How to find and delete infected emails in Outlook PST data files - F-Secure Community
<main> <article class="userContent"> <h3 data-version="6" data-article="000002840">Issue:</h3> <p>How do I identify and remove the infected item(s) that F-Secure has detected on a .PST archive (Outlook data file)?</p> <h3>Resolution:</h3> <p>Follow the steps below to configure the F-Secure scanning report to show additional information when an email is detected inside an Outlook PST file.<br>These steps will help you to <u>identify </u>the email so that it can be removed <u>manually </u>after the scanning:<br></p><ol><li>Open the Registry Editor (regedit.exe)</li><li>Navigate to the following location: <ol><li><b>HKEY_LOCAL_MACHINE\SOFTWARE\F-Secure\Ultralight\GKH2\Plug-Ins\F-Secure Capricorn</b></li></ol></li><li>Add a new 'String Value' (REG_SZ) with the following information: <ol><li>Name: <b>CustomSettings</b></li><li>Data: <b>mailboxmode=2</b> <ol><li><span style="font-family: verdana, geneva, sans-serif;">It should look like in this image:</span></li><li><b><img alt="User-added image" src="https://us.v-cdn.net/6032052/uploads/030/YXI3W4XI4D3F.png" class="embedImage-img importedEmbed-img"></img></b></li></ol></li><li>Other scanning modes available are: <ul><li>0 = none (default, mailbox is not scanned)</li><li>1 = enable mailbox scanning</li><li>2 = enable scanning and provide <b>extended report</b> (inside infection name)</li></ul></li></ol></li><li>Restart the "F-Secure Ultralight Hoster" service <ol><li>net stop fsulhoster</li><li>net start fsulhoster</li><li>(If you are unsure on how to restart a service, just restart the computer)</li></ol></li><li>Manually <b>scan</b> the PST. The report will now show message-related fields (email subject, folder, attachment name)</li><li>Once the message has been identified, proceed to remove it manually in Outlook: <ol><li>Delete the message with [<b>shift-del</b>] (so that it will not be moved to trash).</li><li>Finally follow these steps to <b>compact</b> the PST database:<br><a href="https://support.office.com/en-us/article/reduce-the-size-of-your-mailbox-and-outlook-data-files-pst-and-ost-e4c6a4f1-d39c-47dc-a4fa-abe96dc8c7ef?ui=en-US&rs=en-US&ad=US" rel="nofollow">https://support.office.com/en-us/article/reduce-the-size-of-your-mailbox-and-outlook-data-files-pst-and-ost-e4c6a4f1-d39c-47dc-a4fa-abe96dc8c7ef?ui=en-US&rs=en-US&ad=US</a></li><li><b>Re-scan</b> the .PST archive to ensure all infected items have been removed.</li></ol></li></ol> <p>Article no: 000002840</p> </article> </main>