I have to wonder about the process that Norton Internet Security is going through to continue posting a message to me every morning for last two months. I get the big "Threats Detected - Action Required" notice shortly after I start my computer every morning. Specifically, it states that it has detected threats in an attachment to a message in my Thunderbird Inbox file and offers to delete my inbox, but that the file is too large to be backed up.
The first time I got this message, I used the Locate link to find the file in question. It was about 1.3 GB in size. I went through the file and deleted anything with an attachment that was not essential for my work. I reduced the file size to under 1000 MB by doing this. The next morning, the notice reappeared. I went through the file every day jettisoning more messages. Eventually, I got the file down to about 750 MB. The message still showed up every morning. Yesterday, I made a new subfolder under my Inbox for 2012 and prior messages. I moved all of those messages to that folder. Then, I created 201301, 201302, etc. folders for the first 6 months of 2013. I moved the messages from each month into those files. Now, I have about 200 messages in my inbox and the Inbox file occupies about 8 MB. I expected that now Norton would find the threat in one of my new subfolders. But nope, it says it's still in the Inbox and, incredibly it says that an 8 MB file is too large to back up. Really!? I think it's just joshin'. I have to wonder if it even looked or if it just has this issue in some internal list that needs to be refreshed. Can anyone tell me what's really going on here?
When you delete a message from your Inbox, it does not get moved to the Trash or physically deleted. Instead, a copy is created in the Trash folder and your original message remains in the Inbox, but is now hidden. It may be that Norton is still detecting the hidden message. In order to physically remove a deleted message, you need to compact the folder(s). If you have not been compacting regularly, you should first backup your mail folders as insurance against possible corruption, due to the large file sizes.
Thunderbird stores all messages in a folder as one large file, therefore if Norton detects a malicious attachment in one of the messages it will offer to quarantine the entire folder. This can be problematic for your Inbox. I would advise you to exclude your Inbox and other important mail folders from AV scanning. Please see the following articles about Thunderbird and antivirus programs:
I forgot to mention that after each deletion, I had compacted folders and emptied the trash (trash file size is zero after I finish). As I said, my Inbox file size is now down to about 8 MB. Hopefully, that is not too big to back up, but the message is still the same.
Also, the detailed description of the file has not changed. It is still
This is the description that it had 2 months ago. Now, I have a new set of subfolders. The messages from two months ago are in the 201305 subfolder in Thunderbird and stored in the file named 201305 in the Inbox folder. So I am puzzled. If the NIS process is to actually scan the disk and find threats, then I don't know how it could still find this threat in this file. One more thing: if I use the locate to find the file, right click the file and tell it to do a "Norton Internet Security" "Insight Network Scan", it reports "No threats found". But the next morning, the message reappears. The only way that makes sense to me is if the morning message results from some threat list that does not get updated by that on-demand scan.
Finally, I did exclude the Inbox file from scans yesterday morning. The message still appeared this morning. This would seem to support the threat list hypothesis.
Thanks for your help, but I would still like to get rid of that Threat Detected message. Any additional help would be appreciated.
OK, another possibility is that you have removed the threat, but because you did it manually, Norton is unaware that the issue has been resolved, and so Norton continues to remind you about it. Open Norton History to "Unresolved Security Risks," and if you find the threat listed there, clear it.
Besides scanning the Inbox and eventually deleting the Inbox upon discovery of a virus, there is one more aspect to this subject about receiving Emails. Check the setting in Thunderbird mentioned in this kb :
Although some people think this setting is error prone (which could have been shortly after it became available), I never experienced any problems with it and I use it for many years now.
I also never experience problems that Norton wants to delete my Inbox in a normal scan, when a virus is found. It just deletes it from the Inbox and leaves the Inbox further untouched. Maybe a side-effect of the above setting? I never questioned myself about it, as OP's problem never arises here.
Thanks for your suggestion. At this point, I think I am going to stay with my approach of saving messages based on date. When I get to the end of the year, I will just move my monthly folders into the prior year folder. I suppose it may take a little longer to do searches over all the files, since the program will have to open each file, but I think there will be offsetting benefits in speed to limiting my Inbox to just the current month's messages.