Author Topic: I've lost a folder  (Read 10685 times)

0 Members and 1 Guest are viewing this topic.

jenpen

  • Guest
I've lost a folder
« on: April 24, 2010, 07:42:54 AM »
Avast just found a worm in an email (good) but it has removed the whole folder that contained the email to the chest (bad). I need some of the other emails in that folder and anyway I don't know which particular email was the baddie. Any ideas on how to restore the folder without releasing the worm? Thanks!

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: I've lost a folder
« Reply #1 on: April 24, 2010, 01:41:28 PM »
Which is your email program?
I never saw avast sending folders to Chest, just files.
Can you extract the file (email box) from Chest to a safe place?
The best things in life are free.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: I've lost a folder
« Reply #2 on: April 24, 2010, 07:27:04 PM »
I never saw avast sending folders to Chest, just files.

I did, but that was long time ago with some 4.x versions.
So, maybe we should also ask: Which version of avast do you use...??
asyn
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: I've lost a folder
« Reply #3 on: April 24, 2010, 08:00:28 PM »
@ jenpen
Email folders are somewhat different to regular windows folders, most email clients contain emails in a database 'file' this contains multiple emails but is essentially a single file.

I suspect that this detection was on an on-demand scan ?
If so which type of scan, Quick, Full Scan, Folder Select, etc.

So first what action was taken, Send to chest should mean that the database file is in the chest ?
If you chose delete then it is gone and you will have to resort to your backups to restore that file, you do backup your system.

What is your email client/program ?
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

jenpen

  • Guest
Re: I've lost a folder
« Reply #4 on: April 25, 2010, 09:42:02 AM »
Thanks guys. I use Thunderbird and Avast version 4.8, and yes, it was during an on-demand scan, a Full Scan - the worm was in an email already filed away, so it seems that Avast missed it on the way in.
The file is in the chest.
Tech, what do you mean by "a safe place"?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: I've lost a folder
« Reply #5 on: April 25, 2010, 02:47:18 PM »
Well I thought that thunderbird stored emails in individual .eml files not in database files, so an email folder shouldn't have gone walk about if this was a detection on a .eml file ?

What was the file name and location of the original detection ?

However, if the file is in the chest (you can get that above information) depending on the above answer it may be able to be restored to the original location.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: I've lost a folder
« Reply #6 on: April 25, 2010, 03:00:17 PM »
Well I thought that thunderbird stored emails in individual .eml files not in database files, so an email folder shouldn't have gone walk about if this was a detection on a .eml file ?

No, Thunderbird uses database files.
Best soultion would be to restore the file from chest and delete (also delete trash afterwards) the corresponding mails in TB.
asyn
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: I've lost a folder
« Reply #7 on: April 25, 2010, 03:13:22 PM »
Well restoring from the chest could present its own problems as depending on whatever folder it was 'inbox,' etc. then thunderbird could have replaced that database file. restoring from the chest just to delete and empty the trash seems a waste of time if you don't recover the good emails.

So it may be necessary to close Thunderbird rename (safest, can always be renamed again) or remove the database file before restoring the one in the chest. Then manually find the email avast detected in that folder and delete only that one, emptying the trash and compacting all folders.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: I've lost a folder
« Reply #8 on: April 25, 2010, 03:21:14 PM »
1. restoring from the chest just to delete and empty the trash seems a waste of time if you don't recover the good emails.

2. So it may be necessary to close Thunderbird rename (safest, can always be renamed again) or remove the database file before restoring the one in the chest. Then manually find the email avast detected in that folder and delete only that one, emptying the trash and compacting all folders.

ad 1. That's exactly what i meant - deleting the bad, restoring the good. ;)
ad 2. Sounds good! Renaming before should be the safest way. :)
asyn
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline Gopher John

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2098
Re: I've lost a folder
« Reply #9 on: April 25, 2010, 05:34:30 PM »
I use Pegasus Mail instead of Thunderbird, but it also stores messages in individual files(folders).  I've excluded the entire Windows directory that contains the mail stores in File System Shield and scans.  I also have Mail Shield disabled.
AMD A6-5350M APU with Radeon HD Graphics, 8.0GB RAM, Win7 Pro SP1 64bit, IE11
i7-3610QM 2.3GHZ, 8.0GB Ram,  Nvidia GeForce GT 630M 2GB, Win7 Pro SP1 64bit, IE 11
Common to both: Avast Premium Security 19.7.2388, WinPatrol Plus, SpywareBlaster 5.5, Opera 12.18, Firefox 68.0.2, MBam Free, CCleaner

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: I've lost a folder
« Reply #10 on: April 25, 2010, 05:58:09 PM »
The safer bet is to exclude the database file type inside that folder to try and cut the size of any hole in security by excluding the complete folder.

I don't keep my OE database files in the default location I have moved them to E:\Data\OE-files in the OE settings (I don't know if that can be done in thunderbird or Pegasus Mail) and the exclusion for that in relation to OE files would be E:\Data\OE-files\*.dbx

One thing however, we don't know a lot about the OP's scan type, and if all archives were selected (I suspect Thorough and with Archives selected) ?
A lower level sensitivity/archive selection (Standard scan without archives) may not scan the email database files.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: I've lost a folder
« Reply #11 on: April 25, 2010, 10:25:31 PM »
I've excluded the entire Windows directory that contains the mail stores in File System Shield and scans.
How?
1. Windows Explorer?
2. avast deletion?
The best things in life are free.

Offline Gopher John

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2098
Re: I've lost a folder
« Reply #12 on: April 25, 2010, 11:14:02 PM »
I've excluded the entire Windows directory that contains the mail stores in File System Shield and scans.
How?
1. Windows Explorer?
2. avast deletion?

The entire PMail/Mail directory is excluded from File System scanning.  Also it is excluded from all manual scanning except for one custom scan I've added.  The only files in that directory hierarchy are data files containing the mail stores.
AMD A6-5350M APU with Radeon HD Graphics, 8.0GB RAM, Win7 Pro SP1 64bit, IE11
i7-3610QM 2.3GHZ, 8.0GB Ram,  Nvidia GeForce GT 630M 2GB, Win7 Pro SP1 64bit, IE 11
Common to both: Avast Premium Security 19.7.2388, WinPatrol Plus, SpywareBlaster 5.5, Opera 12.18, Firefox 68.0.2, MBam Free, CCleaner

jenpen

  • Guest
Re: I've lost a folder
« Reply #13 on: April 26, 2010, 04:32:42 AM »
Wow, you guys have been so busy while I've been asleep ;-)
The file in the chest is:
\Thunderbird\Profiles\dmx3zn3f.default\Mail\Local folders\Client folders.sbd

The folder that has disappeared is a subfolder within <Client folders>. The main folder <Client folders> and all the rest of its contents are still there.

I can probably work out which email it was as it's a folder I don't use very often and it must have been the last one I added. If I restore the database file from the chest then just delete that email and empty the trash, that would be safe, no? Then run another scan?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: I've lost a folder
« Reply #14 on: April 26, 2010, 04:57:22 AM »
That should be OK (but I can't say it isn't without risk and I don't use thunderbird), if Thunderbird hasn't recreated that folder Client folders.sbd so you would need to rename that (outside of thunderbird, something like Client foldersNew.sbd) before restoring the one from the chest.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security