Bitdefender corrupting Thunderbird ??

I have the same issue and hate to have to remove Bitdefender. I have tried turning off Antivirus along with adding Thunderbird to the exceptions list to no avail.
I have auto-update on, currently .256

I have spent hours on this. I also hope they find a fix for it.

Hello,

The development teams are actively looking into this, as we've received several reports on the forum.

Thank you for your patience.

As a temporary workaround, you can disable the Encrypted Web Scan feature located in the Online Threat Prevention module. Users who tried this confirmed it helped.

IamaMeatPopsicle

Sadly, this workaround is not working for me. I even toggled the Local Email Protection setting to "Do Not Scan E-mails". A system restart in between also did not help.

I cannot read my e-mails and have important communications due!

GrugDeb

Thanks for that. I have been affected with this problem since yesterday.

The workaround you decribe now allows me to correctly receive my emails.

I don't know if the information is relevant to your development teams, but it seemd that only emails getting in my main Inbox were affected, those filtered to go to different folders, or received through another provider, s

Thank you, much appreciated. Hang on, they will get to the bottom of this.

This did also work for me. Now I just have to remember what I turned off earlier so I can be fully protected once you figure out the issue. I did notice that many users were reliant on their ISP such as sympatico.ca, British Telecom and a large French provider even though the issue must be connected primarily to Thunderbird.

You can always log in to your account directly via their web platform. ie. webmail from your provider.

I found this tip in the Tbird forum. Not mine but it may help your team.

I have found that if I save the message to a file using TB 140.1.x and copy that file to a place where Thunderbird 115.x can load it, the message will be displayed correctly without corruption. So, I am guessing that something is happening that corrupts the message when the message is downloaded from the POP server. From observing the text of the corrupted versions of the message to the text of the UNCORRUPTED version, it looks like part of the header is being deleted when TB 115.x is downloading the file from the server. I can't even begin to imagine what could be causing this to happen.

Trevorwm2

I am also experiencing the HTML/code problem with Thunderbird emails. I tried the suggested fix i.e disable Encrypted Web Scan feature located in the Online Threat Prevention module, it did not fix the problem in my case.

hawknerd

How will I know when a fix rather than a workaround is ready and available? Additionally what does the workaround do to the protection integrity of my PC?

Sign up for updates to this thread if it's not automatic. I've been getting notifications all day and super happy to see them in readable format. Ha.

I'd avoid sketchy Russian bride sites till then.

I've had this problem for a couple of days, started getting blank subject/from etc, then scrambled HTML bits, just assumed they were spam or junk, finally discovered there were messages in there, so will have to go back over everything ! ARGH ! Does anyone know if you can make Thunderbird re-download messages ?

Been looking at the corrupt messages, most of them seem to have this:

X-BitdefenderWKS-Spam: No - 0

     Pzqg=

.
X-Forwarded-Encrypted: i=1;

This gives some empty lines in the header, which are end of header markers, and throw off decoding. I am slowly managing to recover some of the emails in Thunderbird, might work in oither clients

make a 'recover' email folder
copy a single bad email in there
navigate to a different folder
in Exporer, open the recover file in a text editor, find the offending crap, and just delete those headers
go back to the email folder, should now be a good message, so move elsewhere
rinse and repeat, but you need to do a 'compact' on the recover folder to get it cleaned

Even easier, drag and drop the duff msg to the desktop, open with a text editor, remove the offending header lines, then save and drag/drop copy back into the same TB folder, then remove the original corrupt msg.

Or you could forward them from your webmail account to yourself and they will show up now in Tbird if you have the Bitdefender fix in place, albeit with a FW: in each.

Trevorwm2

I tried to carry out the fix suggested by NB512 but in the message I edited I could only find

X-BitdefenderWKS-Spam: No - 0

which I deleted, but a search failed to find the other two lines.

Also what is the 'Bitdefender fix' that I should be putting in place.

If you have Bitdefender you can try to disable the Encrypted Web Scan feature located in the Online Threat Prevention module. Maybe you didn't restart Thunderbird?

I've put in too much time already to worry about editing email files. I just sent them over from webmail as a fwd. Most of the emails I would have deleted anyway.

Trevorwm2

Just tried the NB512 fix again and having removed the 'X-BitdefenderWKS-Spam: No - 0' line and dragging the message back into TB the Subject sender and date now appear but the body of the message contains lots of hyperlinks which wouldn't normally be there.

B.Boru

The real source of the problem is the empty line that follows "X-BitdefenderWKS-Spam: No - 0": an empty line marks the end of the message header and the beginning of the message content.

Just suppress this empty line and you are good.

In thunderbird, I edit the "Inbox" file to do this, and I remove the associated "Inbox.msf" file to force Thunderbird to re-index the messages. Of course, you must fix this extraneous blank line in all the botched messages.

Sorry, should have been clearer, but it was late at night.. yes, the actual issue is the blank line, as B.Boru says, this ends the header section of the email prematurely. You could probably just remove the blank line, I was assuming there was some other corruption there, so removed both the surrounding lines.

"X-BitdefenderWKS-Spam: No - 0" is just what to search for, then you can just remove the blank line underneath, but I also remove that line, and the following 2 to remove the tag + corrupt contents

X-BitdefenderWKS-Spam: No - 0

[blank line]

iC9Q=

[then next line is valid]
X-Forwarded-Encrypted: i=1;

Although I have no critical need or desire to run your process, I fully appreciate your skills and willingness to help others.

Had this thread not been started, and added to with informative advice, I would have imagined that it was my issue alone, perhaps caused by the sun's rays on my new build or the fact I didn't blow dust off my cpu this week.

Sheendigs

Hi Guys,

I have tested THUNDERBIRD today with my Bitdefender always veryfing incoming messages.

It seems to be working. I was able to read my emails correctly.

Take care!

Hello,

There are multiple threads on this topic right now, so I'll do my best to share this information across all of them, so please, if you know people affected by this issue or if you came across this topic on other forums, it would help the community to spread the word.
The developers reverted the changes made in the last signature update and this should do the trick until a permanent fix is deployed. Just click on update in systray and reboot once completed. But keep in mind this change is being rolled out gradually, so it may not reach everyone at the same time..

Thank you for your patience!

hawknerd

what does "reverted the changes" mean?

dont worry I worked it out. The update will put BD back to before the issue arose.

I just tried to update BD but it says I am up to date. I will try later.

The update was available to me, so I ran it, rebooted and my new messages are now coming in normally.

I have three questions:

Is it OK to turn back on Encrypted Web Scan under Protection|Online Threat Prevention?

2. Is it OK to turn back on Local Email Protection under Online Threat Protection to scan emails?

3. Is there a way to fix the messages that came in before the update or is that to be addressed to Thunderbird?

Hi, can't answer 1st 2, but

3 - TB are unlikely to be able to help, BD people SHOULD, but wont offer a fix, so easiest is to do it yourself, but depends on how many messages there are !

Drag/Drop messages to the desktop, or a folder where you can see them. Open each .eml file in a text editor, search for the "X-BitdefenderWKS-Spam: No - 0" line, below that is a blank line, easiest is just type a '1' or anything on the blank line, save and drop back into TB. Check with the first one that it's now readable before doing the others.

As said in my eariler messages a blank line marks the end of the email headers, and that one should not be there !

Is there anything wrong with just deleting the blank line that follows "X-BitdefenderWKS-Spam: No - 0" line, as I read in one of the comments?

I did that with one message that I had copied to my Desktop, edited with EditPad Lite and copied back to my Thunderbird Inbox., and it looks normal to me. In Thunderbird, the subject in the Subject column and the name in the Correspondents column both came back, and the message body looks normal.

I have about 100 messages that were messed up (sorry for the technical lingo ;D) that I had downloaded into Thunderbird before I ran the fix. Some I can scan within Thunderbird and just delete since they're the usual rubbish emails I get every day. That still leaves quite a few, however.

That is a quick way to do it, but it also changes the date and time on the messages. I wanted to keep the actual dates and times, so I did it the still-easy but time-consuming way of highlighting each message, dragging it to the Desktop (making a copy of the message as an .EML file), opening that Desktop .EML copy in a text editor, deleting the blank line in the message, saving the edited message, dragging it back to the Thunderbird Inbox, viewing that corrected message to verify that it was OK and finally deleting the original messed-up message. It took only about 10 to15 seconds or so per message (glad I have two monitors).

Looking back, I should have put Thunderbird into offline mode the moment I realized that the messages were coming in corrupted. I waited to do it and therefore wound up with about 100 messages that had to be fixed.

A big shoutout to NB512 for posting the editing solution to fix the corrupted messages!

Thanks, Alexandru, for letting us know about the Bitdefender temporary fix.

Also, kudos to the developers for getting on top of it so quickly. 👍️

I'm not too concerned about fixing the few emails I have, but I am trying to learn about how to pull an email into Notepad or whatever to resolve this issue. I just tried Atom.

I thought I'd try to follow everyone's directions, but I don't seem to have any reference point mentioning Bitdefender to know where the offending blank line is.

ie. none of the "X-BitdefenderWKS-Spam: No - 0"

This is looking at clearly broken emails.

On a side note, I now wonder about how easy it appears to be for people to manipulate the text in an email and use it as "proof".

Thank you for your patience and I'm really sorry for this inconvenience.. 🙏

I did my best to get the word out quickly, as soon as we discovered that the reports were pilling up on the forum.

Best regards!

https://community.bitdefender.com/en/discussion/104828/bitdefender-corrupting-thunderbird

Ok, it was good to hear from someone 'official' that is IS an issue caused by BitDefender, but how about them actually FIXING the problem ???

And while we are at it how about adding the much requested "Block Internet" option that most other's have, e.g. ZoneAlarm had right-click options on the taskbar for this, as well as 'suspect Firewall/AV for 5 mins" etc.

JimLongIsland

I am running Thunderbird 140.1.1 esr 64 bit on Windows 11 using IMAP and have no problems. I notice someone mentioned POP vs IMAP could that be the difference?

dmeszler

If you do not use Bitdefender as your email scanner (as is the case for me), you will not see any Bitdefender html tags. However, for affected messages (and for me it was only a small subset of my mail) you will still see a blank line between the transmission header and the actual message header. For one of my messages, it came after the line with the tag "Message-ID:" in the 64th line of the "complete" message transmission. For another, it came after a "Received:" tag in line 25. You can generally just scroll to find it and you'll know you've found it because a few lines after the blank, you'll see the message header info (To/Subject/etc). If you delete that blank line and reload the message, it will display properly. So even though Bitdefender is not my main email scanner, it obviously still checks all external links for integrity (a good thing!).

Regarding how to edit, you can use copy/paste as long as you "crtl-u" the message first (to get both the message and the transmission header) or use Thunderbird's command menu as follows. "File-Save As" to save the message to a file (generally a .eml file) and then open that file with Notepad or whatever editor you wish. Find the blank line and delete it. Save the edited file (change the name if you want to be cautious). Thunderbird "File-Open" to open the edited file. You should now see the header info displayed, but in my experience you may not see the links active yet. You then need to copy the opened/edited message into your inbox ("Message-Move To" or "Message-Copy to") and it should put itself where it belongs (time and date-wise) and function correctly. You can then just close the window in which Thunderbird opened the saved/edited message.

Sorry for the length of the reply, but did not want to cause more questions than answers.

Petersl

Hi @Sheendigs @Alexandru_BD

I had the same issue a few days ago but only one time, this is what the mail showed:

" d RNcQ2F03J25uMTG01NcRhQ; Wed, 13 Aug 2025 12:36:25 +020
.
X-Spamcause: dmFkZTFuGpC0l2F6xYua7/jIzLbHT3SYpVBNgRhkLWrk0Sby4MsWjwxEg1MoI0HoP0ynCntqBnZLJB36MI6OJDw6bDO+aIubYK0CYXP4vEFyQvI4dEG2QmZ2/CkW/CeIQk8Sw+YGbPkmeqlekNGbcxrulrf2IVRTEOLfXNJ57O99/Sbet1ivQBlCikCgNGLStA3jdBC+jJvZuXgJghknIpMehjKL1dN1cqYremhniw3nwrkh4HCjWjqowXp2sOu7Jkp4wBFpMh8hpmccjcHlSd9NEEQ4WKYXo53NIKI5i1JTAFQyVriwp0HgDfFM9wh8F5S+VKF/s8V86Ar/ixGJmYu3SQgam+JnoCeHr+6aSQh5hyzQCi0rmVpgh73ImvAk6AH3OVvkSQLPPj6HlimDbPKbA4Q5przp5Tb2XlCv+J7BjJbaqmn+zBhckjNy72VUz1HaEPIHfIY76zYhIiCVSConMM6b8Xrg6zp9ozzhcpAYYsLNpUQMXg6c/huGRtmSxMx0MV8jOurndvTXavkiZtgRqRZG4AmBTdx/IhWUGdflUVfZ1NOoacqm6zSS3hS5BL6z0Gt39jAnddSsLEWm84W5iF7lBO3yK1HYrpoTd//zC8o27TzyIqIGEthVSfFeq3rNImcaNn1GLGxiXRwYCtCSbLkXXMZY9GQ38ZhYd2x5B5PxcA
Delivered-To: REDACTED
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=KbuW9YZWylJgVz1E9wW/Y4QiV8tjlkjOpfALVQZuYilAjvkE6pHX1KGzB3viUOvR3gV9YnRAnFVyxtGKUOmK521OctTpPjNgMvfH4OHbFuzHbeD7eG+Jn2Ldzr4aqg2oNZCT0UHGxNwGd1iDyh/TEcg2eirV8OzgkPF3Splu9xI0ldqSKmZ7s6mDFaHOiby3XzoZD3UGSdMq/pTOD7HHwDU8Xd0jwttz7BPGdd+BvTcSCxrAPVeTeQbN51CrNdH+QWaGTHSR5nUMewclmjdUohAPDS97uFl4sCumBF3tVFUBiLSAtIG6yo8JnuP0IKQOnSFmR6z/mSGm5MCFxCfK9w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=B+2MKU78L8p6U/4zEhg0J7zx+Gn9IBM0Qy6Pb7yPpvw=;
b=Jg2vWshSIfqLmoCXFH5o/kNcqFWbiAKY7aa8FtmooTKBNQq60ysnWveuuIClMl3AV54wAnIj2B7pvPysZByG12TJzG/1cZW6IDQB8HDImgkHoEBG4xTQ33Y+8HXfhBujVFQH66guaPfmYcIiiX6Z1jeChZ1Yo5DSgQDTFTljIZu2vt/U3MeFqdhZUdkjZXIwcM4y8fBG7/wVoZqK9Q17vw1HKzDeCWJ44uMY5g7J6N+ghgiBbmkolHhPf7b/3AX191DifDATuVS5rRt0xFztIDhJigTs/2TyY/ITnUGiBQ4dFS2oULoWUFwuCCXkoYg37qG947lE8ZhLPYspA2VQQQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
smtp.mailfrom=curalys.be; dmarc=pass action=none header.from=curalys.be;
dkim=pass header.d=curalys.be; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; "

Haven't had this happen again since.