How to clean an infected mailbox
In F-Secure Internet Security 2006 and 2007, the Disinfection Wizard handles a mailbox infection automatically and recommends the appropriate action to take.
If you are using an earlier version of F-Secure Internet Security, please note the following:
The F-Secure Anti-Virus product handles an e-mail client mailbox in the same way as it handles any file on your hard drive. Therefore, if you have an infection in your mailbox, do not select the Delete option in the Disinfection Wizard because it will delete the entire mailbox file and not only the virus. If the wizard cannot remove the virus from your mailbox, you can delete it manually. To remove the infected mail from the mailbox, you need to temporarily disable the virus protection.
Step 1: Disable antivirus protection
- Double-click the F-Secure icon in the Windows system tray.
- Select first the Virus Protection page and then select Change... The Virus Protection Level dialog is displayed.
- Select the Off option from the Virus Protection Level Selection list.
- Open your e-mail client and remove the infected mail manually as instructed below.
Warning! Be cautious not to execute any e-mail attachments because the real-time antivirus protection is currently disabled.
Step 2: Remove an infected mail manually
To remove the virus from your mailbox, you have to delete the infected message(s) in the e-mail client that you are using. After this, compact the mailbox and scan the mailbox file manually just to be sure that the file is clean. The current versions of F-Secure Anti-Virus, F-Secure Internet Security and F-Secure Anti-Virus Client Security cannot delete the virus infection inside the mailbox file. By using the E-mail Scanning functionality, the viruses will not infect the mailbox file in the first place.
Step 3: Compact your mailbox
The way how the mailbox is compacted (or compressed) depends on the used e-mail client. See the mail client documentation for details. Below you can find instructions on how to compact the mailbox file for the most commonly used mail clients:
- In Netscape Messenger and Mozilla mail client, right-click the folder, select "Compress folder" or "Compact this folder".
- In Outlook Express, select File | Folders | Compact all folders.
- In Outlook, the compacting of the mailbox varies greatly depending on the version used. For more information, take a look at the following Microsoft articles:
Step 4: What to do if I do not know which mail is infected?
What if the F-Secure Anti-Virus product does not show exactly which message is infected; it just shows that the mailbox file is infected. In this case, one way to remove the infection manually is to create a couple of temporary mail folders. Then, move half of the infected mailbox to a new mailbox, compact the folders and rescan them. After this, the infection should be in either one of the mailboxes. Move again half of the mails from this infected box to a new one, compact the folders & rescan. Repeat this as long as needed. In this way it is relatively fast to find out where the infection is even if the original mailbox file had thousands of messages. This also applies to mailbox files that have an unknown format where the F-Secure Anti-Virus product only detects an infection in the file but cannot pinpoint the exact message.
Step 5: Enable antivirus protection
Once you have cleaned your mailbox file, remember to re-enable the Virus Protection. It is also recommend that you scan again the hard drives of your computer manually to make sure there are no other infections left.