Hello, Avast has put my Thunderbird Mailfile into the Chest. I don’t know how to restore the mailfile again, i.e. all mails are lost!
Does anybody know how to restore the mailfile (e.g. unzip file to location etc.) and how to bring it back into working condition?
Thanks!
Welcome to the avast! forums.
I assume that you mean that avast! has put your Thunderbird Inbox into the chest since there is no such thing as a “Thunderbird Mailfile”.
While I have not encountered this problem it may be possible for you to:
right click on the avast! icon in the system tray
select “Start avast! Antivirus”
Click on the “Chest” icon in the in the avast! interface to open the chest
Select “All chest files”
You should see your Thunderbird Inbox file (it has no extension)
Right click on the file and … hopefully … you can select the “Restore” option
That should move the file back to its right place.
I hope that, from the message you saw when the infected Thunderbird Inbox was quarantined, you have some idea of the problem that was detected by avast! Since it is being detected by avast in the Inbox (which is a plain text file) it is most likely a malign script function (and unlikely to to be anything to do with an encoded attachment).
Before you run another avast scan you will need to determine the message containing the problem. In Thunderbird you must delete the message containing the problem and then you must right click on the Inbox and select the “compact” option. Following that you must empty the Trash folder for that account and then also right click in the Trash folder and select the “compact” option for the Trash folder. The compact function is what really deletes messages from the mail folders of Thunderbird.
Finally, prevention is much better than cure. If you are not using the Internet Mail scanner then start using it now to prevent problems making it into your Thunderbird Inbox in the first place.
Hi alanrf,
thanks for your quick reply. I had already tried out the “restore” function within the avast chest. However, avast tells me that the file cannot be restored, with no reasons stated. Now I don’t know how to get the inbox-file back to working order.
Under file->properties within the avast chest, the file is marked as “not restorable”.
Do you know, what I could try next without losing all my messages?
Thanks!
OK … first you need to know that I am working this one out as we go because I have not tried this with the chest before. So … with the understanding this is at your own risk … let’s see if we can get your mail back.
First go to the folder:
Program Files\Alwil Software\Avast4\DATA\chest
in there you will find a file called index.xml.
Open this file with an edit program such as Notepad.
You will see a set of entries, one referring to each file in the chest.
You should see an entry that has Inbox
followed by containing the folder the file came from and, most importantly, just above the filename the telling you the filename that has been used for the file in the chest.
So from that you should be able to tell which file in the folder:
Program Files\Alwil Software\Avast4\DATA\chest
is your Thunderbird Inbox.
So, now identify that file in the chest folder. Right click on it and select copy.
Paste the file, for now, to your desktop. Rename it to “Inbox”.
Then drag and drop the file into the foldername specified in in the chest entry you identified above.
I hope that you now have your mail folder back working in Thunderbird and you can proceed with the cleanup I described in the earlier post…
If the Inbox still remains on your desktop at this point you should delete it and empty the recycle bin.
This is certainly not going to work - the files in the Chest folder are scrambled, you cannot just copy them out. There’s what the “Extract” command (in the Chest itself) is for.
When you display the “Properties” of the file in Chest - what exactly does it say (especially the “Original file name” and “Original folder” items)?
Well then my apologies to euphemos.
Igor, I will leave it to you to guide the recovery of the user’s Thunderbird Inbox.
I notice that almost everything in my chest (which is all Eicar test viruses I have used) has “Restore” greyed out when I right click on them.
Ah, interesting … I see that even though restore may be greyed out extract is available … seems somewhat esoteric to me … but I live and learn.
Igor,
the user indicated in the thread that the file is a Thunderbird Inbox.
You are probably aware that the folder name for Thunderbird profiles is randomly generated at installation time for every Thunderbird user.
Basically, the “Restore” option is grayed out if the file was moved to Chest from within an archive (including an e-mail) - avast! is not able to return the file back to the archive. The Extract option, however, is always available - avast! certainly is able to store (= decrypt) the file to given folder.
That’s also the reason why I asked about the location - because if avast! put the whole mailbox into the Chest, the “Restore” option should be available. If the Restore option is not available, it sounds more like avast! only extracted some attachment from the mailbox, not the whole file… strange.
Hello alanrf, Hello Igor,
thanks for your responses. Unfortunately, I was not able to get my mails back yet.
I tried to extract the file. Avast renamed it to: PartNo_0#1182120384
Its size is only 96.172 KB. My Inbox was a lot bigger than that…
In addition, I cannot open the file with any of my programs.
Can you give me another hint, what I should do?
I kind of lost trust to avast, since it moved my whole inbox-folder without me doing anything. Have you heard of this problem before?
Thanks again & have a nice day,
euphemos
Thunderbird’s FAQ doesn’t recommend using the inbox for general storage for these very reasons, many AVs can’t extract an infected email from within the file so resort to deleting the whole file.
The inbox is the most vulnerable to corruption or deletion as it is often open at the time, if there is a crash, etc. The inbox should be thought of as a pending tray, you check the contents and having actioned them move them to a more appropriate email folder, Personal, Newsletters, etc. Currently my inbox is empty, its usual state. I would recommend that you regularly back-up your email folders and addressbook, etc. just in case.
I kind of lost trust to avast, since it moved my whole inbox-folder without me doing anything. Have you heard of this problem before?avast doesn't do anything autonomously, you either have to tell it what to do or adjust the settings to do something without input. Yes I have heard of this before as has Mozilla, hence the warning in the FAQs.
I know it is a pain but I think you have lost your old inbox.
PartNo_something means that only an attachment from the e-mail has been moved to Chest, not the whole mailbox.
It might theoretically be possible that the mailbox got somehow corrupted in the process… so, again -what does the “Properties” option of the chest file say?
Igor,
I am fairly certain that avast! only just about knows the difference between a Thunderbird mail folder and a hole in the road. It certainly does not know how to extract an attachment from an email in a Thunderbird mail folder.
So you appear to be telling euphemos that this was an attachment (that could only have been quaratined by the Internet Mail Scanner) when the user says the whole folder has disappeared.
I do (from time to time) watch my weekly avast scan of my system. I have several very large mail folders in Thunderbird (containing messages moved from the Inbox - so the Inbox stays small). When avast scans these large folders it shows very clearly in the progress that it is scanning partno_0… then partno_1… etc. It does exactly the same with large PST files for Outlook and OE.
I have to say that I am beginning to wonder about the value of having avast! on-demand scanning the Thunderbird mail folders at all (or indeed the mail folders of any other mail client). The Internet Mail Scanner (along with the Outlook/The Bat plugins) apparently has the only “email smarts” in the avast! world. Probably better to just have the Internet Mail scanner protecting the mail files from contamination and the standard shield if one should try to execute an infected attachment if the mail client extracts it from a message.
Incidentally, I have tried my best to replicate the problem encountered by euphemos. I have placed just about every eicar infected message available into one of my Thunderbird mail folders. I did not expect (as I discussed above) that on demand scanning would detect any of the base64 encoded eicar attachments but I did expect that the “in the clear” eicar string would be found (and hopefully quaratine the folder). Both the full scan and ashquick.exe scan the infected mail folder and report it virus free.