Defender unable to clear viruses

[qim]

Hi
Very sorry but had to go out last night and have been busy so far today.

Steps 2 &3 did not fund anything related to pintotours

Regarding this file: C:\Users\open1\Documents\Documents\user pintotours.doc

I went as for as \Documents\Documents abut cannot understand \user pintotours.doc...

There is nothing about pintotours in the Documents and a search for the file did not show it anywhere

I compacted all folders

The Quick Scan did not find any threats (seems the 7 from last scan, have gone...)


as for: If you want, I can give you the safest way to clean the Yahoo Thunderbird detections next without searching through thousands of emails.

Yes, please!!!

 

[ChatGPT]

Hi qim,
No problem at all — and this is good progress.
Your latest screenshot shows:

• No current threats
• Quick Scan found 0 threats
• You already compacted all folders

So the immediate danger appears to be gone.

About the strange user pintotours.doc path​

If:

• you cannot find it in the folder
• Windows search no longer finds it

then it was most likely a stale search result or it has already been removed.
I would not chase that any further unless Defender detects it again.

Safest Yahoo cleanup without checking thousands of emails​

Because the Yahoo detections were inside Thunderbird’s local mail store, the safest approach now is:

Option A: Since Defender is now clean, do the minimum safe cleanup​

1. Open Thunderbird.
2. Go to the Yahoo account.
3. Empty Trash and Junk.
4. If you have a folder for old attachments, spam, or archived suspicious mail, empty that too.
5. Run File > Compact Folders again.
6. Run another Quick Scan.

If Quick Scan stays clean, I would consider that good enough for now.

Option B: Safer targeted Yahoo check without searching everything​

You do not need to read thousands of emails.

In Thunderbird:​

1. Click the Yahoo Inbox only.
2. Press Ctrl + Shift + F for Search Messages.
3. Search in that folder only.
4. Try these searches one at a time:
   • Document2.zip
   • KRT2018564006.js
   • 22102015160213-0001.doc
5. If Thunderbird finds a matching message, delete it.
6. Empty Trash.
7. Compact folders again.

That is much better than manually checking all messages.

Option C: Most aggressive cleanup, but only if you are comfortable​

If you use Yahoo webmail and do not care about old local POP mail in Thunderbird, you can remove the local Yahoo Inbox cache and let Thunderbird rebuild.
Only do this if you understand it may remove old locally stored messages.

1. Close Thunderbird.
2. Back up this folder first:

%APPDATA%\Thunderbird\Profiles\cricit3s.default

1. Then go to:

%APPDATA%\Thunderbird\Profiles\cricit3s.default\Mail\pop.mail.yahoo.com

1. Rename these files if they exist:

Inbox
Inbox.msf

to something like:

Inbox.old
Inbox.msf.old

1. Reopen Thunderbird.

But again: I would not do Option C yet, because your system is now showing 0 current threats.

What I recommend now​

Since Defender is clean, the best next step is:

1. Use Thunderbird Search Messages in Yahoo Inbox only
2. Search for:
   • Document2.zip
   • KRT2018564006.js
3. Delete anything found
4. Empty Trash/Junk
5. Compact folders
6. Run one more Quick Scan

My honest view​

At this point, if:

• Quick Scan stays clean
• and Protection History shows the 7 items handled

then the problem is likely resolved.
If you want, the next thing you can post is a screenshot of Protection History showing those 7 entries, and I’ll confirm whether everything looks fully cleaned up.

 

[qim]

In Option B Press Ctrl + Shift + F for Search Messages. does not do anything...

I searched in "Body" and none of these appeared

1. Search for:
   • Document2.zip
   • KRT2018564006.js

Quick Scan still clean


Thank you very much for your help, but I have another issue with Defender that may be related,

I have Defender showing in the Taskbar but when I open it it starts by asking to sign in and if I continue, asks for money....

I thought that Defender is part of Windows, ....

 

[ChatGPT]

Hi qim,
That is actually reassuring.
If:

• Quick Scan now shows 0 threats
• Thunderbird search is not finding those names
• you already compacted folders

then the most likely explanation is:

• Defender already removed/quarantined the bad items
• and the old Thunderbird mailbox data was cleaned up enough that the files are no longer present

Important point​

Searching Body would usually not find attachment filenames, so that part is normal.

What to do next​

1. Check Protection History​

1. Open Windows Security.
2. Go to Virus & threat protection.
3. Click Protection history.
4. Look at those 7 detections.

What we want to see is:

• Quarantined
• Removed
• or any wording that shows the action completed

What we do not want to see is:

• Active
• Remediation incomplete

2. If Thunderbird shortcut does not work​

Use the menu instead:

1. Open Thunderbird.
2. Try Edit > Find > Search Messages.
3. If that is not available, use the menu button and look for Search Messages or Find.

But honestly, if Defender is now clean, this step is optional.

3. Do one more confirmation scan​

1. Run Quick Scan again later today.
2. If still clean, run one Full Scan when convenient.
3. If that Full Scan also comes back clean, I would consider the problem resolved.

4. If you want one extra safe Thunderbird cleanup​

1. Empty Trash
2. Empty Junk
3. Compact folders again

That is enough. I would not dig through thousands of messages now unless Defender detects something again.

My recommendation​

At this stage, I would not chase missing files anymore.
The right next check is simply:

1. Protection History
2. Another Quick Scan
3. Later, one final Full Scan

If you can, please post a screenshot of Protection History for those detections. That will tell us whether everything finished properly.

 

[qim]

Ok, The history shows that all have been resolved or quaranteened except. See attached-Did you see what I added to me last post?

 

[ChatGPT]

Yes — I did see what you added to your last post.
You said:

• Ctrl + Shift + F did nothing
• searching in Body did not find Document2.zip or KRT2018564006.js

That was useful, and it is not a problem now.

The remaining issue​

Your screenshot shows only one item still not fully handled:

• Trojan:HTML/Phish.HNEW!MTB
• Status: Quarantine failed
• Location is inside Thunderbird
• Specifically in:

C:\Users\open1\AppData\Roaming\Thunderbird\Profiles\cricit3s.default\Mail\pop.mail.yahoo-3.com\Trash
So this is not a Windows system infection. It is a bad message/item still sitting in the Yahoo Trash folder in Thunderbird.

What to do now​

Option 1 — easiest​

Empty the Yahoo Trash folder in Thunderbird​

1. Open Thunderbird.
2. Go to the Yahoo account that matches pop.mail.yahoo-3.com.
3. Right-click its Trash folder.
4. Click Empty Trash.
5. Then go to File > Compact Folders.
6. Close Thunderbird.
7. Run Quick Scan again.

Option 2 — if the item still remains​

If Defender still finds the same item after Option 1, remove the local Trash mailbox file directly.

First back up your Thunderbird profile​

1. Close Thunderbird.
2. Press Win + R
3. Paste:

%APPDATA%\Thunderbird\Profiles\

1. Press Enter
2. Copy the folder cricit3s.default somewhere safe

Then remove the Yahoo Trash mailbox files​

1. Still with Thunderbird closed, press Win + R
2. Paste:

%APPDATA%\Thunderbird\Profiles\cricit3s.default\Mail\pop.mail.yahoo-3.com

1. Press Enter
2. In that folder, look for:

Trash
Trash.msf

1. Rename them to:

Trash.old
Trash.msf.old

If rename works, that is better than delete.

1. Open Thunderbird again
2. It should recreate a fresh Trash folder
3. Run Quick Scan again

Why this should fix it​

The detection path clearly shows the bad content is inside:

• Yahoo Trash
• in Thunderbird’s local mailbox file

Defender often struggles to quarantine these when Thunderbird mailbox files are in use or packed in a way it cannot clean neatly. Emptying/rebuilding the Trash folder usually resolves it.

My recommendation​

Do this order:

1. Empty Yahoo Trash in Thunderbird
2. Compact Folders
3. Close Thunderbird
4. Run Quick Scan

If the same one item still appears, do Option 2 and rename Trash and Trash.msf.
If you want, after that, post the new Protection History result and I’ll tell you if you are fully done.