All Netscape Inbox mail corrupt after Avast scan

[kidpiglet]

Hello, I am having trouble I was hoping someone could help me with. I downloaded avast free home version ( 4.8 ) and after a virus scan it detected a few viruses

10/26/2008 12:27:53 PM  User 2012   Sign of "Other:Malware-gen" has been found in "C:\Documents and Settings\User\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-5286af48-6b666d29.zip\vmain.class" file. 
10/26/2008 12:45:12 PM   User 2012   Sign of "VBS:Kak-A1 [Wrm]" has been found in "C:\Program Files\Netscape\Users\default\Mail\from User" file. 
10/26/2008 1:16:02 PM   User 2012   Sign of "Win32:BadTrans-II [Wrm]" has been found in "C:\Program Files\Netscape\Users\default\Mail\Inbox\PartNo_0#900232439" file. 


After the scan i noticed that every message in my entire inbox was blank. No headers, or body message. I have a lot of important emails including passwords, receipts and work messages (over 5000). Is there anyway to undo this operation or repair the inbox file? I am using netscape mail 4.75 communicator.

I have tried moving the messages to a new folder, and replying to message to see if the contents could be salvaged but no luck

[kidpiglet]

anyone?

[DavidR]

Sorry I wish I could suggest something but I have never used the Netscape email function and I guess many others avast users are in the same boat.

[alanrf]

I too should preface my comments with the admission that I have never used the Netscape mail client and I am not familiar with the internal format of its mail files. 

Dare I ask if you perform regular system backups?

When avast detected the viruses it would have asked you what you wanted to do with the infected file.  Can you recall what you told avast (ie Delete or Move to Chest)? 

Files that have been moved to the Chest can be recovered (as in the "from User" file).  Files that you asked avast to delete are, most likely, unrecoverable. 

Either way, in the case of the Inbox I rather suspect that avast (and its "PartNo_0#900... message) may well have performed unrecoverable surgery on that file.  (If my guess is incorrect then I am sure a knowledgeable member of the avast team will say so). 

There is one other possible path of assistance.  Do you also retain your emails on your email server?  If you keep them there then there would be the possibility of downloading the emails from the server again.  However, if you have accepted (the typically standard) option of deleting emails from the server after they have been downloaded then - I am sorry to say - that these messages are, in all probability, permanently lost. 

So the steps to take:

1) If you do have backups then please let us know (before restoring your mail files and we will try to help prevent a recurrence of this problem)
2) Please check the Chest of avast (Start avast antivirus > Virus Chest).  Are the files in there?
3) If you are able to log on to your email server via the Web then please check if the emails are still there on the server.

[kidpiglet]

Thanks for the replies!

I too should preface my comments with the admission that I have never used the Netscape mail client and I am not familiar with the internal format of its mail files. 

Dare I ask if you perform regular system backups?

When avast detected the viruses it would have asked you what you wanted to do with the infected file.  Can you recall what you told avast (ie Delete or Move to Chest)? 

Files that have been moved to the Chest can be recovered (as in the "from User" file).  Files that you asked avast to delete are, most likely, unrecoverable. 

Either way, in the case of the Inbox I rather suspect that avast (and its "PartNo_0#900... message) may well have performed unrecoverable surgery on that file.  (If my guess is incorrect then I am sure a knowledgeable member of the avast team will say so). 

There is one other possible path of assistance.  Do you also retain your emails on your email server?  If you keep them there then there would be the possibility of downloading the emails from the server again.  However, if you have accepted (the typically standard) option of deleting emails from the server after they have been downloaded then - I am sorry to say - that these messages are, in all probability, permanently lost. 

So the steps to take:

1) If you do have backups then please let us know (before restoring your mail files and we will try to help prevent a recurrence of this problem)
2) Please check the Chest of avast (Start avast antivirus > Virus Chest).  Are the files in there?
3) If you are able to log on to your email server via the Web then please check if the emails are still there on the server.

1) I do occasional backups however my last one was in June. Since that time I have received a lot of invoice, account settings, passwords, work and personal email which I'm afraid is not backed up.
I could restore the ones I have however I'm afraid avast will only detect the virus again and corrupt the inbox file.

2) I remember I clicked put in chest or something like that. I just loaded up the chest as you instructed. The file now says part no 900232439 / virus win32: badtrans-II wrm and cannot be restored.

3) All my emails are deleted from the mail server once they were downloaded to my netscape mail so that option is not possible

Are my emails gone for good? Any other suggestions?

[alanrf]

1) I could restore the ones I have however I'm afraid avast will only detect the virus again and corrupt the inbox file.

We can help you prevent that from happening.  I understand the frustration you will feel at the loss of data since then ... but better some than none ... and we can prevent avast taking action on the files again.

The avast Chest data is held in an avast coded way. I'm sorry but that means that regular folks like you and I cannot take that data that "cannot be restored" and retrieve useful information from it.  Unless someone from the avast team intervenes with a better suggestion I believe that emails in your Inbox are indeed "gone for good".

Let's give the avast team a chance to comment and perhaps advise other ways of recovering your email.  If that fails and you are not too discouraged to continue with avast we can proceed to get you going again as well as possible. 

I do ask you to understand that (however much I regret it) this is very much a "first time" issue with avast.  avast is very good at preventing the bad stuff getting into your mail files in the first place (that is one of its great features).  However, I have to say that allowing avast to find problems in your mail file after the event is not the best idea (and that, unfortunately, is the situation for first time avast users).

If you choose to stay with avast we will be here to help.  I am sorry that you have had this unfortunate introduction but you are not alone ... the same happened to me with my Thunderbird mail file 4 years ago.   I and the folks I support are still here and satisfied users of avast.         

[kidpiglet]

bump

anything from the avast team?

[vojtech]

What is the size of the C:\Program Files\Netscape\Users\default\Mail\Inbox file ? When you open it in Notepad, do you see the text of your emails ?

Sorry for the inconvenience.

[kidpiglet]

sorry for the late reply as i have been very busy and have not been able to check the forum. the inbox file size is over 200 megs. I can not open with notepad because the file is way too big

[warlock]

This also happens with Thunderbird, but fortunately it was always the junk folder in my case. I would say Netscape is using the same file format as Thunderbird. The problem is, Avast overwrites everything starting from the infected mail to the end of the file with spaces (20 in hex editor), this not only deletes every single email stored after the infected one, but also prevents compaction of the folder file.

[vojtech]

Try deleting the Inbox.msf file as described here: http://sillydog.org/forum/sdt_11953.php

[roblove]

Download the editor PFE32.  It is a free text editor for really large files.  I use Netscape 7.2, WIN 98, and have to get some deleted files back now and again.  PFE32 will handle the big Netscape files.  This may help to open the 200 M file above.

I haven't loaded avast yet but it sounds like I will be at risk.  Backup before loading is in order.

Bob

[alanrf]

This is, I think, rather academic.

avast is only capable of understanding the very first physical message in the message file format of Netscape and Thunderbird files.  This is typically the oldest message in the particular message folder, be it Inbox, Junk or whatever.

This is why the problem does not affect too many users - the virus has to be present in that first message for avast to be able to detect it and take unfortunate action on the file. 

Deleting the .msf file for the message file in question will not cause a problem since the mail client will simply rebuild it so attempting it is worthwhile.

The suggestion given above to have a good backup is always excellent advice.

There is, in my opinion, no value in having avast scanning the mail file of Thunderbird or Netscape.  The true value of avast is having the Internet Mail provider of avast - which understands very well the format of email messages in transit - scan the mail messages as they arrive and prevent any problems from ever being placed in the the Thunderbird mail files. 

[Ed_P]

Well this is dang scary!! 

I've used Netscape for years and still use 7.2 for email and browsing.  And I use Avast! 

In addition to making sure you have a backup another useful idea is to have multiple email folders so if one gets wiped it doesn't wipe everything.

I backup the hd about once a month, prior to the MS monthly update.  And my emails are subdevided into Family, Neighbors, Work, etc with some of the major folders subdivided into individuals.  Msg filters help in the segregation.

Apparently adding Netscape email folders/files to the Avast! Exclusions is a good idea also.  My question is which set of exclusions should I add them to?  The one when I dbl click on the Avast! System Tray icon or the one when I RIGHT click on the Avast! System Tray icon and then click on Program Settings?

[alanrf]

I think that I have explained that this is really unlikely to be a problem.  You have to have a virus infected message as the very oldest message in a folder for avast to ever notice it and take action.  This is almost exclusively a problem for a first time user of avast not for an established user.   

If it has not happened by now, then calm down - do not worry and rely on the Internet Mail provider to prevent problems with your email.