PPRuNe Forums - View Single Post - trojan problem emails
View Single Post
Old 16th Aug 2011, 13:52
  #3 (permalink)  
Mike-Bracknell
 
Join Date: Jan 2008
Location: Bracknell, Berks, UK
Age: 52
Posts: 1,133
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by rans6andrew
Daily I keep getting a number emails, each claiming to be a "UPS Notification" and which have a trojan embedded in. When I delete them (Mozilla Thunderbird) they get moved to my deleted items folder BUT this single email totally jams up the folder meaning subsequent deleted items can't clear until the folder is emptied. As I am getting several of these rogue emails each day I have to manually delete and empty the folder in a careful order to prevent the rogue files ever being opened/read. The virus tools I have (AVG) only pick up the threat when it is moved into the deleted items folder.

I have tried using the message filter tool to automatically move the mails to the deleted folder but the lock up seen above still happens with the attendant risk of the next message automatically opening on message deletion, the next message MAY be another rogue message.

If I set a message filter to "remove from POP3 server" is this going to remove the message from the server and NOT bring it to my local folders? Anyone know how this is handled by the Thunderbird system?

Thanks for reading this.

Rans6....
If you're using POP3 solely, what the server does is retrieve your inbound email (in text format) and append it to a long text file of your email mailbox. This is then indexed by the POP3 server based upon settings negotiated by the client.

i.e. the mailbox on the server looks like this:

<separator>
header and contents of email #1
<separator>
header and contents of email #2
<separator>
header and contents of email #3
<separator>
header and contents of email #4

your mail is then retrieved by the POP3 client by contacting the server and sending a stream of commands that manipulate the index, the content, or both.

Hence, the "leave mail on server" setting in your email client basically means "never send a DELE (delete) command to the server" so the server retains the previous email content and advances the index pointer after sending the unread email down to the client to process as new mail.

The DELE command can be sent from the POP3 client in such a way as to highlight a specific email and delete it from the server without downloading it to the client. This is what the functionality in your Thunderbird client does. *HOWEVER*, something in that email is jamming something about your email stream. Whether it remains untouched by this process, or whether it has to be processed, depends solely on sod's law

Hope this helps you understand POP3 a little better. I would personally look at spamfiltering prior to mail receipt by your mailserver if I were you though.
Mike-Bracknell is offline