From MozillaZine Knowledge Base

This article was written for Thunderbird but also applies to Mozilla Suite/SeaMonkey.

Manufacturers of antivirus programs often change their behavior without prior warning or sufficient testing on non-Microsoft products. Word to the wise - be conservative and cautious. And make sure you have backups of your profiles.

Preventing infection

In this article, "virus" means any malware program, including worms, trojans, etc.

Despite talk of "heuristics", most antivirus programs do not provide protection against rapidly spreading new malware infections before the antivirus companies manage to provide appropriate updates. To protect yourself against new e-mail viruses, open e-mail attachments only if you trust the sender and if the sender announces the attachment. Be alert for messages where the sender's address is spoofed (the message appears to have come from one source but in fact was sent from somewhere else) or where the attachment is announced in a way that sounds suspiciously generic (e.g., "Hi, here's the file you wanted"); both techniques are commonly used by the creators of malware to trick you into opening the attachment. If you have any suspicions about the origin or authenticity of a message, do not open any attached files until you have checked with the sender.

Do not check (enable) "View -> Display Attachments Inline".

Unless the e-mail is job-related or otherwise important, consider waiting a while before opening the attachment. This gives your antivirus program's manufacturer a chance to provide a necessary update. Be especially careful if the e-mail is not a new one and is being forwarded.

Opening attachments is the major risk, but consider using "View -> Message Body As -> Plain Text" to view a message as plain text whenever you're going to read a suspicious message. For example, reading a message in your junk mail folder to confirm whether it's really spam. Viruses and scripts rely upon the email client interpreting the message. If you view it as plain text, there is nothing to interpret (unless you click on a link in the message or open an attachment)

Keeping your antivirus software from deleting your Inbox

Thunderbird stores all of the messages that you see in your Inbox folder in a single file called "Inbox" in your profile folder. All of the other mail folders also use a single file named after the folder ("Sent.", "Drafts.", "Trash.", etc.). Some antivirus software assumes each message is stored as a separate file so when it detects a virus in your Inbox it deletes the whole file (your entire Inbox folder) rather than deleting that message. This problem is due to a design flaw in certain antivirus programs, not in Thunderbird. It is known to occur with Outlook Express , Eudora and other email clients. Fortunately, there are measures you can take to keep it from happening.

Antivirus program settings

• Use an antivirus program that's compatible with Thunderbird (listed below).
• Set your antivirus software to ask what to do or to at least only quarantine infected files rather than to automatically delete or "repair" them.
• Many experts recommend turning off email scanning in antivirus software since it provides no added protection and corrupts and destructs email folders much more often than viruses and other malware do. It also eats up CPU power, slows down sending and receiving, and causes many problems such as time-outs and changes in account settings. To be safe it's enough to make sure your antivirus software is monitoring your whole computer, in other words make sure that it provides real-time protection (also called "background guard" etc.) and that this is turned on.[1][2][3][4][5]
• If you nevertheless want to let your antivirus program scan email, it is recommended to only let it scan incoming messages because many antivirus programs have problems scanning outgoing messages, especially if you use SSL. If the recipient doesn't have an up-to-date antivirus program with real-time protection, they have bigger problems to worry about than your not scanning your outgoing mail.
• Your email provider may automatically scan messages and "remove" infected ones (prevent them from reaching your mailbox) or may provide this service for a fee and may be using better software than you can buy. Advanced users that understand the risks sometimes disable email scanning by their antivirus software and rely upon the email provider to "remove" infected messages. However, most users don't know anything about what their email provider does (for example, whether it scans both the message body and the attachments) so if you want to scan incoming mail, it's safest to always scan the mail yourself.

Thunderbird settings and use

To minimize the chance of your Inbox being quarantined or deleted:

• Compact folders regularly. Otherwise your antivirus software might detect infected messages that you've deleted. Deleted messages are just marked deleted and hidden from view but aren't physically deleted until the folder is compacted.
• If your anti-virus program can't quarantine individual messages, set Thunderbird to download each individual message to a separate file before adding it to your Inbox. Don't do this unless absolutely necessary because it slows performance and has been known to create bugs as a side effect.

To minimize the loss of mail if your Inbox ever does become quarantined or deleted:

• Keep your Inbox relatively empty by storing most old messages in other folders. That way, if your antivirus software deletes/damages your Inbox, fewer e-mails will be affected.
• If you use a POP account, configure Thunderbird to leave mail on the server for a short period (at least a few days), rather than deleting them immediately when downloaded. That way, if your antivirus software damages your Inbox you can download those messages again. To leave messages on the server for a specified number of days:
  • in Thunderbird: go to "Tools -> Account Settings -> [account name] Server Settings", check the box for "Leave messages on server" and set the number of days.
  • in Mozilla Suite: go to "Edit [in Mozilla Mail] -> Preferences -> Mail & Newsgroups Settings -> [account name] Server Settings", check the box for "Leave messages on server" and set the number of days.
• Make regular backups of your Thunderbird mail and other profile data.

Recovering a quarantined Inbox

1. Switch off the "auto-protect" feature on your anti-virus software, or otherwise deactivate your anti-virus software.
2. Back up your profile folder.
3. Make a copy of your Inbox (If you don't do this, the next step will overwrite the current Inbox with the older version in quarantine.) Right-click the account to make a new folder called OldInbox, and then copy everything in your Inbox (Ctrl+a and then right-click).
4. Take the Inbox (or other affected mail file) out of quarantine.
5. In Thunderbird, delete the infected message.
6. Empty the Trash for the affected account.
7. Compact folders for the affected account.
8. Reactivate your anti-virus software.
9. Verify that all your e-mail is present.

Other potential problems

• If you receive blank messages it might be a side effect of the antivirus program certifying that each message was safe. If "View -> Message Source" confirms that the messages are empty try disabling that feature. For example, with AVG you would use E-mail Scanner -> Configure -> (Disable)Certify mail Incoming & Outgoing and then restart your system.

• Antivirus programs can cause slow or poor performance. If you see poor performance in Thunderbird, test with antivirus turned off. See also Firewalls, Antivirus Related Performance Issues, and [6].

• Poor performance can also occur from enabling too many optional features in the anti-virus program. For example, one person had poor performance due to enabling seven "shields" in Avast!. The problem was fixed by disabling the "Behavior Shield" (it reports suspicious behavior by analyzing the behavior of programs.). [7]

Compatible antivirus programs

Avast, AVG, NOD32, and Kaspersky seem to be safe choices, and the retail version of Symantec a risky choice based on comments from the forums over several years. Symantec's Norton Antivirus does not support IMAP and its POP3 scanner frequently quarantines the Inbox according to many reports in the forums. There doesn't seem to be a consensus for CA, F-Prot, McAfee, Panda, etc., though typically enterprise versions of some anti-virus programs seem to be more compatible than retail versions. The free version of Avast seems to meet most users' needs, but there are reports of it producing blank emails when scanning outgoing mail. All antivirus programs with real-time protection (including Norton) can however be safely used by turning off email scanning since this prevents folder corruption and deletion while still providing just as much protection.[8]

We used to have a list here of which versions of anti-virus programs are compatible with Thunderbird and which aren't, but that information was typically several years out of date so it's been deleted. However, Mozilla Wiki has an up-to-date list of compatible and problematic antivirus programs here. What version of Thunderbird you use doesn't seem to effect what antivirus programs are safe choices.

Safe test virus

Many anti-virus programs (those that are EICAR compliant) can be tested to ensure some minimal level of functionality by using the European Institute for Computer Anti-Virus Research (EICAR)'s anti-virus test file.

Dropped support

AVG has stopped development of "AVG Plugin For Mozilla Thunderbird" and recommends you install the "Personal E-mail Scanner service" instead. [9] They aren't the only anti-virus manufacturer that has had problems dealing with the new rapid release cycle of Thunderbird. If your vendor doesn't have a version that supports the latest version of Thunderbird, see if you can use the generic solution they have for less popular email clients instead of the Thunderbird specific plugin.

In some cases the Thunderbird add-on (the ESET Smart Security extension for example) just adds a toolbar to report spam, and if you don't install that add-on it will still scan your messages for viruses.

See also

• Antivirus program claims Thunderbird.exe has a virus
• Email scanning - pros and cons
• Firewalls

External links

• Message body missing if a message filter moves it and you download each message to a temporary file
• Top 9 Windows Antivirus programs
• Wikipedia antivirus article It has links to three free online scanners and four testing organizations whose reports you can use to compare a anti-virus programs track record. The Virus Bulletin (free registration required) is the most popular.
• [10]
• Antivirus Related Performance Issues

• F-Secure FAQ - Why does Thunderbird freeze when sending and receiving e-mail?

• Security forums:

• Security cleanup forum at dslreports
• Security forum at dslreports
• Wilders security forums
• Spyware Warrior forums

• Eset NOD32 Beta that supports Thunderbird 3.0

• Testing anti-virus related problems