A deleted trojan shows up in my (Bullguard) virus scan and Bullguard claim that Thunderbird "shift delete" may not have completely deleted the offending email.
I had an email with Trojan.vbs Agent.amv attached. I forwarded it to the city police and deleted both the original and the forward using "shift - delete". Bullguard anti-virus detected the trojan in one of it's own ".mtmp" files and Support has advised me that the trojan may still be on the hard disk despite the "shift-delete" process and have advised me to find it and delete it. I have no clue as to how I can find an already deleted file. Does anyone have any kind advice please?
Chosen solution
lambch said
sfhowes saidThe message may be in some other non-TB folder, e.g. a Temp directory that contains files being scanned, or it could possibly be in another mail folder such as the 'All Mail' folder of a gmail account. The best I can suggest is to inspect the Bullguard report for the file's location and run Disk Cleanup (Windows Administrative Tools) to delete all unnecessary temp files.Thanks sfhowes. I'll investigate those possibilities and let you know what happens. Thanks for your help.
Hi sfhowes I tried the suggestions above and ran the Windows Disk Cleanup to no effect. However, the Bullguard report was pointing to one of its own hidden temporary files. I checked with Bullguard and they agreed it was ok to delete it. This seems to have solved the problem although I don't know why Bullguard pointed me at Thunderbird in the first place as the problem was located exactly where their software said it was! Anyway, thank you very much for your kind suggestions which got me to the right place in the end.
Read this answer in context 👍 0All Replies (10)
Shift-Delete simply bypasses the Trash folder; a message isn't completely removed from your computer until the original folder is compacted (right-click a folder, Compact).
I had an email with Trojan.vbs Agent.amv attached. I forwarded it to the city police
What exactly do you expect the city police to do with it? What if that's interpreted as an attack on their systems?
christ1 said
I had an email with Trojan.vbs Agent.amv attached. I forwarded it to the city policeWhat exactly do you expect the city police to do with it? What if that's interpreted as an attack on their systems?
Hi christ1 Thanks for the response. I was trying to keep the posting concise so by "city police" I meant the dedicated fraud line NFIBPhishing@city-of-london.pnn.police.uk I don't expect they will do much with the individual email but they like to know what is out there for their intelligence picture. They request intelligence so they won't see it as an attack and I'm happy to do everything I can to frustrate those who want to steal my identity.
sfhowes said
Shift-Delete simply bypasses the Trash folder; a message isn't completely removed from your computer until the original folder is compacted (right-click a folder, Compact). http://kb.mozillazine.org/Undelete_a_message
Hi sfhowes. Thanks for your suggestion. I wasn't aware of that and I've been ignoring prompts to compact the folders so this may be the way forward. I'll compact the folders, run the scan and let you know if it fixes the problem. Thanks.
If you suspect something may on your computer, suggest you reboot computer in Safe Mode and then scan.
Toad-Hall said
If you suspect something may on your computer, suggest you reboot computer in Safe Mode and then scan.
Hi Toad-Hall. Thanks for your response. I have run a scan in safe mode but the problem persists. I appreciate the idea and the help.
lambch said
sfhowes saidShift-Delete simply bypasses the Trash folder; a message isn't completely removed from your computer until the original folder is compacted (right-click a folder, Compact). http://kb.mozillazine.org/Undelete_a_messageHi sfhowes. Thanks for your suggestion. I wasn't aware of that and I've been ignoring prompts to compact the folders so this may be the way forward. I'll compact the folders, run the scan and let you know if it fixes the problem. Thanks.
Hi sfhowes. I compacted the folders and ran a scan but I got the same problem. It seemed like a possible solution and I'm grateful that you took the time. Thanks.
The message may be in some other non-TB folder, e.g. a Temp directory that contains files being scanned, or it could possibly be in another mail folder such as the 'All Mail' folder of a gmail account. The best I can suggest is to inspect the Bullguard report for the file's location and run Disk Cleanup (Windows Administrative Tools) to delete all unnecessary temp files.
sfhowes said
The message may be in some other non-TB folder, e.g. a Temp directory that contains files being scanned, or it could possibly be in another mail folder such as the 'All Mail' folder of a gmail account. The best I can suggest is to inspect the Bullguard report for the file's location and run Disk Cleanup (Windows Administrative Tools) to delete all unnecessary temp files.
Thanks sfhowes. I'll investigate those possibilities and let you know what happens. Thanks for your help.
Chosen Solution
lambch said
sfhowes saidThe message may be in some other non-TB folder, e.g. a Temp directory that contains files being scanned, or it could possibly be in another mail folder such as the 'All Mail' folder of a gmail account. The best I can suggest is to inspect the Bullguard report for the file's location and run Disk Cleanup (Windows Administrative Tools) to delete all unnecessary temp files.Thanks sfhowes. I'll investigate those possibilities and let you know what happens. Thanks for your help.
Hi sfhowes I tried the suggestions above and ran the Windows Disk Cleanup to no effect. However, the Bullguard report was pointing to one of its own hidden temporary files. I checked with Bullguard and they agreed it was ok to delete it. This seems to have solved the problem although I don't know why Bullguard pointed me at Thunderbird in the first place as the problem was located exactly where their software said it was! Anyway, thank you very much for your kind suggestions which got me to the right place in the end.