Antivirus software

This article was written for Thunderbird but also applies to Mozilla Suite/SeaMonkey.

Preventing infection

In this article, "virus" means any malware program, including worms, trojans, etc.

Despite talk of "heuristics", most AV programs do not provide protection against rapidly spreading new malware infections in the many hours before the AV companies manage to provide appropriate updates. To protect yourself against these new e-mail viruses, open e-mail attachments only if you trust the sender and if the sender announces the attachment. Additionally, be alert for messages where the sender's address is spoofed (the message appears to have come from one source but in fact was sent from somewhere else) or where the attachment is announced but in a way that sounds suspiciously generic (e.g., "Hi, here's the file you wanted"); both techniques are commonly used by the creators of malware to trick you into opening the attachment. If you have any suspicions about the origin or authenticity of a message, do not open any attached files until first checking with the sender.

Do not check (enable) "View -> Display Attachments Inline".

Unless the e-mail is job-related or otherwise important, you may also wish to consider waiting a while before opening the attachment. This gives your AV program's manufacturer a chance to provide a perhaps necessary new update. Be especially careful if the e-mail is not a new one and is being forwarded.

While opening attachments is the major risk, you might consider using "View -> Message Body As -> Plain Text" to view a message as plain text whenever you're going to read a suspicious message. For example, reading a message in your junk mail folder to confirm whether its really spam. Viruses and scripts rely upon the email client interpreting the message. If you view it as plain text there is nothing to interpret (unless you click on a link in the message or open an attachment)

Keeping your antivirus software from deleting your Inbox

Thunderbird stores all of the messages that you see in your Inbox folder in a single file called "Inbox." in your profile folder. All of the other mail folders also use a single, correspondingly named file ("Sent.", "Drafts.", "Trash.", etc.). Some antivirus software assumes each message is stored as a seperate file so when it detects a virus in your Inbox it deletes the whole file (your entire Inbox folder) rather than deleting that message. This problem is due to a design flaw in certain AV programs, not in Thunderbird, and it is known to occur with Outlook Express , Eudora and other email clients. Fortunately, there are measures you can take to keep it from happening.

Antivirus program settings

• RECOMMENDED: Use an antivirus program that's compatible with Thunderbird (listed below).
• IMPORTANT: Set your antivirus software to ask what to do or to at least only quarantine infected files rather than to automatically delete or "repair" them.
• If your antivirus software includes a proxy for incoming e-mail, which scans for viruses before they reach Thunderbird, use it and keep it updated.

Advanced users might also wish to configure their AV software as follows. (For explanation of the rationale behind these measures, see Email scanning - pros and cons.)

• Especially if you must use an incompatible antivirus program, configure it to not scan Thunderbird's "Inbox" file (located in your profile folder) for viruses. You may also want to exclude other mailbox files (such as "Sent", "Templates", etc.) from being scanned.
• Even if your AV program is compatible with Thunderbird, consider turning off your AV program's e-mail scanning but not its autoprotect function.
• Even if your AV program is compatible with Thunderbird, consider also configuring it to not scan the Inbox and other mailbox files during system scans and to not let autoprotect monitor these files.

Thunderbird settings and use

To minimize the chance of your Inbox being quarantined or deleted:

• Compact folders regularly. Otherwise your antivirus software might detect infected messages that you've deleted. Deleted messages are just marked deleted and hidden from view but aren't physically deleted until the folder is compacted.
• Try setting Thunderbird (version 1.5 or later) to download each individual message to a separate file before adding it to your Inbox. This should make it easier for some antivirus software to quarantine individual messages instead of taking action on the whole Inbox file.

To minimize the loss of mail if your Inbox ever does become quarantined or deleted:

• Keep your Inbox relatively empty by storing most old messages in other folders. That way, if your antivirus software deletes/damages your Inbox, fewer e-mails will be affected.
• If you use a POP account configure Thunderbird to leave mail on the server for a short period (e.g., 3 days), rather than deleting them immediately when downloaded. That way, if your antivirus software damages your Inbox you can download those messages again. To leave messages on the server for a specified number of days:
  • in Thunderbird: go to "Tools -> Account Settings -> [account name] Server Settings", check the box for "Leave messages on server" and set the number of days.
  • in Mozilla Suite: go to "Edit [in Mozilla Mail] -> Preferences -> Mail & Newsgroups Settings -> [account name] Server Settings", check the box for "Leave messages on server" and set the number of days.
• Make regular backups of your Thunderbird mail and other profile data.

Other measures

• Consider using third-party software such as Mailwasher that will remove infected messages from the server before Thunderbird downloads them.
• Use an e-mail provider (usually, your ISP [Internet Serivce Provider] or hosting company) that scans incoming e-mail for viruses.

Recovering a quarantined Inbox

1. Switch off the "auto-protect" feature on your anti-virus software, or otherwise deactivate your anti-virus software.
2. IMPORTANT: back up your profile folder.
3. Take the Inbox (or other affected mail file) out of quarantine.
4. In Thunderbird, delete the infected message.
5. Empty the Trash for the affected account.
6. Compact folders for the affected account.
7. Reactivate your anti-virus software.
8. Verify all your e-mail is present.

Other potential problems

• If you receive blank messages it might be a sideffect of the antivirus program certifying that each message was safe. If "View -> Message Source" confirms that the messages are empty try disabling that feature. For example, with AVG you would use E-mail Scanner -> Configure -> (Disable)Certify mail Incoming & Outgoing and then restart your system.

• Many antivirus programs have problems scanning outgoing messages, especially if you use SSL. It is recommended you only scan incoming messages. If the recipient doesn't scan their incoming messages they have bigger problems to worry about than your not scanning your outgoing mail.

Compatible antivirus programs

Avast, AVG, NOD32, and Kaspersky seem to be safe choices, and the retail version of Symantec a risky choice based on comments from the forums over several years. There doesn't seem to be a consensus for CA, F-Prot, McAfee, Panda etc. though typically enterprise versions of any anti-virus program seem to be more compatible than retail versions. We used to try identify what versions of anti-virus programs worked and didn't work but that information was typically several years out of date so its been deleted.

The free version of Avast seems to meet most users needs.

Safe test virus

If you are unsure whether your anti-virus program is really scanning for viruses the European Institute for Computer Anti-Virus Research (EICAR) web site has a anti-virus test file that is supposedly supported by all leading anti-virus programs. This web site claims it will send you that same file (the EICAR test virus ) in a email message. Obviously you need to be very carefull where you get this file to avoid getting a harmful virus in disguise. Perhaps the safest approach is to look on your vendors web site for some mention of it. For example, Avast has a EICAR Standard Antivirus Test File Informationweb page while AVG has a link to the EICAR home web page at Interesting Pages.

See also

• Antivirus program claims Thunderbird.exe has a virus

External links

• Castle Cops security forums
• Security cleanup forum at dslreports
• Security forum at dslreports
• Wikipedia antivirus article It has links to three free online scanners and four testing organizations whose reports you can use to compare a anti-virus programs track record. The Virus Bulletin (free registration required) is the most popular.
• Wilders security forums
• F-Secure FAQ - Why does Thunderbird freeze when sending and receiving e-mail?