This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

How do I run a virus scan on Thunderbird? I think my software has been compromised

  • 7 cavab
  • 1 has this problem
  • 2 views
  • Last reply by WTFeatme

more options

A relative had an account that he knew was compromised. So he sent me his new email address from the infected account. The message he sent arrived in duplicate. That is to say that there were two identical messages. I was unaware of the problem and opened the messages. Every message I have received since then has arrived in duplicate (or more copies) regardless of sender (I have sent messages from Google/Yahoo accounts). I also received a suspect email, thankfully stopped at earthlink server, that said it was from someone in my address book but the email address was foreign/bogus/fake. I am running Windows 7 and use Microsoft Security Essentials. I ran a complete system scan which turned up nothing. But I am unable to search an individual message or focus on Thunderbird. I upgraded to 52.4.0 in the hopes of eliminating the issue with no luck. Any suggestions? I am using IMAP. Can I delete that email account at server and in Thunderbid and then re-establish account or is the issue now an integral part of Thunderbird?

A relative had an account that he knew was compromised. So he sent me his new email address from the infected account. The message he sent arrived in duplicate. That is to say that there were two identical messages. I was unaware of the problem and opened the messages. Every message I have received since then has arrived in duplicate (or more copies) regardless of sender (I have sent messages from Google/Yahoo accounts). I also received a suspect email, thankfully stopped at earthlink server, that said it was from someone in my address book but the email address was foreign/bogus/fake. I am running Windows 7 and use Microsoft Security Essentials. I ran a complete system scan which turned up nothing. But I am unable to search an individual message or focus on Thunderbird. I upgraded to 52.4.0 in the hopes of eliminating the issue with no luck. Any suggestions? I am using IMAP. Can I delete that email account at server and in Thunderbid and then re-establish account or is the issue now an integral part of Thunderbird?

All Replies (7)

more options
Every message I have received since then has arrived in duplicate (or more copies)

Who is your email provider?

Do you also see duplicate messages when you login to your account via webmail?

I am unable to search an individual message or focus on Thunderbird.

Can you explain that in more detail?

Can I delete that email account at server

That would be a silly idea, unless you want to give up your current email address.

Can I delete that email account ... in Thunderbid and then re-establish account

You could do that, but then you may see the same problem again after re-creating the account.

Did you check with your email provider about this? It may well be a problem on the server.

or is the issue now an integral part of Thunderbird?

What are you talking about?

more options

Earthlink.net is the provider. The messages only appear once at the server.

I was able to scan Thunderbird by using Windows 7 start menu, typing Thunderbird, right clicking and choosing Scan with Microsoft Security Essentials. It took a split second and said no threats were detected.

When I say integral part of Thunderbird I mean it is a problem contained within the software for Thunderbird that hopefully will not affect my operating system.

A new issue is a test message sent from a Google account that appears on the server but has not been detected by Thunderbird. I will give it a couple of more hours but this is not usual. I have T Bird set to check messages at startup and if the message is at server it should appear.

Is it possible to become infected by simply viewing an email? I have found support for both yes and no on the internet.

more options
When I say integral part of Thunderbird I mean it is a problem contained within the software for Thunderbird that hopefully will not affect my operating system.

If you mean there's a bug in Thunderbird causing the behavior you do see, that's rather unlikely. If that was the case we'd be swamped by complaints in this forum. More likely there's a problem in your Thunderbird profile. Note, that's not necessarily an infection.

A new issue is a test message sent from a Google account that appears on the server but has not been detected by Thunderbird.

You may not like this, and you may completely disagree, however, in fact is the most common cause for causing problems with Thunderbird. That is when anti-virus software prevents Thunderbird from accessing mail files, and anti-virus software trying to remove attachments it thinks are malicious from messages, and causing mail file corruption in the process.

Is it possible to become infected by simply viewing an email?

You may get infected when clicking on dubious links in unsolicited messages. Or by deliberately open attachments in unsolicited messages. I suppose you did neither. Hence it is rather unlikely you got infected. Even if there is a malicious attachment in a message sitting in your Inbox, it won't do any harm, as long as you don't deliberately open or run the attachment.

Wrt the next steps: Try to rebuild the index file of Inbox. Right-click Inbox - Properties - Repair Folder

Try to start Windows in safe mode with networking enabled. - Win10 https://support.microsoft.com/en-us/help/12376/windows-10-start-your-pc-in-safe-mode - Win8 https://support.microsoft.com/en-us/help/17076/windows-8-startup-settings-safe-mode - Win7 https://support.microsoft.com/en-us/help/17419/windows-7-advanced-startup-options-safe-mode#start-computer-safe-mode=windows-7

Still in Windows safe mode, start Thunderbird in safe mode. - https://support.mozilla.org/kb/safe-mode

Does the problem go away?

more options

Well the last test message I sent from a Google account appeared initially once. Then when I checked again a few hours later there were two MORE copies of the same message. I checked it at the Earthlink server and there were 3 copies of the same message there as well. Is it possible that T Bird could create the extra copies by bouncing back to the server in IMAP mode? I've gone in and deleted them and sent yet another test message. I will wait and see what happens. So maybe it is a problem at the server.

BTW I did run the Repair Inbox Folder command (thank you) in case that would have some bearing. It inverted the order (I have it set so most recent message is at top of list) of the messages. I am uncertain if that indicates anything.

In regards to the anti-virus interfering with receiving messages/attachments, there is a utility bill that I receive monthly and I have to tell the software to ignore the warning every month. It did not do that when I initially switched to T Bird. I HOPE that the municipal server is not sending out malware to all of its customers, but I guess anything is possible.

Thanks for all for all of your input. I will get back later with results from last test message. It was sent after running repair command and so far I have only received one copy. I will know more in a couple of hours.

Thanks again

more options
It inverted the order (I have it set so most recent message is at top of list) of the messages. I am uncertain if that indicates anything.

That's expected. You'd need to restore the sort order of your choice.

there is a utility bill that I receive monthly and I have to tell the software to ignore the warning every month.

What warning?

more options

I have the utility bills stored in Local Folders and was unable to reproduce the warning, so I can't give a definite answer on that one.

Test messages showed up on server in duplicate from one address and there were five copies of the other. I will call and speak with someone at Earthlink today.

I am getting ready to send test messages to/from the two other addresses (one Google, one Yahoo) to eliminate the email programs as potential suspects.

Thanks for your input. I hope I will remember the Repair Inbox utility. That could come in handy down the road.

Have a great day

more options

After finally calling Earthlink I was able to ascertain that indeed several of their customers were experiencing similar issues with their email accounts. I was told it was a technical issue with the Earthlink server and they were working on it.

Thanks for all of your help and assistance. It was a learning experience for me.