Thunderbird Community Forum

I have a trojan in one of my emails. Every time I start TB McAfee catches the bug. I cannot find it. What processes does TB execute while loading. I want to be able to isolate the the bug. What tools can I use in TB to help with this.

As an 80 year old woman of sound mind and competent in most things I still struggle with AI & IT! Can anyone advise or help me restore my system with or without my original email? Do I have to change it, change my provider or start again with everything changed? Thank you for any help.

Hi, Will there ever be a functioning option to set up a primary password that aborts the start up if not provided with the correct password. Still in 2026, hitting cancel gives access to all already synced emails. Please, soon!

Recently purchased a new HP laptop. And installed my ZoneAlarm without issue. Then downloaded Thunderbird and installed it. On opening ZA went berserk constantly alerting every few seconds saying there was a Bot. See attached screenshot from the last instance of this. Deleted Thunderbird and the problem disappeared. Was the problem actually caused by Thunderbird and have you any idea what was trying to access the website in the screenshot and what the website is that it was trying to access?

existing emails are not password protected, password only good to retrieve new emails. If you open Thunderbird and password window appears and you hit cancel all existing emails are exposed for viewing. This is a security issue.

Sometime ago, when I was regularly using more than one computer, I thought I'd found a way to have my Thunderbird address book centrally located and accessible from both computers. I got no success from attempting this, but have suffered some side-effects every since. Configuring Thunderbird back then somehow involved using the location "demo.sogo.nu" and I believe it related to a security certificate. What used to happen was, soon after rebooting the computer, I'd get a couple of pop-up messages about connecting to demo.sogo.nu that I could clear away easily. Recently, something changed regarding this certificate and I now get pop-ups (screenshot attached) that continually bother me to create a security exception. I want these gone! I've gone into the Certificate Manager and can't find anything under the Server tab to delete. One other clue is a second screenshot that I discovered somewhere in Thunderbird that actually shows the *.sogo.nu certificate - but offers no way to delete it! Can anyone give me a hand? My only alternative is to literally annihilate Thunderbird and start from scratch, but I really don't want to go there.

OPERATING SYSTEM Windows 10 Professional (x64) Version 22H2 (build 19045.6466) System Model : HP HP ProDesk 600 G3 DM SYSTEM MODEL HP HP ProDesk 600 G3 DM Enclosure Type: Mini PC PROCESSOR 2.80 gigahertz Intel Core i7-6700T 256 kilobyte primary memory cache 1 megabyte secondary memory cache 8 megabyte tertiary memory cache 64-bit ready MEMORY 15.88 Gigabytes Usable Installed Memory BOARD HP 829E KBC Version 06.29 STORAGE 4.51 Terabytes Usable Local Storage Capacity 3.59 Terabytes Local Storage Free Space

• Waterfox - 6.6.12 (64-bit) • Thunderbird - 140.13.0esr (64-bit) • WordPerfect 12.0.0.602

======================================================

MESSAGE:

“Your email ***.net and data has been hacked. . . . The Trojan virus gives me complete access and control over the device you are using. As a result, blah, blah, blah, blah . . . “

I rather doubt the veracity of this, seeing it includes “I can see the full list of your contacts from your phone and all your social networks” — since I do not access the Internet from any telephone.

It has been several years since I’ve received something of this sort, so have remained confident that my system(s) remain well-protected. However, since the message did arrive in one of my email accounts, is there still the potential of my contacts list(s) being compromised, and, if so, how to safeguard against that?

Many thanks. Appreciated.

I've just recently (over the past 10 days) been notified about 3-4 times a day by Windows Defender which flagged "something" as Trojan:HTML/ScrInject.AW!MTB in "file" %temp%/newmsg.

That's where my copy of Tbird puts temp files. Closing it stops this behavior. Uninstalling and reinstalling w/out deleting my profile caused the same behavior, but uninstalling and cleaning out my profile files seems to have stopped this behavior.

I only have one extension, Compact Headers, and that doesn't seem to be the problem. Has anyone else experienced anything like this?

Jim

The certificate for pop.3marysvilleprint.com is not vailid for that server. Someone could be trying to impersonate the server and you should not continue

Hi using 153esr and Win11

I have my emails on an encrypted drive. Until now if I closed Thunderbird I would have to enter my Master/Primary password before and emails would show, i.e they were protected from casual view.

Now if I type [cancel] at the request for a password, twice in a row than all my emails are visible.

I though it may be this new thing where the [close] icon functions differently, but even if I close via the menu File > Exit it seems Thunderbird still has access to my emails without authorisation.

Any ideas would be useful

Thanks

“A fake login page at auth.tb.pro appeared while adding an Outlook account in Thunderbird. It is NOT a Thunderbird or Microsoft domain. Do NOT enter your password.”

Is this a known scammer - have others been caught by it.

I hope I avoided trouble by not responding and following the instructions I was able to get from Microsoft CoPilot to locate and remove the the dangerous cookies from my PC.

My screenshot shows the cookies that were there.

Today, I have received an email, claiming to be from Mozilla support.

The text is garbled but it appears to contain words, 'hacking', 'paynalti', and 'auto-block'. These are words which immediately put me on security alert. I haven't opened the mail but have viewed it in preview pane. and screen grabbed the attached pdf image.

Any comments?

Thanks, William

very recently perhaps with a McAfee or Thunderbird update , I am seeing a message that McAfee stops a threat every time thunderbird does a message retrieval. see attachments. I have checked my outlook account directly and deleted a bunch of messages but it persists.

I always get: "newmsg Trojan:WIN/SuspiciousAttachmentScript.a" and "C:\Users\newb\AppData\Local\Temp Trojan:WIN/SuspiciousAttachmentScript.a" from Mcafee when I open Thunderbird. I'm only getting this in Thunderbird and suspect it's a false positive of some kind. It's still worrying and I'd like to eliminate this. This has been going on for a couple of months. I've run several cleaners and anti-virus programs on the system, but it still returns.

thanks

I have a suspicion someone is reading my e-mails. I am using Virgin Media as my ISP and have changed the password on my account.

Is that enough to stop my e-mails being read by someone other than me or what can I do to protect my inbox, please?