I would suggest you stop subscribing to mail that use LiveIntent web bugs to monetize their email. The server is owned/registerd to LiveIntent see https://monetizepros.com/ad-network-reviews/liveintent/ and http://whois.domaintools.com/licasd.com

Basically Thunderbird is doing it's job getting mail. Your anti virus is protecting you from yourself blocking the web tracking information from em.licasd.com/m

The solution is determine which mails contain the links and unsubscribe from them or change your anti virus settings to ignore that particular risk. None of the solutions involves Thunderbird.

Thanks. I never thought about the emails being active... I've searched the registry, to no effect. Thank you for the detailed information!

They are not active in the true sense, the link will most probably be to an image, a link however that identifies you as the mail recipient.

the link is perhaps something like em.licasd.com/m/queries?whsxcv fkjnsxzoijncv just a jumble to you and me, but an encoded version of your email address to the web server. When it gets the request it send you an image, but it sends everyone an image and logs the fact that they opened the email, and perhaps that they clicked on the link for toilet soap in the email.

These guys also do email marketing http://mailchimp.com/features/ have a look at the detailed information they offer their clients about what you do with mail they send. did you open it, how long did it take what did you click on did you buy when you clicked. After all the link that opens the web site identifies you, so they know what you did on the web site based on what you clicked to get there.

Thanks again