Author Topic: Moved file with .vir extension added and .....  (Read 5019 times)

0 Members and 1 Guest are viewing this topic.

bobal

  • Guest
Moved file with .vir extension added and .....
« on: June 07, 2008, 08:59:06 AM »
I moved a file and added the ".vir" extension because it was shown to be infected with a trojan horse.  Unfortunately it was my inbox file for my thunderbird mail client.  Now I want to recover it as i lost all my inbox email.   Any help on how to recover the file from the "moved" directory in Avast?? 

Thanks for your help !!

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89690
  • No support PMs thanks
Re: Moved file with .vir extension added and .....
« Reply #1 on: June 07, 2008, 03:50:48 PM »
Well you could rename it by removing the .vir so it should be your same file name for the inbox and move it back to the original location. Ensure that TB isn't running when you try that, you would have to pause the Standard Shield when doing this or it is likely to alert again. Your file should be in the C:\Program Files\Alwil Software\Avast4\DATA\moved folder.

I don't know if that would work I don't use thunderbird, as it might be that TB has already created a new inbox.

It is best not to store email in the inbox but use it as a bending tray, read, action and move to a folder more appropriate to its subject. That way the inbox (which is the most succeptable to corruption/deletion) only has a few emails, so any loss is minimised.

The TB F.A.Q has a recommendation along these lines as many AVs would just delete the file as they can't extract the infected email from within the file causing it to be corrupted.

That however won't deal with the problem that you have an infected email in your inbox from some time ago. You could exclude the email folders from on-demand scans to avoid this in the future, more on that when life is more calm.
« Last Edit: June 07, 2008, 03:52:52 PM by DavidR »
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD - 27" external monitor 1440p 2560x1440 resolution - avast! free  24.9.6130 (build 24.9.9452.762) UI 1.0.818/ Firefox, uBlock Origin Lite, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67183
Re: Moved file with .vir extension added and .....
« Reply #2 on: June 07, 2008, 07:51:02 PM »
Better than move, the recommended action is 'move to Chest'.
Thunderbird does not allow to clean the inbox or deleting only the infected message. It's a pity.
Follow David's recommendation to not loose your inbox in the future.
The best things in life are free.

bobal

  • Guest
Re: Moved file with .vir extension added and .....
« Reply #3 on: June 07, 2008, 11:50:14 PM »
Thanks David and Tech !

David, I tried the rename with carefully following your suggestions. Unfortunately it has not worked.  The file I moved is still showing lots of kb's so hopefully the data has not been lost.  I also moved the "inbox.msf" file which i believe is the "index file" for the inbox.  Thunderbird does not seem to have any help that i can find. If you have any further suggestions -- i will be most grateful for your help.

Tech, the trojan horse that was found in the Thunderbird "inbox" was not able to be moved to the Chest -- gave me a message that the file was too large -- that is why i moved with the .vir extension.  If you have any other information for me I will appreciate an email or a post here.  Thanks again.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89690
  • No support PMs thanks
Re: Moved file with .vir extension added and .....
« Reply #4 on: June 08, 2008, 12:07:40 AM »
Sorry I can't be of any practical help as I don't use thunderbird, I'm just thinking how I might recover the inbox in OE6 and that is much simpler.

I would ensure the email client is closed, delete or rename the current file that matches the name of the one in the moved folder, it should retain the original name with .vir tacked on at the end, e.g. inbox.msf.vir. So checking the file in the moved folder would indicate what file to rename/remove from the thunderbird folder. Other than that I'm not sure what else can be done.

My friend google might be able to help, see these hits to a search I did, http://www.google.co.uk/search?q=restore+deleted+thunderbird+inbox+file.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD - 27" external monitor 1440p 2560x1440 resolution - avast! free  24.9.6130 (build 24.9.9452.762) UI 1.0.818/ Firefox, uBlock Origin Lite, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67183
Re: Moved file with .vir extension added and .....
« Reply #5 on: June 08, 2008, 01:25:49 AM »
Tech, the trojan horse that was found in the Thunderbird "inbox" was not able to be moved to the Chest -- gave me a message that the file was too large -- that is why i moved with the .vir extension.  If you have any other information for me I will appreciate an email or a post here.  Thanks again.
The problem is that 'all' your email seem to be in the inbox and the whole file is bigger than the Chest limit. You could increase the Chest size into avast settings, but it won't help now.
Can't you rename the file and bring it back to its original place, maybe disabling avast and carefully deleting only the email that was infected?
The best things in life are free.

bobal

  • Guest
Re: Moved file with .vir extension added and .....
« Reply #6 on: June 09, 2008, 02:27:34 AM »
Hey David & Tech,

Thanks for all the help!  Many hours of torture and recovery steps -- retrieved by Inbox from the bottomless pit of the moved folder!
You are correct -- Thunderbird is not user friendly when it comes to recovery of lost or deleted emails.  Nonetheless with your good assistance and learned advise I have now got most of the emails back.

I am in the process of going through the emails and moving to other inboxes (subset Email Boxes) which I am creating and moving the mail i really want to save in those.  I also learned from you that the "smart" way is to NOT keep email in the main inbox (default one in Thunderbird".  I will also backup more often so this might have been a good lesson learned.

Props to you both -- thanks again for the kind assistance! ;D  ;D  ;D

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89690
  • No support PMs thanks
Re: Moved file with .vir extension added and .....
« Reply #7 on: June 09, 2008, 01:21:15 PM »
No problem, glad I could help.

A good Back-up and Recovery strategy is the best insurance ;D

Welcome to the forums.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD - 27" external monitor 1440p 2560x1440 resolution - avast! free  24.9.6130 (build 24.9.9452.762) UI 1.0.818/ Firefox, uBlock Origin Lite, uMatrix/ MailWasher Pro/ Avast! Mobile Security