SillyDog701

[RootsMan]

Greetings,

I'm using Netscape v7.1 for my personal email.

I received an email this morning that contained an infected attachment.
Symantec AntiVirus 8.0 quarantined the entire Inbox which meant that all my mail was now missing.

To recover from this,
1. Undo the quarantine in AntiVirus.
2. Temporarily disable File System Realtime protection
3. Open the "inbox" file using a text editor. I used UltraEdit-32 (http://ultraedit.com).
4. Go to the end of the Inbox file and delete the chunk that belongs to the infected attachment. (The infected attachment is most likely in the last email received.)
5. Save the Inbox
6. Enable File System Realtime Protection. (!!! Very important !!!)
7. You should now have full access to you email.


To prevent this from happening to you, you'll need to exclude your Inbox from the real-time scan. Your system will still be protected because an infected attachment will still be detected when you try to open it.

Here is now to prevent this from happening to you.

Netscape or Outlook Express Inbox is quarantined when infected email is detected
http://service1.symantec.com/SUPPORT/en ... 1809560948


Situation:
Symantec AntiVirus Corporate Edition (Symantec AV) or Norton AntiVirus Corporate Edition (NAVCE) has detected an infected email, and the options are set to have infected files quarantined. You now find that your Netscape or Outlook Express 5.0 Inbox has been quarantined.

Solution:
Netscape and Outlook Express store email in a single file. Symantec AV or NAVCE scans the file, and quarantines the file if a virus is detected. Because all email is stored in a single inbox file, the entire inbox is quarantined in some circumstances. To avoid quarantining the entire inbox file, we suggest excluding the inbox file from being scanned.

How to avoid having the entire Inbox placed in Quarantine
Excluding the inbox file from being scanned prevents the inbox file from being quarantined while still allowing a virus to be detected. When a virus is found in an opened email message, rather than during a scan or when downloading, the opened message can be safely quarantined--or deleted--without causing problems with the Inbox itself.

o The Outlook Express 5.0 inbox file is named Inbox.dbx.
o The Netscape inbox file is named Inbox.


How to exclude specific drives, folders, and files from being scanned by Symantec AntiVirus Corporate Edition 8.0
http://service1.symantec.com/SUPPORT/en ... 94848?Open

This issue also applies to Mozilla and may apply to other email clients.

Regards,

RootsMan
http://CVibes.net/
.=.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) (CK-SillyDog)

[Fulvio]

I learned my lesson five years ago, when I wish that Norton AV would quanrantine the Inbox. It deleted it.
Of course, I may have been able to optimize the setup. But, not using Norton was a good option then, as it is now.
There is no need for scanning mail, and the only reason for using OE is to check a problem before reporting it, since your ISP will not support other mail clients.
My phylosophy is to mistrust first, and the more exposed one is, the worse it is going to me.
But, I really feel that Rootsman input will help a number of people. Thank you.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040421

[Alice]

I just added my Inbox files to the Exclusion list in Norton AV 2004*

Open Norton AV, click on Options.
Under System > Autoprotect > Exclusions:

When you select Exclusions, there is a space under "Items" to add the path to any file, or you can select a file by clicking the open folder icon. I noticed that *.dbx was already in Autoprotect Exclusions. .DBX is the file extension for Outlook Express mail files. So, I clicked on the NEW button, clicked the open folder icon and browsed to my Inbox files and excluded them. I had to browse to each Inbox file, since I have multiple e-mail addresses and different profiles.

I also looked in the Exclusions under System, Manual Scan, but since no .dbx files were excluded there, I decided not to exclude any of my Mozilla or Netscape mail files from a Manual scan. I wasn't using Norton AV's "Email scanning" feature but I just enabled it, so that the mail is scanned automatically as it is being downloaded, preventing infected mail from sitting in the Inbox for any length of time.

I've never had Norton AV catch a virus (my ISP ATT Worldnet does a good job of screening them out) but I would think it would be easier to get a file out of Quarantine:

http://bugzilla.mozilla.org/show_bug.cgi?id=116443
Deleted inbox after receiving virus infected mail

------- Additional Comment #27 From James Gurney 2002-10-27 10:47 PDT [reply] -------

I ran into this with Norton AV. FYI, for anyone who has this problem, you can go into the Norton tools, look in the quarantine and select the Inbox file and restore it to recover the data. It appears to strip the 'virus' email in the process. It's not an ideal solution, but if you're running Norton it's a way to recover lost data.

*For more information including instructions for different versions of Norton AV see
http://service1.symantec.com/SUPPORT/na ... 9829164436
How to exclude specific drives, folders, and files from being scanned

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040421

[Fulvio]

I found this; NORTON ANTIVIRUS 7.6 FOR PC: MANAGING QUARANTINED FILES
to recover important files, after the next update.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) (CK-SillyDog)

[Alice]

That page looked a bit outdated so I did a websearch and found this in Symantec's Knowledge Base (If you go to the Reports Quarantined Items View Report section in Norton AV 2004 you will also find a Help link with more information):

http://service1.symantec.com/SUPPORT/na ... 3109560706
Restoring a file from Quarantine

This document describes how to restore a file to its original location after the file has been quarantined using Norton AntiVirus (NAV).

Solution:
This document describes how to restore a file from Quarantine. If you want to know how to delete a quarantined file, then see the document Removing files from Norton AntiVirus Quarantine. If you have submitted a quarantined file to Symantec Security Response using NAV Scan and Deliver, then the previously quarantined file will be moved from Quarantined Items to Backup Items.

To restore a file that has been quarantined

WARNING: You should do this only if you are sure that the file is not infected.

1. Start NAV.
2. Click Reports.
3. Do one of the following:
* NAV 2000/2001: Double-click 'View and manage the items in Quarantine."
* NAV 2002/2003: In the Quarantined items section, click View Report.
4. In the left pane, click "Quarantined Items."
5. In the right pane, select the item that you want to restore.
6. Click Restore Item.
7. When you see the Warning message, click Yes.
8. When the Restore results message appears, click OK. The file will be decrypted and replaced to its original location.

After restoring the quarantined Inbox:

Instead of disabling Autoprotect (real-time protection) and opening the Inbox with a text editor and removing the infected attachment portion, as RootsMan suggested, I would imagine that you could open the Inbox normally within Netscape/Mozilla, find the infected mail, then delete it, then compact the Inbox and accomplish the same thing.

Outlook Express is another matter.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040421

[Fulvio]

thanks alice, I know you would come up with a good suggestion.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040421

[profman]

My general approach is to prevent Norton from scanning any E-mail. In fact, I prevent any automatic action by Norton software from occuring without my express command. I do not necessarily recommend this approach to anyone without my peculiar habits. I frequently download Norton AV updates and carry out complete manual Norton AV scans. I configure Norton AV to ask me before it carries out any action against an infected file. If the infected file is found in my mail, I believe that deleting that file and then compacting the folders involved (as suggested by Alice) has gotten rid of the infected item without messing up my mail. If the compacting the mail is skipped, it seems to me that Norton has still found the infected item.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113

[RootsMan]

Greetings,

Instead of disabling Autoprotect (real-time protection) and opening the Inbox with a text editor and removing the infected attachment portion, as RootsMan suggested, I would imagine that you could open the Inbox normally within Netscape/Mozilla, find the infected mail, then delete it, then compact the Inbox and accomplish the same thing.

Alice, I tried twice, and both times Symantec AntiVirus quarantined my inbox as soon as I opened Netscape Mail. So I couldn't get to the email with the infected attachment. That's why I had to manually edit my inbox file. I couldn't even make a backup of inbox while the AV was enabled. Both the copy and the original would get quarantined during the copy process.

RootsMan

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) (CK-SillyDog)

[Fulvio]

So, Norton has not changed since I returned it five years ago. Bad news if you cannot control what you are doing.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a) Gecko/20040515 Firefox/0.8.0+

[Ramona]

I prevent any automatic action by Norton software from occuring without my express command. I do not necessarily recommend this approach to anyone without my peculiar habits.

I don't think there's a thing peculiar about how you configure Norton. I don't allow Email screening, and I have Norton configured as do you, ask first, and nothing automatic.

I think this is more or less the trend, especially with Mozilla users, as Mozilla FAQ tell us that Mail & Newsgroups will not allow a virus or worm to execute automatically. You would have to save a file to your system and deliberately run it before it could cause any harm. JavaScript is switched off by default for mail and news, so an e-mail cannot run script code just by being opened.

From Symantic:
Norton AntiVirus Auto-Protect protects your computer from viruses and other malicious code by automatically scanning any email attachment file that is opened, moved, or copied on your hard drive. For more information see:
How Norton AntiVirus Auto-Protect protects your computer.

Ramona

UserAgent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7) Gecko/20040501

[Alice]

Greetings,

Instead of disabling Autoprotect (real-time protection) and opening the Inbox with a text editor and removing the infected attachment portion, as RootsMan suggested, I would imagine that you could open the Inbox normally within Netscape/Mozilla, find the infected mail, then delete it, then compact the Inbox and accomplish the same thing.

Alice, I tried twice, and both times Symantec AntiVirus quarantined my inbox as soon as I opened Netscape Mail. So I couldn't get to the email with the infected attachment. That's why I had to manually edit my inbox file. I couldn't even make a backup of inbox while the AV was enabled. Both the copy and the original would get quarantined during the copy process.

RootsMan

Seeing how Mozilla and Netscape will not launch a virus attachment automatically I would feel save in disabling Autoprotect before opening Netscape Mail, then delete the infected e-mail and finally compact the Inbox.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040421

[sfinks]

Greetings,

I'm using Netscape v7.1 for my personal email.

I received an email this morning that contained an infected attachment.
Symantec AntiVirus 8.0 quarantined the entire Inbox which meant that all my mail was now missing.

To recover from this,
1. Undo the quarantine in AntiVirus.
2. Temporarily disable File System Realtime protection
3. Open the "inbox" file using a text editor. I used UltraEdit-32 (http://ultraedit.com).
4. Go to the end of the Inbox file and delete the chunk that belongs to the infected attachment. (The infected attachment is most likely in the last email received.)
5. Save the Inbox
6. Enable File System Realtime Protection. (!!! Very important !!!)
7. You should now have full access to you email.


To prevent this from happening to you, you'll need to exclude your Inbox from the real-time scan. Your system will still be protected because an infected attachment will still be detected when you try to open it.

Here is now to prevent this from happening to you.

Netscape or Outlook Express Inbox is quarantined when infected email is detected
http://service1.symantec.com/SUPPORT/en ... 1809560948


Situation:
Symantec AntiVirus Corporate Edition (Symantec AV) or Norton AntiVirus Corporate Edition (NAVCE) has detected an infected email, and the options are set to have infected files quarantined. You now find that your Netscape or Outlook Express 5.0 Inbox has been quarantined.

Solution:
Netscape and Outlook Express store email in a single file. Symantec AV or NAVCE scans the file, and quarantines the file if a virus is detected. Because all email is stored in a single inbox file, the entire inbox is quarantined in some circumstances. To avoid quarantining the entire inbox file, we suggest excluding the inbox file from being scanned.

How to avoid having the entire Inbox placed in Quarantine
Excluding the inbox file from being scanned prevents the inbox file from being quarantined while still allowing a virus to be detected. When a virus is found in an opened email message, rather than during a scan or when downloading, the opened message can be safely quarantined--or deleted--without causing problems with the Inbox itself.

o The Outlook Express 5.0 inbox file is named Inbox.dbx.
o The Netscape inbox file is named Inbox.


How to exclude specific drives, folders, and files from being scanned by Symantec AntiVirus Corporate Edition 8.0
http://service1.symantec.com/SUPPORT/en ... 94848?Open

This issue also applies to Mozilla and may apply to other email clients.

Regards,

RootsMan
http://CVibes.net/
.=.

problems with Outlook Express??? Try it...

Repair Outlook Express
Outlook express repair
Repair express outlook

UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

[ceem]

Hi All,

Great posts and very helpful. I have ran into this problem at work and am attempting to exclude all inbox from being scanned. The darn extention only allows 4 characters and the files folder requires a path.

I have used the following for the named apps:

Outlok Express 5.0
C:\Windows\Application Data\Identities

Netscape
C:\Program Files\Nescape\Users

Mozilla
C:\Windows\Application Data\Mozilla\Profiles\

This will work as logn as
the system directory is called windows
the path is installed as default

know of any way to just exclude the INBOX and save myself the guessing game?


Thanks!!!

UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)

[Fulvio]

I was under the impression that if you exclude .msf files (the header files), you protect your gecko-based mail.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.11) Gecko/20050728

[Alice]

know of any way to just exclude the INBOX and save myself the guessing game?

Depends on your version of Norton AV... for example, for Norton AV 2004, see my above post from 14 May, 2004 8:35 am

Open Norton AV, click on Options.
Under System > Autoprotect > Exclusions:

When you select Exclusions, there is a space under "Items" to add the path to any file, or you can select a file by clicking the open folder icon. I noticed that *.dbx was already in Autoprotect Exclusions. .DBX is the file extension for Outlook Express mail files. So, I clicked on the NEW button, clicked the open folder icon and browsed to my Inbox files and excluded them. I had to browse to each Inbox file, since I have multiple e-mail addresses and different profiles.

Your Mozilla and Netscape 7.xx Inbox files are located in the Profile Folder under MAIL, in a subfolder named for the mail server. In Windows 2000 and XP the "Application Data" folder containing the Mozilla Profiles may be hidden., so you might need to double-click My Computer, then click: Tools -> Folder Options -> View (tab) -> Show Hidden files and folders.

On a Windows XP system the Inbox file (just "Inbox" - no extension) might be here:
C:\Documents and Settings\Alice\Application Data\Mozilla\Profiles\default\abcdefgh.slt\MAIL\pop.ISP.net\Inbox
In Windows 98, the path might be:
C:\Windows\Application Data\Mozilla\Profiles\default\abcdefgh.slt\MAIL\pop.ISP.net\Inbox

You can find the path to your mailserver folder by looking in the Mail Account Settings, Server Settings, in the "Local Directory" box: See this SCREEN SHOT
screenshot from: http://www.mozilla.org/mailnews/specs/accounts/AcctSetOld.html

Edited by Moderator to eliminate horizontal scroll

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.11) Gecko/20050728