All of a sudden, after years of use, with no alerts, I am getting anti-virus alerts on my work computer when I start/use Thunderbird portable. I would like to post a printscreen, but don't see how to do it. I also can't test the detected item because McAfee deleted it. But from the log there is this:
rheath ran H:\PortableApps\ThunderbirdPortable\App\Thunderbird\thunderbird.exe, which attempted to access H:\PortableApps\ThunderbirdPortable\Data\profile\startupCache\startupCache.4.little\contentAreaClick.js. The potentially unwanted program named Suspicious Attachment!script was detected and deleted.
There were 51 "threats" and all of them were similar and in the startup cache. I deleted all the history and cache, so at the moment this folder is empty.
Can anyone advise? Was this a false threat, or should I be concerned?
Thanks.
Visit the Community page
Join our forums
Subscribe to our email newsletter
Subscribe with RSS
Follow us on Facebook
Follow us on LinkedIn
Follow us on Twitter
Follow us on Mastodon
Follow us on BlueSky
I just got another 56 alerts! I am closing Thunderbird Portable until I get an answer and solution.
Thanks.
Engenulf
Scanning the installer via VirusTotal in 36 different engines shows it clean as always: https://www.virustotal.com/#/file/81e5a09ec50d29a7813f1f40616d217bc9d0b5...
It is possible yours got infected if you bring it from PC to PC, though. startupCache.4.little is a cache file of Thunderbird's startup bits in your current configuration. Upload it to VirusTotal.com to scan it. That will let you determine if you were infected or if your antivirus is having issues.
Sometimes, the impossible can become possible, if you're awesome!
The file reappeared after I closed Thunderbird. I ran it through VirusTotal.com and they found nothing, although a lot were designated as unknown. If this keeps on this way, I won't be able to use Thunderbird at work. I only use this portable drive at work, rarely use in on a home laptop, but I don't usually use portable apps, only documents I have on the drive. At most, it has ever been in three computers, two at home, and the one at work. Thanks.
Engenulf
I stopped using Thunderbird Portable for a while, and then started it up again just a couple of weeks ago. No more alerts. I don't think I had updated Thunderbird in the meantime, so apparently the anti-virus software must have been updated, and the false alarms corrected.
Engenulf