perhaps https://wiki.mozilla.org/Thunderbird:Testing:Antivirus_Related_Performance_Issues#Norton_Security will help

I discussed this with Symantec, who said that Norton does nor support Mozilla Thunderbird. I pointed out that NIS does support Mozilla Firefox and NIS anti-virus should therefore support Thunderbird too. They said they would escalate this problem to their engineers. Norton case reference number is 32072193 and chat number 4468927. Thanks for the link to Symantec.

Really The scanning for a virus in email is not important. In the case of NIS though, it is an almost guaranteed way to delete all the mail in the folder they scan and find a virus in.

I am not going to preach, but a virus in an email in Thunderbird is like a virus in a glass phial in a laboratory. harmless unless released. The mere presence of virus code in an email is most unlikely to cause infection. This is because Thunderbird stores mail as text... you can not "run" text to make it into a program or really do more than read it, even if it is jibberish in the text file.

Thunderbird does not implement any form of script that an email includes, so the act of opening the email can not "make" anything run, nor can the act of saving an attachment.

Opening an attachment carries risks, but your anti virus scans the opening of all files, so if an attachment contains a virus that it could detect in the email, it will detect that as soon as you attempt to open it, regardless of the email having been previously scanned or not.

The worst thing about letting NIS scan your mail is that it deletes everything in the folder when if "cleans" for you. although the method of deletion appear as mails that will not display in Thunderbird, not as empty folders. They don't appear empty until your try and repair the folder.

A further note here is that NIS does not scan email in any email client that is secured with SSL/TLS (an encrypted connection.) Given this is a requires connection method for all the major free providers and most of the paid products (hosted domains and ISP mail) They also do not scan email from IMAP accounts, only POP. They really should just say they do not scan email, given that most accounts these days do not meet their definition of an email account that can be scanned.

Link to Norton documentation stating they do not scan SSL or IMAP accounts. https://support.norton.com/sp/en/us/home/current/solutions/v96137879_EndUserProfile_en_us

Matt - not quite. Some time ago, before I began running NIS 'custom scans' against my Thunderbird email folders, I received a virus-infected email through Thunderbird. This virus then spread and infected my whole PC - not only in the Thunderbird folders, but also everywhere else it could. After I had completely purged this virus "off-line", I then still had to restore my whole system and data from backup - thus losing some of the data that had not yet been backed up. NIS quarantines/deletes only the viruses that are found in emails: it does not delete the email itself. See attached example of a "VBS.Downloader.B" trojan virus found and deleted via a NIS 'custom scan' of my Thunderbird email folders on 29 July - i.e. yesterday. NIS did not delete the email but deleted only the virus. As this was a spam email and had been filtered/stored in my Thunderbird 'Thrash' folder, I did not bother to click on it and read it. But the email was still in my 'Trash' folder (I had checked that) and it was deleted when I exited Thunderbird. HTH.

Bov4 said

Matt - not quite. Some time ago, before I began running NIS 'custom scans' against my Thunderbird email folders, I received a virus-infected email through Thunderbird. This virus then spread and infected my whole PC - not only in the Thunderbird folders, but also everywhere else it could. After I had completely purged this virus "off-line", I then still had to restore my whole system and data from backup - thus losing some of the data that had not yet been backed up. NIS quarantines/deletes only the viruses that are found in emails: it does not delete the email itself. See attached example of a "VBS.Downloader.B" trojan virus found and deleted via a NIS 'custom scan' of my Thunderbird email folders on 29 July - i.e. yesterday. NIS did not delete the email but deleted only the virus. As this was a spam email and had been filtered/stored in my Thunderbird 'Thrash' folder, I did not bother to click on it and read it. But the email was still in my 'Trash' folder (I had checked that) and it was deleted when I exited Thunderbird. HTH.

You may believe that. You are free to do so. I do not believe the email did you any damage unless you opened the attachment. If you did, that also is nothing to do with Thunderbird and a failure of NS to scan the file properly or have a definition to detect the virus at all.

So it found something in the trash. have you tried repairing the trash folder since it did it's thing? It delete in such an insidious way that you have to repair the folder to see what is actually missing.

The 'Trash' is stored in the 'Deleted' folder, whose contents are then permanently deleted when I exit Thunderbird. I tried 'repairing' it, but nothing happened: it remains empty. Next time my NIS detects a virus in one of my emails via 'custom scan', I'll click on the infected email (after the scan) and take screenshots of what is left in it, then post that to this forum. Meanwhile, from memory of having clicked on such virus-infected emails in the past (i.e. after virus scanning them), they did still exist and did contain text and any attachments [after the virus(es) had been deleted]. But let me wait for another virus-infected email to arrive in Thunderbird, so I can take screenshots of that after it has been NIS virus-scanned - and then post them here. Thanks.

So your anti virus found something that was destined for the great bit bucket in the sky. Just before it went there. Just do not complain when the entire contents of your inbox simply disappears after it finds something in there, because Norton does nor understand the mbox format used to store your mail. Or if they do it is really new.

But this is off topic. I have issued my warning, which is all I intended to do because I have seen the heart break caused by Anti virus products that are trusted to do their job. So I will drop this topic.

Matt - no email ever appears in my 'inbox'. By default, all emails I receive are presumed to be 'spam' and are automatically stored in the 'Deleted' folder - unless one of my message filters recognises them as genuine: in such cases they are stored in their appropriate email folders. Yes, this is very much off topic - but thanks anyway.

I'll return to this topic when Norton confirms that they now support virus-scanning of Thunderbird emails. If Norton does not confirm this, I'll have to consider switching to a different anti-virus product - e.g. to McAfee or whatever else does scan these Thunderbird emails. Thanks again.

Norton Settings: Suggest you set settings to scan but if scan locates problem, then set it to ask you what to do, so you can stop further action allowing you deal with issue. It will tell you what file has the problem.

One idea: you could choose to export emails from that folder as .eml files. then scan the .eml files. This should then identify which is the bad email.

So you can delete the email in the folder and then empty the deleted folder and then compact folders to remove all traces of email. Delete the .eml files.

Thanks for the suggestions, but they would not help.

I typically receive 50+ emails a day, mostly from IBM mainframe forums to which I subscribe/contribute. To export all my received emails as .eml files would require that I first open each one (that is the risk) and then save each one as a separate .eml file - then scan them. That would take longer to complete than the 15-20 minutes it takes to run a 'custom scan' against all my Thunderbird email folders.

I have already set my Norton settings to scan Thunderbird emails (they were previously set to scan Netscape and Outlook emails). So I am now waiting for another virus-infected email to arrive, just to see whether my Norton anti-virus can trap and delete it before I run a 'custom scan' of my Thunderbird email folders. If it does so, the problem is resolved.

Thanks again.