Author Topic: false positive with backuped thunderbird profile  (Read 4062 times)

0 Members and 1 Guest are viewing this topic.

Offline zivilist

  • Full Member
  • ***
  • Posts: 126
false positive with backuped thunderbird profile
« on: February 01, 2006, 12:19:24 AM »
Hello,

if a scan my thunderbird backup file (created with http://mozbackup.jasnapaka.com)
avast found several worms:

JS:Seeker-Iu2 [Wrm]

avs: 0605-2, 31.01.2006

But there are definitly no infections.

The same like if I want to install thunderbird 1.5.

Can anybody verify it?

thanks

Raymond
« Last Edit: February 01, 2006, 12:22:01 AM by zivilist »
OS: Windows 7 Professional x64, OS X 10.8.3
Avast Free (for Mac and Windows)

Offline Cloussau

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 897
  • AVAST! antivirus with balls
Re: false positive with backuped thunderbird profile
« Reply #1 on: February 01, 2006, 12:37:13 AM »
pressure for Increased detections have brought a spate of false positives in recent days .
I suggest you send a copy of the file in a password protected zip file (using 'virus' as the password) to virus @ avast.com  with a brief explanation or reference to this thread so it can be corrected.
you can exclude this file in the interim if you want by adding to exclusion lists in standard sheild and main settings
« Last Edit: February 01, 2006, 12:45:46 AM by Cloussau »
sys- p4  3.0D ,  1024mb ddram ;arsenal :Avast IS 5.0 pro / Firefox / adblock /noscript : win xp/pro/sp3 32 bit

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 85800
  • No support PMs thanks
Re: false positive with backuped thunderbird profile
« Reply #2 on: February 01, 2006, 02:31:42 AM »

You could also check the offending/suspect file at: Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. You can't do this with the file in the chest, you will need to move it out.
Or VirusTotal - Multi engine on-line virus scanner

If it is indeed a false positive, add it to the exclusions lists and check scan it periodically using the ashQuick scan (right click scan), when it is no longer detected then remove it from the exclusions.
Also see (Mini Sticky) False Positives
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.8.2487 (build 21.8.6586.697) UI 1.0.666/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: false positive with backuped thunderbird profile
« Reply #3 on: February 01, 2006, 02:59:26 AM »
Raymond,

I just used that program to backup my Thunderbird 1.5 profile.  I then scanned the resulting 79Mb backup file and avast! reported no errors, VPS 0605-2.

Offline zivilist

  • Full Member
  • ***
  • Posts: 126
Re: false positive with backuped thunderbird profile
« Reply #4 on: February 01, 2006, 10:52:08 AM »
hello,

I note that the infection is only in one folder (happened before using avast! home)
I can't scan it because its already in downloaded messages and avast! scans only while incoming messages in thunderbird.
Can you build a provider that scans every mail (unreaded/readed mail)?

If I use the backup tool, unpack it and scan the infected file (one big file for one thunderbird folder) avast delete the folder after the warning :(

thanks for help
OS: Windows 7 Professional x64, OS X 10.8.3
Avast Free (for Mac and Windows)

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: false positive with backuped thunderbird profile
« Reply #5 on: February 01, 2006, 11:28:52 AM »
First please note that I am just an avast user - I do not speak for the avast team.

I am sorry to say that none of the on demand avast scanners available for the avast Home edition has any idea that a file being scanned by it is part of Thunderbird email.

One big part of the problem is Thunderbird itself.  Many email products (like Outlook and Lotus Notes store the mail files in an encrypted format that prevents anyone just reading the email contents).  Those products not only encrypt the mail content but also any virus information that may be contained in the emails, so that an antivirus scanner, like avast, cannot detect it. 

Thunderbird stores the email in each folder in clear text, but each folder is just a clear text file with a filename such as Inbox or Sent or a folder name that you have chosen.  That means that if an email in one of the Thunderbird folders is recognized as a malicious script, for example, then avast will identify the folder as infected and move it completely to the virus chest. 

Avast has no way of knowing that this is an email file and still less has it any way of identifying a single infected mail message in that folder and surgically removing it from the folder. 

That is why it is vital with Thunderbird to use the Internet Mail scanner, which does understand the format of email, to scan email as it is being received (or sent) and to prevent any infected email messages from ever being put into the Thunderbird mail store.

If you can identify the infected message in your Thunderbird folder then it is imperative that you:

1) delete the infected message from the folder
2) empty the trash folder into which the infected message is moved
3) compact the folder from which you deleted the message
4) compact the trash folder to which you emptied in (2) above

Remember that in Thunderbird a mail message is only ever really deleted when you compact any folder in which it was held or any trash folder to which it was copied.   

I realize that this will not solve your problem but I hope that it helps.

Offline zivilist

  • Full Member
  • ***
  • Posts: 126
Re: false positive with backuped thunderbird profile
« Reply #6 on: February 01, 2006, 04:05:42 PM »
Did a developer contact the developers of thunderbird?
Some information Thunderbird <> Antivirus:

http://kb.mozillazine.org/Thunderbird_:_FAQs_:_Anti-virus_Software (Avast is listed as compatible  ;))
http://forums.mozillazine.org/viewtopic.php?p=445420#445420
« Last Edit: February 01, 2006, 05:22:19 PM by zivilist »
OS: Windows 7 Professional x64, OS X 10.8.3
Avast Free (for Mac and Windows)

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: false positive with backuped thunderbird profile
« Reply #7 on: February 01, 2006, 09:38:50 PM »
There is no standard for the way the email packages store email messages.  There is indeed a lot of internal argument going on in the Thunderbird community about wanting to change the way Thunderbird stores the mail. 

Even though I am a Thunderbird user I think the (limited) resources of the avast team would be wasted on writing code to understand the email structures of every mail package that is out there.  If they did they would probably concentrate on heavily used mail packages and not one (like Thunderbird) which still has a very low adoption rate.