Product Troubleshooting Common topics

How to find and delete infected emails in Outlook PST data files

Issue:

How do I identify and remove the infected item(s) WithSecure has detected on a .PST archive (Outlook Data File)?

Resolution:

Follow the steps below to configure the scanning report to show additional information when an email is detected inside an Outlook PST file.
These steps will help you to identify the email so that it can be removed manually after the scanning:

Open the Registry Editor (regedit.exe)
Navigate to the following location:
1. HKEY_LOCAL_MACHINE\SOFTWARE\F-Secure\Ultralight\GKH2\Plug-Ins\F-Secure Capricorn
Add a new 'String Value' (REG_SZ) with the following information:
1. Name: CustomSettings
2. Data: mailboxmode=2
  1. It should look like in this image:
3. Other scanning modes available are:
  - 0 = none (default, mailbox is not scanned)
  - 1 = enable mailbox scanning
  - 2 = enable scanning and provide extended report (inside infection name)
Restart the "F-Secure Ultralight Hoster" service
1. net stop fsulhoster
2. net start fsulhoster
3. (If you are unsure on how to restart a service, just restart the computer)
Manually scan the PST. The report will now show message-related fields (email subject, folder, attachment name)
Once the message has been identified, proceed to remove it manually in Outlook:
1. Delete the message with [shift-del] (so that it will not be moved to trash).
2. Finally follow these steps to compact the PST database:
  https://support.office.com/en-us/article/reduce-the-size-of-your-mailbox-and-outlook-data-files-pst-and-ost-e4c6a4f1-d39c-47dc-a4fa-abe96dc8c7ef?ui=en-US&rs=en-US&ad=US
3. Re-scan the .PST archive to ensure all infected items have been removed.

Article no: 000002840