Why is my email being immediately deleted?

Malware often arrives via email

As we all know, one of the primary ways that malware makes it on to many machines is by virtue of being included in an email or perhaps a malicious link in an email.

By virtue of opening the attachment or clicking on that malicious link, users unknowingly "invite" malware onto their machines.

Unlike other approaches to malware distribution, there's no bug or system vulnerability involved, so there's nothing to be "fixed." As long as people open attachments containing malware and click on links to malicious sites, email remains a lucrative approach to deploying the latest viruses and spyware.

Anti-malware tools to the rescue

Many anti-malware tools attempt to help keep people safe by scanning email as it arrives. Using various techniques, the tools insert themselves into the email delivery stream and scan each message for malware before the email program completes receiving it.

What happens then depends on both the anti-malware program and the email program that's receiving the email (sometimes, but not often, including web-based email).

Attachments may be removed, emails may be flagged in some way, or the messages deemed to be dangerous may simply be deleted.

And that's where the fun starts.

Anti-malware tools gone wild

Every so often, an anti-malware tool that performs this real-time scanning of email as it's downloaded will go a little crazy and decide that absolutely everything is dangerous.

As a result, it'll delete absolutely everything to protect you.

You're protected, all right; from everything - dangerous or not.

I don't have specific tools to name or specific email programs. Over time, it seems to affect one combination of anti-malware tool and email program and get fixed, but then, we find some other combination that experiences the problem a while later.

And often it appears to be highly selective, affecting on certain users.

The solution: turn off real-time email scanning

The only solution that I'm aware of is to turn off the feature in your anti-malware tool that attempts to scan email in real time as it's downloaded.

Exactly how that's done will vary depending on what tools you happen to use.

There are then three approaches:

• Leave that feature disabled, relying on other parts of your anti-malware toolset, or your own habits and common sense, to protect you.

• Leave that feature disabled "for a while," hoping that some update or fix to the anti-malware tools or email program will eventually resolve the issue.

• Change tools. This is often where people will decide that perhaps a different anti-malware tool might serve them better.

(This is an update to an article originally published April 15, 2005.)