Antivirus software

From MozillaZine Knowledge Base
Revision as of 20:28, 19 July 2008 by Alice Wyman (talk | contribs) (added SeaMonkey to the intro)
Jump to navigationJump to search
This article was written for Thunderbird but also applies to Mozilla Suite/SeaMonkey.


Preventing infection

In this article, "virus" means any malware program, including worms, trojans, etc.

Despite talk of "heuristics", most AV programs do not provide protection against rapidly spreading new malware infections in the many hours before the AV companies manage to provide appropriate updates. To protect yourself against these new e-mail viruses, open e-mail attachments only if you trust the sender and if the sender announces the attachment. Additionally, be alert for messages where the sender's address is spoofed (the message appears to have come from one source but in fact was sent from somewhere else) or where the attachment is announced but in a way that sounds suspiciously generic (e.g., "Hi, here's the file you wanted"); both techniques are commonly used by the creators of malware to trick you into opening the attachment. If you have any suspicions about the origin or authenticity of a message, do not open any attached files until first checking with the sender.

Do not check (enable) "View -> Display Attachments Inline".

Unless the e-mail is job-related or otherwise important, you may also wish to consider waiting a while before opening the attachment. This gives your AV program's manufacturer a chance to provide a perhaps necessary new update. Be especially careful if the e-mail is not a new one and is being forwarded.

While opening attachments is the major risk, you might consider using "View -> Message Body As -> Plain Text" to view a message as plain text whenever you're going to read a suspicious message. For example, reading a message in your junk mail folder to confirm whether its really spam. Viruses and scripts rely upon the email client interpreting the message. If you view it as plain text there is nothing to interpret (unless you click on a link in the message or open an attachment)

Keeping your antivirus software from deleting your Inbox

Thunderbird stores all the different messages that you see in your Inbox folder in a single file called "Inbox" in your profile folder. Each of your other mail folders likewise consists of a single, correspondingly named file (Sent, Drafts, Trash, etc.). Some antivirus software unfortunately isn't familiar with Thunderbird, so when it detects a virus in your Inbox, it takes action on the whole file (your entire Inbox) instead of taking action on just one e-mail. For instance, if your antivirus software is set to automatically delete infected messages, it might delete your entire Inbox! This problem is due to a design flaw in certain AV programs, not in Thunderbird, and it is known to occur with Outlook Express and other e-mail programs too. Fortunately, there are measures you can take to keep it from happening.

Antivirus program settings

  • RECOMMENDED: Use an antivirus program that's compatible with Thunderbird (listed below).
  • IMPORTANT: Set your antivirus software to ask what to do or to at least only quarantine infected files rather than to automatically delete or "repair" them.
  • If your antivirus software includes a proxy for incoming e-mail, which scans for viruses before they reach Thunderbird, use it and keep it updated.

Advanced users might also wish to configure their AV software as follows. (For explanation of the rationale behind these measures, see Email scanning - pros and cons.)

  • Especially if you must use an incompatible antivirus program, configure it to not scan Thunderbird's "Inbox" file (located in your profile folder) for viruses. You may also want to exclude other mailbox files (such as "Sent", "Templates", etc.) from being scanned.
  • Even if your AV program is compatible with Thunderbird, consider turning off your AV program's e-mail scanning but not its autoprotect function.
  • Even if your AV program is compatible with Thunderbird, consider also configuring it to not scan the Inbox and other mailbox files during system scans and to not let autoprotect monitor these files.

Thunderbird settings and use

To minimize the chance of your Inbox being quarantined or deleted:

  • Compact folders regularly. Otherwise, your antivirus software might detect infected messages that you've deleted but which have not actually been erased from your mail files. (Deleting messages and emptying the Trash still leaves those message in your Inbox; they are only hidden from the Inbox view and remain that way until you compact folders).
  • Try setting Thunderbird (version 1.5 or later) to download each individual message to a separate file before adding it to your Inbox. This should make it easier for some antivirus software to quarantine individual messages instead of taking action on the whole Inbox file.

To minimize the loss of mail if your Inbox ever does become quarantined or deleted:

  • Keep your Inbox relatively empty by storing most old messages in other folders. That way, if your antivirus software deletes/damages your Inbox, fewer e-mails will be affected.
  • If you use POP3, configure Thunderbird to leave mail on the server for a short period (e.g., 3 days), rather than deleting them immediately when downloaded. That way, if your antivirus software damages your Inbox, you can download those messages again. (Note: Leaving messages on the server might cause the same messages to be downloaded again and again; test this setting before accepting it permanently.) To leave messages on the server for a specified number of days:
    • in Thunderbird: go to "Tools -> Account Settings -> [account name] Server Settings", check the box for "Leave messages on server" and set the number of days.
    • in Mozilla Suite: go to "Edit [in Mozilla Mail] -> Preferences -> Mail & Newsgroups Settings -> [account name] Server Settings", check the box for "Leave messages on server" and set the number of days.
  • Make regular backups of your Thunderbird mail and other profile data.

Other measures

  • Consider using third-party software such as Mailwasher that will remove infected messages from the server before Thunderbird downloads them.
  • Use an e-mail provider (usually, your ISP [Internet Serivce Provider] or hosting company) that scans incoming e-mail for viruses.

Recovering a quarantined Inbox

  1. Switch off the "auto-protect" feature on your anti-virus software, or otherwise deactivate your anti-virus software.
  2. IMPORTANT: back up your profile folder.
  3. Take the Inbox (or other affected mail file) out of quarantine.
  4. In Thunderbird, delete the infected message.
  5. Empty the Trash for the affected account.
  6. Compact folders for the affected account.
  7. Reactivate your anti-virus software.
  8. Verify all your e-mail is present.

Other potential problems

  • If you receive blank messages it might be a sideffect of the antivirus program certifying that each message was safe. If "View -> Message Source" confirms that the messages are empty try disabling that feature. For example, with AVG you would use E-mail Scanner -> Configure -> (Disable)Certify mail Incoming & Outgoing and then restart your system.
  • Many antivirus programs have problems scanning outgoing messages, especially if you use SSL. It is recommended you only scan incoming messages. If the recipient doesn't scan their incoming messages they have bigger problems to worry about than your not scanning your outgoing mail.

List of compatible and incompatible antivirus programs

Please include version numbers of the antivirus program and Thunderbird (or Mozilla Suite).

Compatible antivirus programs

These programs cause no problems when used with Thunderbird. Note that this list is incomplete.

  • Alwil Avast! with Thunderbird 0.9, 1.0 - 1.5.0.9
  • eset NOD32 version 2.12.3
  • Computer Associates eTrust EZ Antivirus version 6.2.0.28 with Thunderbird 0.9
    • eTrust v6.4 may prevent Thunderbird from retrieving mail from Ipswitch Imail POP servers (not all POP servers, just this particular brand) according to this post. This is a known bug in bugzilla and generally affects Thunderbird 0.7.3 and higher.
  • Grisoft AVG7 with Thunderbird 1.0, 0.9
    • Configuration instructions (apparently not necessary; automatic install seems to work fine unless installing a new account where reinstallation may be necessary)
    • This post describes an unusual problem with certain incoming e-mails. It can be avoided by turning off AVG's certification of email scanning (email scanner, properties, configure); this does not turn off email scanning, only the announcements that emails have been scanned. Such certification is useless, and in outgoing email it is annoying, a kind of spam, and in fact dangerous (They give a false sense of security to the recipient, and not only in forwarded messages.)
  • Kaspersky Lab Anti-Virus with Thunderbird versions 0.x and 1.x
  • Trend Micro PC-cillin Internet Security 2005 version 12 with Thunderbird 0.9 (20041103)
  • Trend Micro ServerProtect v5.x with Mozilla v1.3 & Netscape v7.1

Antivirus programs with compatibility problems

These programs may cause e-mails to be damaged or lost; note that this list is incomplete. Please list workarounds if you know them.

  • Symantec Norton AntiVirus version 9.0.1.1000 with Thunderbird 1.0.x
    • See this post, this workaround, or get more help here.
    • E-mail scanning is not compatible with accounts using SSL (e.g., Gmail)
    • Using Symantec products' incoming mail virus scanning may block Thunderbird from retrieving mail from Ipswitch Imail POP servers (not all POP servers, just this particular brand). This is a known bug in bugzilla and affects Thunderbird 0.7.3 and higher; one post referencing it is here
    • Use the incoming mail proxy, and keep it updated.
  • Panda Antivirus Internet Security with Thunderbird 0.9 may create delays (no reports of quarantining/deleting the Inbox) report & workaround
  • Panda Antivirus Internet Security with Thunderbird 0.9 may corrupt database (making every email dublicated up to three times and causing general disorder) report & workaround
  • McAfee VirusScan with Thunderbird 1.0 and 0.9 may cause delays when reading from local folders (no knowledge of quarantining/deleting folders) report & workaround
  • F-Prot Antivirus for Windows 3.16f is not compatible with Thunderbird 1.5
  • Avira Antivir Guard does not scan any mbox files (more information).

Safe test virus

If you are unsure whether your anti-virus program is really scanning for viruses the European Institute for Computer Anti-Virus Research (EICAR) web site has a anti-virus test file that is supposedly supported by all leading anti-virus programs. This web site claims it will send you that same file (the EICAR test virus ) in a email message. Obviously you need to be very carefull where you get this file to avoid getting a harmful virus in disguise. Perhaps the safest approach is to look on your vendors web site for some mention of it. For example, Avast has a EICAR Standard Antivirus Test File Informationweb page while AVG has a link to the EICAR home web page at Interesting Pages.


See also

External links