I see three questions from you. All three most likely having the same source. Antivirus product interference. You are free to choose your products, but some anti virus products have long and very chequered histories when involved with mail clients. So of the stories are documented here. https://wiki.mozilla.org/Thunderbird:Testing:Antivirus_Related_Performance_Issues Additionally some products have anti scam and spam tools which are good for one binary version of Thunderbird (so about 4 weeks) before they can start doing odd things like filing everyone not in the address book in spam or such like.

As for you feeling uneasy. Why? When information comes in over the wire. You anti virus scans it in the guise of an encrypted connection. When the email is at rest in Thunderbird's storage it is a plain text file. It represents no more risk then a takeout menu on your refrigerator. When you open the email Thunderbird does not allow remote images, fails to run scripts and generally prevents the body of the email being anything but some text to read, even with the images (which reduces privacy) little changers. So you decide to open an attachment. So Thunderbird turns it into something other than plain text and writes it to your system temp folder so it can be opened, and your anti virus scans the resultant file.

So I reiterate my original question. Why?

Thanks, Matt. Learning that AV software does its thing to incoming email BEFORE it ever ends up in my profiles folder takes care of my uneasiness. Did not know that level of detail about how AV deals with email. (My AV, by the way, is AVG, and it does notify me of a problem from time to time, so all good there. I could only wish it were smart enough to weed out the endless flow of "We have $20m for you from the National Bank of Burundi" scams!) If that is the case, though, it seems to me that makes my profile corruption problem less likely to be AV-caused. I've set my profile folder as an exception in AVG as recommended here by Christ1, so we'll see what happens in the next few days or weeks. If it doesn't happen again any time soon, I'll report back here and declare this one resolved.