no inbox all other files ok

no inbox all other files ok - NAVCE

First time I've used a BBS forum. Searching the web I found your site as quite informative. Last night while visiting several sites auto update of mail started. The Netscape windows hung when this happened for several seconds (never happened before). When it freed up Norton AV (corporate 7.6) indicated that a virus had been detected and quarantined. Upon trying to open the mail the inbox is empty. All other folders are intact. I'm running W2KPRO Netscape 7.1. I've searched the HDs for a file inbox but only find very small ones (there were over 100 messages still in the inbox). In talking to a friendly geek it was revealed that NAV may lock the entire inbox in quarantine at times, but no luck in finding the file there. If the infected inbox was quarantined and possibly deleted is there any hope of getting anything back?
If not are there any suggestions to replace Netscape 7.1 (I HATE IE & OUTLOOK). Thanks in advance.

 

Welcome to the Forum twelvevolt man!

Hi twelvevolt man!

Here is a fix for your problem, from Symantic:

Netscape or Outlook Express Inbox is quarantined when infected email is detected

Let us know if you continue to have problems.

Ramona

 

I've looked at this information, but am afraid that the inbox containing all the messages is not to be found on my hard drives. Their information about location of files appears to be about older versions of Netscape. I'm almost at the point of frustration. My wife says she's glad it happend to me not her.

 

This is the entire post from the other Forum, which may help you. To view your Inbox, you will have to open Norton's Quarantine section.

I'm using Netscape v7.1 for my personal email.

"I received an email this morning that contained an infected attachment.
Symantec AntiVirus 8.0 quarantined the entire Inbox which meant that all my mail was now missing.

To recover from this,
1. Undo the quarantine in AntiVirus.
2. Temporarily disable File System Realtime protection
3. Open the "inbox" file using a text editor. I used UltraEdit-32 (http://ultraedit.com).
4. Go to the end of the Inbox file and delete the chunk that belongs to the infected attachment. (The infected attachment is most likely in the last email received.)
5. Save the Inbox
6. Enable File System Realtime Protection. (!!! Very important !!!)
7. You should now have full access to you email.


To prevent this from happening to you, you'll need to exclude your Inbox from the real-time scan. Your system will still be protected because an infected attachment will still be detected when you try to open it.

Here is now to prevent this from happening to you.

Netscape or Outlook Express Inbox is quarantined when infected email is detected
http://service1.symantec.com/SUPPORT/ent-security.nsf/pfdocs/2000051809560948


Situation:
Symantec AntiVirus Corporate Edition (Symantec AV) or Norton AntiVirus Corporate Edition (NAVCE) has detected an infected email, and the options are set to have infected files quarantined. You now find that your Netscape or Outlook Express 5.0 Inbox has been quarantined.

Solution:
Netscape and Outlook Express store email in a single file. Symantec AV or NAVCE scans the file, and quarantines the file if a virus is detected. Because all email is stored in a single inbox file, the entire inbox is quarantined in some circumstances. To avoid quarantining the entire inbox file, we suggest excluding the inbox file from being scanned.

How to avoid having the entire Inbox placed in Quarantine
Excluding the inbox file from being scanned prevents the inbox file from being quarantined while still allowing a virus to be detected. When a virus is found in an opened email message, rather than during a scan or when downloading, the opened message can be safely quarantined--or deleted--without causing problems with the Inbox itself.

The Outlook Express 5.0 inbox file is named Inbox.dbx.
The Netscape inbox file is named Inbox.


How to exclude specific drives, folders, and files from being scanned by Symantec AntiVirus Corporate Edition 8.0
http://service1.symantec.com/SUPPORT/ent-security.nsf/pfdocs/2002092413394848?Open

This issue also applies to Mozilla and may apply to other email clients.

Regards,

RootsMan "

 

A search of the quarantine files in NAV does not show that a file of >45KB exists. I'm afraid that the inbox file that held all the information was deleted by NAV shortly after it was moved into the quarantine area. Thanks for your time, I think that it is gone forever.

 

Greetings,

In Symantec AntiVirus when you look in History > Virus History, do you see an entry for filename "Inbox" ?
What actions do you have set under Configure > File System Realtime Protection?

What size was your Inbox file?
How much free space is available on your hard disc drive?
If your Inbox file was larger than the available free space, then it's possible it was deleted regardles of the settings in AV.

How are you able to tell the size of the files in quarantine? My AntiVirus (v7.1) does not show file sizes.

RootsMan
http://CVibes.net/

 

NAV history does show inbox (but it may have been deleted).
Real time is set to defaults and to clean or quarantine.
The inbox was somewhere about 16MB it contained over 100 messages.
The drive mail uses has >11GB free space.
I've located the inbox file in quarantine using explorer or search and checked properties.
This just proves that I should have spent more time setting up the options for NAV for my system.

Thanks everyone for your help.

 

Greetings,

Were you able to recover your Inbox file? I wasn't sure from your message.

RootsMan.

 

The inbox file was only one message which was infected and could not be restored. This has been a lesson about keeping too many messages in the inbox, it won't happen again. I guess that's why you have the ability to create folders to store the incoming messages in. They are gone and I'm OK with that now, a lesson learned in my journey through life.
Thanks everyone!

 

Netscape Inbox lost while using Norton System Works 2004

I hope I am replying so that I have picked out the right item to respond to.
The item title: no inbox all other files ok
Was from twelvevolt man, 4th post

I had the same problem as this user had and the 7 steps given helped me to get my inbox restored. The virus was W32.Netsky.P@mm!enc. Since I did not have Corporation Edition, I had to make minor changes but it worked. Thank you so much.

However, System Works 2004 does not have an exclude file name - only exclude file extensions so not workable (Netscape is Inbox with no extension.

Have I missed something? Any other ideas? Switch from Norton? If so what?

I have sent a strongly worded email to Norton regarding what they have not done, e.g., warned people adequately, provide uptodate Knowledge Base info that works, etc. I am only slightly hopeful of help from them and I don't really care to be editing my inbox in hope of getting it fixed every so often.

FYI I am using XP Home, SP1 plus all critical updates, free ZoneAlarm Ver. 5.0.590.015, Norton Systems Works 2004 with NAV 10.0.13

Thank you for your help,
Ken

 

Ken,

When you select Exclusions, there is a space under "Items" to add the
path to any file, or you can select a file by clicking the open folder
icon. Click on the NEW button, clicked the open folder icon and browse to the Inbox files and exclude them. If you have multiple e-mail addresses and different profiles then browse to the Inbox file of each Mail Account.

You might also be interested in this Symantic Article, and Mozilla Bug:

http://service1.symantec.com/SUPPORT/nav.nsf/docid/199829164436
How to exclude specific drives, folders, and files from being scanned

http://bugzilla.mozilla.org/show_bug.cgi?id=116443
Deleted inbox after receiving virus infected mail

Ramona

 

Thank you so much. I had missed the Norton AV Knowledge base article.
That solved how to exclude the Inbox.
You helped out again,
Ken

 

Hi Ken,

Glad to hear that the Article gave you the info you needed!

Ramona

 

I am in the same situation but my copy of NAVCE 7.61.937 does not have a restore function anywhere on the quaranine screen. Is there a way to enable it?

Thanks Pete

 

Welcome to the Forum, ptbrunet!

Hi Pete,

This is a bit old, but does have a Screen Shot:

NORTON ANTIVIRUS 7.6 FOR PC: MANAGING QUARANTINED FILES


Restoring a file from Quarantine

This document describes how to restore a file to its original location after the file has been quarantined using Norton AntiVirus (NAV).
---
Some user report adding their Inbox to the "Exclusions" will prevent this problem.

Mozilla FAQ tell us that Mail & Newsgroups will not allow a virus or worm to execute automatically. You would have to save a file to your system and deliberately run it before it could cause any harm. JavaScript is switched off by default for mail and news, so an e-mail cannot run script code just by being opened.

Ramona

 

Thanks Ramona. As the first link says, I am probably out of luck. I think I have a backup of that file from about a month or so ago and that should have most of what I want. (I also just finished a backup of my other inbox ;-)

If anyone knows of the secret of enabling the restore option on NAVCE (or where NAVCE hides the quarantined file), please let me know.

Thanks, Pete

 

Pete,

See this Users Guide which also shows the location of the Quarantine file for the Corporate Edition: http://www.yu.edu/mis/nav/NAVCE75U.PDF
Look at Pp. 31. and 32.

Ramona

 

Pete,

You might also try the symantec.support.winnt.nortonantivirus.general newsgroup, or the
General Symantec and Norton Antivirus forums

Ramona

 

Ramona, Thanks for the PDF. That gave me the hint I needed. There is a key called PreventRestore in both GRC.DAT on the disk and in the registry. I changed it from 1 to 0 in both places. (I probably only needed to do it in the registry.) Then I was able to restore the mail file and delete the offending email from it. (I had earlier found FSRPLCK.EXE on the disk to allow temporary disablement of the real time scanning, though I don't know if I really needed to do that.) I undid all my changes after all that to get back to the original configuration.

Thanks again, Pete