PS Searching '3xPM5BwYvQVewuv.exe' returns only a few reports from www.joesandbox.com '

I just checked the Norton 360 log and found that it quarantined a file from the inbox on Oct 9. , 3xPM5BwYvQVewuv.exe.

Inbox is just one mbox file containing all messages. Hence anti-virus software attempting to quarantining individual messages is problematic at best. More often than not anti-virus software corrupts the Thunderbird Inbox file, and you do see the effects as described above. Even though Thunderbird may be able to repair the corruption, this often results in loss of messages as a result of the corruption.

Therefore, if there is a recent backup available I'd restore that, instead of trying to repair the damage.

To prevent anti-virus from corrupting Thunderbird files in the first place follow these generic suggestions.

Create an exception in your anti-virus software for the Thunderbird profile folder, so that the anti-virus real-time scanner will not scan it. https://support.mozilla.org/en-US/kb/profiles-where-thunderbird-stores-user-data#w_how-to-find-your-profile

Don't let your anti-virus software scan incoming and outgoing messages.

Don't let your anti-virus software scan attachments.

Don't let your anti-virus software intercept your secure connection to the server.

Remove any add-ons your anti-virus software may have installed in Thunderbird.

Keep it working. http://kb.mozillazine.org/Keep_it_working_-_Thunderbird

And last but not least, backup your Thunderbird profile on a regular basis. https://support.mozilla.org/kb/profiles-where-thunderbird-stores-user-data#w_backing-up-a-profile

Thanks for the help

I checked Thunderbird settings and 'allow anti-virus clients to quarantine individual incoming messages' was checked. If I exclude my TB profile from Norton scans than how do you prevent an incoming message or one with an inline or attached file from infecting the computer?

I'm assuming that xPM5BwYvQVewuv.exe was suspicious and not a legitimate message attachment because the only reference a search found was on joesandbox.com.

So since Norton moved more that the suspect message and messed up the inbox I would think it would be okay to replace only the Inbox and Inbox.msf files from a backup. This would leave the Local folders, etc. intact as there seems to be no problem with them.

I looked at the links and the Mozilla info seems current but the mozillazine talks about very old versions. I used to have an import/export add-on that was removed many versions ago because legacy support was dropped. I'll have to check for a current one if one exists.

ImportExportTools NG for TB 91:

https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/

Merely having a message with an infected attachment in your mail folder is not a threat unless you attempt to launch it, which should be scanned by the real-time background AV process. The recommendation is to not allow AV scanning of the profile folder or secure connections; the real-time scan should be maintained.

If you save a folder as eml files (select all, Ctrl+S), scan the eml files and see if you can find the message that has been flagged.

If I exclude my TB profile from Norton scans than how do you prevent an incoming message or one with an inline or attached file from infecting the computer?

Even if there is a malicious attachment in an email, nothing will ever happen as long as nobody is silly enough to attempt to open or run it. Even then, you are still protected from malware by your anti-virus software other protection features. With the real-time scan turned on (which should be by default) it will scan all the files and attachments on access and will alert you if there is any infection.

So since Norton moved more that the suspect message and messed up the inbox I would think it would be okay to replace only the Inbox and Inbox.msf files from a backup.

Yes. Delete the existing and potentially corrupted Inbox.msf file. Don't restore the backed up Inbox.msf file, it will be rebuilt automatically when Thunderbird starts.

... mozillazine talks about very old versions.

MozillaZine isn't being updated anymore since quite a while. It's read-only, but it still has lots of useful information. Note, MozillaZine is not affiliated with Mozilla in any way.

I used to have an import/export add-on that was removed many versions ago because legacy support was dropped.

It's now called ImportExportTools NG. https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/

Thanks to all for the help! Norton tech support is lacking.

The person with the inbox problem did remember getting an unsolicited email with numbers and letters a dash, numbers and letters a dash, repeated more than filling the message header bar. This was never opened but put in the trash and then emptied a day or 2 later. Thunderbird used to auto compact a lot more in the past but the last several months it does it rarely. I was wondering if she hadn't compacted manually lately then that could have been the problem email but then again Norton reported it in the Inbox not the trash. Am i correct that even though the trash may be empty the messages are marked and don't actually delete until compacting?

I will delete the Inbox and let it recreate. We have Retrospect incremental backups so I can restore a few profile versions and take the last one that was good and try my old Emailchemy program I bought to transfer AOL emails to Thunderbird. I could then look for any important emails that were lost when the Inbox was corrupted without having to bring the restored Inbox back into Thunderbird.