Antivirus software

This article was written for Thunderbird but also applies to the Mozilla Suite.

Preventing infection

In this article, "virus" means any malware program, including worms, trojans, etc.

Despite talk of "heuristics", most AV programs do not provide protection against rapidly spreading new malware infections in the many hours before the AV companies manage to provide appropriate updates. To protect yourself against these new e-mail viruses, open e-mail attachments only if you trust the sender and if the sender announces the attachment. Additionally, be alert for messages where the sender's address is spoofed (the message appears to have come from one source but in fact was sent from somewhere else) or where the attachment is announced but in a way that sounds suspiciously generic (e.g., "Hi, here's the file you wanted"); both techniques are commonly used by the creators of malware to trick you into opening the attachment. If you have any suspicions about the origin or authenticity of a message, do not open any attached files until first checking with the sender.

Unless the e-mail is job-related or otherwise important, you may also wish to consider waiting a while before opening the attachment. This gives your AV program's manufacturer a chance to provide a perhaps necessary new update. Be especially careful if the e-mail is not a new one and is being forwarded.

Keeping your antivirus software from deleting your Inbox

Thunderbird stores all the different messages that you see in your Inbox folder in a single file called "Inbox" in your profile folder. Each of your other mail folders likewise consists of a single, correspondingly named file (Sent, Drafts, Trash, etc.). Some antivirus software unfortunately isn't familiar with Thunderbird, so when it detects a virus in your Inbox, it takes action on the whole file (your entire Inbox) instead of taking action on just one e-mail. For instance, if your antivirus software is set to automatically delete infected messages, it might delete your entire Inbox! This problem is due to a design flaw in certain AV programs, not in Thunderbird, and it is known to occur with Outlook Express and other e-mail programs too. Fortunately, there are measures you can take to keep it from happening.

Antivirus program settings

• RECOMMENDED: Use an antivirus program that's compatible with Thunderbird (listed below).
• IMPORTANT: Set your antivirus software to ask what to do or to at least only quarantine infected files rather than to automatically delete or "repair" them.
• If your antivirus software includes a proxy for incoming e-mail, which scans for viruses before they reach Thunderbird, use it and keep it updated.

Advanced users might also wish to configure their AV software as follows. (For explanation of the rationale behind these measures, see Email scanning - pros and cons.)

• Especially if you must use an incompatible antivirus program, configure it to not scan Thunderbird's "Inbox" file (located in your profile folder) for viruses. You may also want to exclude other mailbox files (such as "Sent", "Templates", etc.) from being scanned.
• Even if your AV program is compatible with Thunderbird, consider turning off your AV program's e-mail scanning but not its autoprotect function.
• Even if your AV program is compatible with Thunderbird, consider also configuring it to not scan the Inbox and other mailbox files during system scans and to not let autoprotect monitor these files.

Thunderbird settings and use

To minimize the chance of your Inbox being quarantined or deleted:

• Compact folders regularly. Otherwise, your antivirus software might detect infected messages that you've deleted but which have not actually been erased from your mail files. (Deleting messages and emptying the Trash still leaves those message in your Inbox; they are only hidden from the Inbox view and remain that way until you compact folders).
• Try setting Thunderbird (version 1.5 or later) to download each individual message to a separate file before adding it to your Inbox. This should make it easier for some antivirus software to quarantine individual messages instead of taking action on the whole Inbox file.

To minimize the loss of mail if your Inbox ever does become quarantined or deleted:

• Keep your Inbox relatively empty by storing most old messages in other folders. That way, if your antivirus software deletes/damages your Inbox, fewer e-mails will be affected.
• If you use POP3, configure Thunderbird to leave mail on the server for a short period (e.g., 3 days), rather than deleting them immediately when downloaded. That way, if your antivirus software damages your Inbox, you can download those messages again. (Note: Leaving messages on the server might cause the same messages to be downloaded again and again; test this setting before accepting it permanently.) To leave messages on the server for a specified number of days:
  • in Thunderbird: go to "Tools -> Account Settings -> [account name] Server Settings", check the box for "Leave messages on server" and set the number of days.
  • in Mozilla Suite: go to "Edit [in Mozilla Mail] -> Preferences -> Mail & Newsgroups Settings -> [account name] Server Settings", check the box for "Leave messages on server" and set the number of days.
• Make regular backups of your Thunderbird mail and other profile data.

Other measures

• Consider using third-party software such as Mailwasher that will remove infected messages from the server before Thunderbird downloads them.
• Use an e-mail provider (usually, your ISP [Internet Serivce Provider] or hosting company) that scans incoming e-mail for viruses.

Recovering a quarantined Inbox

1. Switch off the "auto-protect" feature on your anti-virus software, or otherwise deactivate your anti-virus software.
2. IMPORTANT: back up your profile folder.
3. Take the Inbox (or other affected mail file) out of quarantine.
4. In Thunderbird, delete the infected message.
5. Empty the Trash for the affected account.
6. Compact folders for the affected account.
7. Reactivate your anti-virus software.
8. Verify all your e-mail is present.

List of compatible and incompatible antivirus programs

Please include version numbers of the antivirus program and Thunderbird (or Mozilla Suite).

Compatible antivirus programs

These programs cause no problems when used with Thunderbird. Note that this list is incomplete.

• Alwil Avast! with Thunderbird 0.9, 1.0 - 1.0.7
• eset NOD32 version 2.12.3
• Computer Associates eTrust EZ Antivirus version 6.2.0.28 with Thunderbird 0.9
  • eTrust v6.4 may prevent Thunderbird from retrieving mail from Ipswitch Imail POP servers (not all POP servers, just this particular brand) according to this post. This is a known bug in bugzilla and generally affects Thunderbird 0.7.3 and higher.
• Grisoft AVG7 with Thunderbird 1.0, 0.9
  • Configuration instructions (apparently not necessary; automatic install seems to work fine unless installing a new account where reinstallation may be necessary)
  • This post describes an unusual problem with certain incoming e-mails. It can be avoided by turning off AVG's certification of email scanning (email scanner, properties, configure); this does not turn off email scanning, only the announcements that emails have been scanned. Such certification is useless, and in outgoing email it is annoying, a kind of spam, and in fact dangerous (They give a false sense of security to the recipient, and not only in forwarded messages.)
• Kaspersky Lab Anti-Virus with Thunderbird versions 0.x and 1.x
• Trend Micro PC-cillin Internet Security 2005 version 12 with Thunderbird 0.9 (20041103)
• Trend Micro ServerProtect v5.x with Mozilla v1.3 & Netscape v7.1

Antivirus programs with compatibility problems

These programs may cause e-mails to be damaged or lost; note that this list is incomplete. Please list workarounds if you know them.

• Symantec Norton AntiVirus version 9.0.1.1000 with Thunderbird 1.0.x
  • See this post, this workaround, or get more help here.
  • E-mail scanning is not compatible with accounts using SSL (e.g., Gmail)
  • Using Symantec products' incoming mail virus scanning may block Thunderbird from retrieving mail from Ipswitch Imail POP servers (not all POP servers, just this particular brand). This is a known bug in bugzilla and affects Thunderbird 0.7.3 and higher; one post referencing it is here
  • Use the incoming mail proxy, and keep it updated.
• Panda Antivirus Internet Security with Thunderbird 0.9 may create delays (no reports of quarantining/deleting the Inbox) report & workaround
• Panda Antivirus Internet Security with Thunderbird 0.9 may corrupt database (making every email dublicated up to three times and causing general disorder) report & workaround
• McAfee VirusScan with Thunderbird 1.0 and 0.9 may cause delays when reading from local folders (no knowledge of quarantining/deleting folders) report & workaround

External links

• Virus Bulletin 100% award: check various antivirus programs' track records for detecting all in-the-wild viruses and generating no false positives (free registration required).