McAfee highlitghs a trojan - "newmsg" I cannot find the root file

[CanadaNorth]

McAfee keeps informing that it has isolated a trojan in trojan:Win/suspiciousattachmentScript.a  I cannot find the item on my laptop?  How can I delve further into it this to delete it.  Read some post where folks call McAfee and were told to contact Bell.  It happens multiple times but I cannot figure out what app/program is triggering it. 

[dks · Accepted solution]

False positives are not uncommon with antivirus software, particularly McAfee. This alert means that something in a file attachment has triggered McAfee. It does not mean there is a trojan. You would have to try to find every file attachment and try to locate the questionable file, if it actually exists. If you are in a Windows environment, you might consider uninstalling McAfee and using Windows Defender combined with a reputable malware detector. Windows Defender works well and plays nicely with Windows 10 and 11. Malwarebytes is a paid malware detector suite which is one option. It also plays well with Windows.  

[WelshTerrier · Accepted solution]

Good Day.

Are you using McAfee software & is McAfee installed on your laptop? If McAfee continues to show this alert, it means it is doing its job by blocking the threat, but the source generating the file may still be active.

The generic threat name trojan indicates that a background script (often from a web browser cache or email attachment) is repeatedly trying to download or execute a malicious file. This could be a false positive, a trojan or simply nothing at all.

If McAfee is installed on your laptop, you can find your scan results and detected threats by opening the installed McAfee application on your device and checking the Quarantine or Protection History / Reports section. You can once again run a scan to see if McAfee recognizes any further threats on your laptop.

If you are seeing pop-up warnings telling you a trojan was found directly when you are using your web browser (Chrome, Edge, or Firefox), this is usually a fake scam alert rather than a real warning from McAfee.

Real alerts come from the actual McAfee app installed on your system, not from a web page. To remove this pop up, go to the notifications section in your browser privacy settings and remove or block any unrecognized or unfamiliar site.

Once you have completed this step, go to your browser settings and clear your browser data.

1. You can do this by pressing Ctrl + Shift + Delete on your keyboard to open the "Clear Browsing Data" menu.
2. Select > All time.
3. Select > Cached images & files, cookies and other site data.
4. Follow the onscreen instructions & Select > Clear data.
5. Close your browser & then restart your laptop.

Let us know if this makes a difference in solving your problem.

Take care.

[CanadaNorth]

The "trojan" is coming from Thunderbird email program.

[WelshTerrier]

Good Day.

Thank you for your reply.

Are you using McAfee software & is McAfee installed on your laptop?

If you are using McAfee, I can only speculate the reason McAfee is alerting you about a trojan in (trojan:Win/suspiciousattachmentScript.a), there is a conflict between how McAfee cleans files and how Mozilla Thunderbird stores your emails.

By default, Thunderbird stores an entire email folder (like your Inbox) as a single, large continuous file on your hard drive. When a spam or phishing email arrives with a malicious script attachment, McAfee spots it. However, because the threat is embedded inside that single huge folder file, McAfee cannot safely delete the individual virus without breaking your whole mailbox. Instead, it locks, blocks, or "quarantines" a temporary data stream, but the underlying email text still sits in your folder, causing McAfee to re-detect it over and over again.

Please have a look at the following step by step instructions that I have compiled from the McAfee and Thunderbird support websites.

1. Open Thunderbird. Go to your Junk or Trash folders & look for any recent suspicious emails (especially ones with attachments), right-click them, and select Delete.
2. Click the Alt key on your keyboard to reveal the top menu bar. Click File > Compact Folders. This permanently wipes the deleted text blocks out of the mailbox file so McAfee stops seeing them.
3. In Thunderbird, open Settings (the gear icon at the bottom left). 
4. Go to Privacy & Security on the left menu & scroll down to the Antivirus section.
5. Check the box for "Allow antivirus clients to quarantine individual incoming messages"

As a final step, you can add the Thunderbird Profile to McAfee Exclusions. This will stop the constant real-time pop-up loop and prevent McAfee from accidentally corrupting your emails.

• Keep in mind if you exclude a file, it will not be scanned.
• If changes are made to an excluded file, it will be removed from the exclusion list and will no longer be excluded from scanning. This is a security measure, as the file is treated as new once modified. To stop it from being scanned, you will need to exclude it again.

Please refer to the following support websites for complete instructions:

• Exclude files from virus scans on Windows and macOS | McAfee Support
• Security panel - Junk, scam, antivirus, and password settings in Thunderbird | Thunderbird Help
• Thunderbird: Testing: Antivirus Related Performance Issues

Let us know if this has been of assistance in resolving your poblem.

Take care.