Author Topic: Thunderbird mail files causing trouble  (Read 4065 times)

0 Members and 1 Guest are viewing this topic.

Vivace

  • Guest
Thunderbird mail files causing trouble
« on: June 07, 2006, 06:15:12 PM »
I have run into a really bad problem. Avast marked two files in my Thunderbird Mail folder. I moved them to the chest. After doing that, it seems that all of my mail since september last year disappeared!

So, I wanted to move the files back, but the restore choice was "greyed out". I then edited the entries for the files in index.xml to allow restoring. But then Avast complained that the search path did not exist. So, I renamed the search path, and restored the files.

However, when opening them in a text editor, they only contained binary data (while the mail files are in plain text).

I am at a loss at how to proceed, and I guess that my manual tinkering has only made things worse.

Any and all help would be much appreciated. Thanks.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3870
  • Just an avast user
Re: Thunderbird mail files causing trouble
« Reply #1 on: June 07, 2006, 10:24:46 PM »
Welcome to the avast forum.

The files in the chest are encrypted.

See this thread:

http://forum.avast.com/index.php?topic=18435.msg156761#msg156761

I am rather afraid that you may well be in the same situation as the originator of that thread, but I hope not. 

When avast is scanning very large files (as the Inbox of Thunderbird can become) it scans it in chunks that it labels as PartNo.... (and generates a label).  It appears (to me - though the avast team may correct me) that if one of these chunks is found to be infected then only that chunk is moved to the chest and not the whole of the original file and only that chunk (which is rather useless) can be recovered.   

Try the extract option as mentioned in that thread.  If the extract operation produces a file named PartNo..... then I doubt your mail folder can be recovered and I sincerely hope that you have a recent backup from which you can recover your mail folder.

Let's hope it is the whole mail file - let us know. 

 
« Last Edit: June 07, 2006, 10:27:23 PM by alanrf »

Vivace

  • Guest
Re: Thunderbird mail files causing trouble
« Reply #2 on: June 08, 2006, 10:39:12 AM »
Thanks for the info. I tried to extract the files, but to no avail; it was only a part of the mail file. I had no backup, so those mails are gone, I guess...

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3870
  • Just an avast user
Re: Thunderbird mail files causing trouble
« Reply #3 on: June 08, 2006, 12:18:34 PM »
I am very sorry to hear that.

I will delay any further comments and hope that the avast team may have some response to this problem.

Fast

  • Guest
Re: Thunderbird mail files causing trouble
« Reply #4 on: June 08, 2006, 12:24:21 PM »
Alas every antivirus-program has this "problem" with Thunderbird mail.
The origin of the problem lies in the way how Mozilla (and Thunderbird and all Mozilla derivates)  handel mail. The inbox is ONE file in these programs. Should any AV-program find anything suspicious in a mailmessage, the whole file (read: the whole INBOX) is considered infected.
Solution: once you've read a message, move it to another folder of your choice and keep your inbox empty for new messages to come.

Fast

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3870
  • Just an avast user
Re: Thunderbird mail files causing trouble
« Reply #5 on: June 08, 2006, 12:31:12 PM »
Fast,

I am sorry to say that I am fairly certain that your analysis of this is incorrect (though I agree with your recommendation).  I have no issue with your comments about how Thunderbird/Mozilla mail files are managed.   

I do have very serious concerns about how avast responds (or rather how avast improperly destroys user's files) on finding an infection. That's why I am witholding further comment and awaiting a response directly from the avast team.
« Last Edit: June 08, 2006, 12:41:40 PM by alanrf »

Fast

  • Guest
Re: Thunderbird mail files causing trouble
« Reply #6 on: June 08, 2006, 12:39:56 PM »
Well Alan, I guess you are right, I'm not exactly a rocket-scientist so the exact technical background of this problem is beyond my understanding  ;D
However I'm sure about the way Thunderbird stores it's mail, so dragging the mail from the inbox to a self-defined folder would be a solution to prevent losing lots of messages.
Let's wait what the technicians say about this.

Kind regards,
Fast  :)

edit: I see you edited your message faster than I can type (you're the "Fast" one here  ;D  )
Sorry for my double statement.
Regards,
Fast
« Last Edit: June 08, 2006, 12:41:54 PM by Fast »

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3870
  • Just an avast user
Re: Thunderbird mail files causing trouble
« Reply #7 on: June 08, 2006, 12:48:58 PM »
I'm sorry - my point is not being made clearly enough.

If avast finds an infection in any large enough Thunderbird/Mozilla mail folder then avast will destroy that folder in a way that cannot be recovered.

There is nothing any Thunderbird user can do about it - this is a flaw in avast.  That's why I have commented earlier this year that Thunderbird users are best advised to exclude their mail files from on demand scans by avast and rely on the Internet Mail scanner and the Standard shield.  The avast team needs to respond to this. 

« Last Edit: June 08, 2006, 12:53:38 PM by alanrf »

Fast

  • Guest
Re: Thunderbird mail files causing trouble
« Reply #8 on: June 08, 2006, 12:56:34 PM »
I see, there's more behind it I guess. In AntiVir forums users describe the same problem when recieving infected mail in Thunderbird and the way AntiVir handels it.
That's why I thought the main problem lies in Thunderbird.
Well Alan, we'll await the response of the Alwil team on this one.
Have a nice day  :)

Fast

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3870
  • Just an avast user
Re: Thunderbird mail files causing trouble
« Reply #9 on: June 08, 2006, 01:11:46 PM »
If avast put the whole mail folder whether Inbox or any other user defined folder in the chest it could be recovered. 

avast scans large mail folders in chunks (PartNo ... etc).  If it finds an infection it just puts the infected chunk in the chest and deletes the whole original folder.  The infected chunk can be recovered ... and is no use to anyone. 

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Thunderbird mail files causing trouble
« Reply #10 on: June 08, 2006, 01:35:11 PM »
The problem is that the Thunderbird mailbox doesn't really have any format. It's a concatenation of plain e-mail bodies, one after another. So, when avast! is scanning such a file, it detects the first message as an EML file (MIME format), unpacks its content and scans it.
If a virus is found inside of the first message and avast! is asked to perform an action, this (first) e-mail is modified (and the rest of the file is kept appended).

Now, however - Thunderbird keeps some kind of an index file somewhere else (which probably contains informations like where the particular message starts in the original file). When this index file mismatches the actual content of the file, Thunderbird is unable to read the files (and probably also to rebuild the index?).

It's not clear to me how to avoid this problem...  :-\

Fast

  • Guest
Re: Thunderbird mail files causing trouble
« Reply #11 on: June 08, 2006, 01:44:19 PM »
Thank you Igor for this quick response  :) :) :)

Edit: I've found this "solution" :

http://kb.mozillazine.org/Download_each_e-mail_to_a_separate_file_before_adding_to_Inbox

Fast
« Last Edit: June 09, 2006, 11:31:01 AM by Fast »