Kaspersky Standard deletes Thunderbird archive files

[ABC]

Hi, we have been using Kaspersky Internet Security for many years, on many PCs, without encountering any problems. Recently, with the license expiring, we wanted to upgrade to the new version. So we uninstalled the old version, without saving settings, restarted the PCs, and finally installed the latest version of Kaspersky Standard with the default settings. Then it happened that Kaspersky Standard program began to detect viruses present inside Thunderbird, such as attachments to very old emails. Failing to do the disinfection, it deleted the Thunderbird archive files and we found ourselves without any emails inside our client Thunderbird. To see our emails again, we had to restore Thunderbird archive files from quarantine, but the problem recurs every time we do a scan.

How can we fix it?

Why can't Kaspersky Standard disinfect or delete individual virus-containing emails inside Thunbderbird?

Is it possible to create an exclusion without compromising protection from infected emails?

Thank You!

[Berny]

@ABC Welcome.

14 minutes ago, ABC said:

 attachments to very old emails

Can't you locate and delete these old emails ?
Does this happens when scanning  ' C:\Users\UserName\AppData\Roaming\Thunderbird ' ?
Do you have a backup from above folder ?

Also , can you post a screenshot from the Quarantine  ?

[harlan4096]

Exactly, why don't You just delete those emails, that probably have infected files attached, manually?

 

Probably K. can't disinfect them without delete the full emails because of the own ThunderBird structure to store them.

[andrew75]

Thunderbird bases began to be scanned in version 21.17

33 минуты назад, harlan4096 сказал:

Exactly, why don't You just delete those emails, that probably have infected files attached, manually?

This is not always easy if you have several mailboxes and a large database.
I also faced this problem. Antivirus periodically warns me about the presence of viruses in old email attachments.
I'm leaning towards adding Thunderbird bases to the scan exclusions.

[Berny]

@andrew75

Same here , see screenshot from Kaspersky report below.
My TB Sent folder doesn't contain mails dated year 2014 🤔

[andrew75]

It might be worth doing this: https://support.mozilla.org/en-US/kb/rebuilding-global-database

[Berny]

There is also a repair option available in de TB folder properties.

Spoiler

 

[andrew75]

2 часа назад, Berny сказал:

There is also a repair option available

Yes, it sometimes helps to return emails that are not visible in the list

[ABC_F]

On 5/20/2024 at 10:31 AM, Berny said:

@ABC Welcome.

Can't you locate and delete these old emails ?
Does this happens when scanning  ' C:\Users\UserName\AppData\Roaming\Thunderbird ' ?
Do you have a backup from above folder ?

Also , can you post a screenshot from the Quarantine  ?

these are the elements detected by the antivirus. we have already taken steps to delete emails and remove reports but, despite this, a few days later, the antivirus detected the same elements even though they were no longer present on thunderbid

[Berny]

Hi @ABC_F 

Thank you for posting back.

Currently the best temporary option is to add TB folder 'C:\Users\UserName\AppData\Roaming\Thunderbird'  to the exclusions as suggested by @andrew75.

In the meantime i am checking the removed screenshots.
 

[ABC_F]

On 5/20/2024 at 10:31 AM, Berny said:

@ABC Welcome.

Can't you locate and delete these old emails ?
Does this happens when scanning  ' C:\Users\UserName\AppData\Roaming\Thunderbird ' ?
Do you have a backup from above folder ?

Also , can you post a screenshot from the Quarantine  ?

we have already deleted the emails and remove the alerts but, despite this, the next day, the antivirus detected the same elements, even though they were no longer on thunderbird

[ABC_F]

On 5/20/2024 at 10:31 AM, Berny said:

@ABC Welcome.

Can't you locate and delete these old emails ?
Does this happens when scanning  ' C:\Users\UserName\AppData\Roaming\Thunderbird ' ?
Do you have a backup from above folder ?

Also , can you post a screenshot from the Quarantine  ?

we have already deleted the emails and remove the alerts but, despite this, the next day, the antivirus detected the same elements, even though they were no longer on thunderbird

[Berny]

@ABC_F

Please see above  and add TB folder ' C:\Users\UserName\AppData\Roaming\Thunderbird '  to the exclusions.

Kaspersky Main Screen → ⚙️ (gear down left) → Security settings :
→ Scroll down → Exclusions and action on object detection
→ Scroll down → Manage exclusions

EN : Exclusions and actions on object detection
IT : Esclusioni e azioni sul rilevamento di oggetti

 

[Berny]

@ABC_F

Also please proceed as follows :

1. ⚠️ Backup C:\Users\UserName\AppData\Roaming\Thunderbird
2. Right click TB INBOX → Properties → Repair folder.

 

[andrew75]

After deleting a message, it is not physically deleted. To remove it completely, you need to compact the folders.

https://support.mozilla.org/en-US/kb/compacting-folders#w_why-is-compact-required

[Berny]

@ABC_F

Also : Thunderbird - Internet Cache

Spoiler

 

[ABC_F]

On 5/20/2024 at 10:31 AM, Berny said:

@ABC Welcome.

Can't you locate and delete these old emails ?
Does this happens when scanning  ' C:\Users\UserName\AppData\Roaming\Thunderbird ' ?
Do you have a backup from above folder ?

Also , can you post a screenshot from the Quarantine  ?

I tried compacting, repairing the folders and cleaning with ccleaner but the problem persists

Edited May 22 by ABC_F

[Berny]

@ABC_F

Thank you for your feedback.

Please temporary exclude your TB profile , in the meantime I am investigating this problem and will update asap.

[ABC_F]

I apologize for the earlier message. I ran compaction on other computers and the problem was resolved. Thank you vero much

[Berny]

@ABC_F

34 minutes ago, ABC_F said:

I apologize

You are welcome and no apologize , i am glad that the problem seems to be resolved.
If you need further assistance please let us know.
 

[ABC]

Thanks to @Berny, @harlan4096, @andrew75 for you kind replies and support.
A few days have passed and il seems that we have solved this by following quite all your suggestions.
In this case, we have deleted the infected emails inside Thunderbird, even from the trash, and we have compacted the Thunderbird databases.
At the moments, it seems that there was no need to add any exclusions to the antivirus, and there is no need to repair the Thunderbird databases.

Thank You!

Regards,
ABC