{"id":4275,"date":"2026-06-08T17:57:43","date_gmt":"2026-06-08T14:57:43","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&p=4275"},"modified":"2026-06-08T17:57:43","modified_gmt":"2026-06-08T14:57:43","slug":"how-to-find-and-delete-infected-emails-in-outlook-pst-data-files","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/jp-ja\/support-articles\/how-to-find-and-delete-infected-emails-in-outlook-pst-data-files\/","title":{"rendered":"How to find and delete infected emails in Outlook PST data files"},"content":{"rendered":"

Issue:<\/h3>\n

How do I identify and remove the infected item(s) WithSecure has detected on a .PST archive (Outlook Data File)?<\/p>\n

Resolution:<\/h3>\n

Follow the steps below to configure the scanning report to show additional information when an email is detected inside an\u00a0Outlook PST file.
These steps will help you to identify <\/u>the email so that it can be removed manually <\/u>after the scanning:<\/span><\/span><\/p>\n

    \n
  1. Open the Registry Editor (regedit.exe)<\/span><\/span><\/li>\n
  2. Navigate to the following location:<\/span><\/span>\n
      \n
    1. HKEY_LOCAL_MACHINE\\SOFTWARE\\F-Secure\\Ultralight\\GKH2\\Plug-Ins\\F-Secure Capricorn<\/span><\/span><\/b><\/li>\n<\/ol>\n<\/li>\n
    2. Add a new 'String Value' (REG_SZ) with the following information:<\/span><\/span>\n
        \n
      1. Name:\u00a0CustomSettings<\/b><\/span><\/span><\/li>\n
      2. Data:\u00a0mailboxmode=2<\/b><\/span><\/span><\/li>\n
      3. Other scanning modes available are:\n
          \n
        1. 0 = none (default, mailbox is not scanned)<\/li>\n
        2. 1 = enable mailbox scanning<\/li>\n
        3. 2 = enable scanning and provide extended report (inside infection name)<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n
        4. Restart the "F-Secure Ultralight Hoster" service:\n
            \n
          1. net stop fsulhoster<\/li>\n
          2. net start fsulhoster<\/li>\n
          3. (If you are unsure on how to restart a service, just restart the computer)<\/li>\n<\/ol>\n<\/li>\n
          4. Manually scan the PST. The report will now show message-related fields (email subject, folder, attachment name)<\/li>\n
          5. Once the message has been identified, proceed to remove it manually in Outlook:\n
              \n
            1. Delete the message with [shift-del] (so that it will not be moved to trash).<\/li>\n
            2. Finally follow these steps to compact the PST database:
              https:\/\/support.office.com\/en-us\/article\/reduce-the-size-of-your-mailbox-and-outlook-data-files-pst-and-ost-e4c6a4f1-d39c-47dc-a4fa-abe96dc8c7ef?ui=en-US&rs=en-US&ad=US<\/a><\/li>\n
            3. Re-scan the .PST archive to ensure all infected items have been removed.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

              How to identify what emails are infected when F-Secure products have a detection in a PST archive.<\/p>\n","protected":false},"template":"","support_article_product":[104],"class_list":["post-4275","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000005790","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 14:57:43","import_hash":"4d6695db7fb3098e84247ec0c1aa520befdc95b5","vanilla_article_id":29660,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/29660-how-to-find-and-delete-infected-emails-in-outlook-pst-data-files","vanilla_kb_id":30,"vanilla_category_id":106,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/support_article\/4275","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/media?parent=4275"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/support_article_product?post=4275"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}