Norton Anti-Virus 2011 (Version 18.5.0.125), in trying to remove an invoice_copy.exe virus that was downloaded, scrambled a couple dozen e-mails in my Thunderbird (Version 3.1.9) in-box while I was away from the computer.
Thunderbird may likely have been in the process of moving the virus-infested e-mail from the Inbox folder to the Junk folder, because the same virus was found in both Inbox and Junk. NAV seems to have deleted the messages or scrambled them in such a way that they didn't even show up in the message list, so I can't prove that they were the same message. However, NAV reports the same virus being found at the same time in both folders. And I have Thunderbird configured to filter some messages to Junk. (Don't know what tripped the trigger, however, as the message is gone, but each virus has been quarantined. Not a helpful default setting, to my mind.)
NAV Activity report (which I can't seem to simply copy and paste):
invoice_copy.exe
[Contained in] invoice_copy_in32948.zip
[Contained in] unknown01f28e0d.data
[Contained in] (path to file)\inbox
Deleted
invoice_copy.exe
[Contained in] invoice_copy_in32948.zip
[Contained in] unknown000f1d07.data
[Contained in] (path to file)\junk
Deleted
Relevant Thunderbird settings:
Tools, Options, Security icon, Anti-Virus tab, "Allow anti-virus clients to quarantine individual incoming messages" is checked.
Relevant NAV 2011 settings:
Settings, Real Time Protection section:
SONAR Protection: On
SONAR Advanced Mode: Automatic
Remove Risks Automatically: Off
Remove Risks if I Am Away: On
Show SONAR Block Notifications: Show all
I have now turned off "Remove Risks if I Am Away," hoping that I will be prompted to deal with a suspect file when I return. If I'm not, I trust NAV will still check every file I save to the hard drive and every file I execute.
Hugh Wyn Griffith asked me to post my experience here. Let me know if there's any further information you need, and I'll see what I can do. A bit more discussion here, but I think this is the best distillation of that discussion.
-- Timothy J. McGowan