I've let my Forticlient remove the detected infected file three times. If I don't launch Thunderbird I won't get the message. It started happening right after I selected 'download content for this message', and the remote content was four images contained w/in a canned message about 'Advice from an old man' with advice in captions of each 'seductive' image of women. I deleted the message from inbox, and trash, the last time, then let Fortinet reboot and remove once again. After roboot and removal, launch Thunderbird with same problem. The only difference is that the actual filename of the infected file changes some each time. The first time it was 'invoice_SCAN_28Vvk.js', the second it was 'invoice_copy_SXXKra.ja', and the third it was 'invoice_copy_OJFzQw.js', each time appearing in folder 'c:\users\owner\appdata\roaming\thunderbird\...\' (doesn't show the full address in the warning message from Forticlient, but to the ellipsis). I've also tried to scan for viruses in the 'owner\appdata' directory w/no reported virus. If I don't launch Thunderbird, the file / virus isn't spawned. Thank you for any help. Mark.