Thunderbird now.

Click on 'ImapMail' folder Click on imap mail account name You will see an Inbox file with no extension. That is the Inbox which contains all downloaded emails. You can open the file using a text editor program like Notepad++

You will see emails one after the other. The oldest will be at the top and newest at the bottom.

If you want to create a backup now then go back up the folder directory to the 'Roaming' folder and copy the 'Thunderbird' folder to an external drive. This would be a backup. See image below as a guide.

An alternative to locating the same location to create a backup: Exit Thunderbird

In Windows search type : %APPDATA% and select the %APPDATA% file folder. Then click on 'Roaming' You will see the 'Thunderbird' folder which you would need to copy and paste into an external drive to be your backup copy.

There is a method that does store emails as separate .eml files in a folder, but it is not the default setting in Thunderbird. You would have needed to set up the use of Maildir when you initially set up Thunderbird and it is not something advised as it is still being perfected, so not something a novice would do. It does have it's risks.

• https://support.mozilla.org/en-US/kb/maildir-thunderbird

re :as I let antivirus do it's job, it deleted the bad file and left everything else alone. You were very fortunate. Sadly this is not the experience of many people. Some Anti-Virus are better than others, but it is risk.

This link offers some info: http://kb.mozillazine.org/Thunderbird_:_FAQs_:_Anti-virus_Software

You can open the file using a text editor program like Notepad++

OK, you're right on this one, but then I don't understand what the antivirus detected and deleted. Because it did delete something, as the second time I ran a scan it didn't detect threats.

If you had previously deleted the email with bad attachments and then followed my advice to 'compact' the Inbox folder then Thunderbird would have removed it anyway, so the Anti-Virus would not detect it.