573617 - Thunderbird does not interact nicely with antivirus program

Status: RESOLVED INCOMPLETE

(Thunderbird :: OS Integration, defect)

Description

[Marius Hudea]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.10) Gecko/20100512 Thunderbird/3.0.5

Using Thunderbird 3.0.5  (and 3.0.4 also), I've created several mail boxes and applies a single message filter rule to each box:

If subject contains [SPAM] move to Trash and mark as read.

AVG 8.5 is installed on the computer, it runs in background and by default it monitors what is being written to files.

When emails arrive, some of the emails with the subject [SPAM] contain viruses in attachments. 

Thunderbird detects the [SPAM] in subject and attempts to write the email to the Trash file for that account. 
However, as the write attempt is performed, AVG detects the virus in attachment and pops up with the message that a virus was about to be written to file Trash and asks if I should move the file "Trash" to Vault or Ignore it. 
 - If I attempt to move to Vault, AVG will say that the file is locked, in use (evidently by Thunderbird), so it can't be moved.
 - If I click Ignore, the antivirus popup goes away.
However, right away after AVG pops up its window, Thunderbird shows a modal message box saying that it failed to perform the write and says that the drive is full, which is incorrect. What's worse is that as that message box is shown, Thunderbird seems to stop downloading messages in the background so for example if overnight or while working on something in Full Screen mode, then it will show the popup indefinitely and stop reading mails.

If I remember correctly, if I click Ok on Thunderbird's before I click on Ignore in AVG, then an entry is added to Trash but it's empty, no title and no content. If  I click Ignore in AVG and then OK in Thunderbird, it goes on without retrying to write or anything, it goes to download the next email.
I couldn't reproduce it but it happened once - somehow one of those emails with virus attachment made it into the Trash file and using Ctrl + A and pressing Delete key, the delete process would stop with an error as AVG detected the virus attachment being read from Trash. I had to disable the antivirus and delete the emails from Trash and then enable the antivirus again.

If I go to Options in Thunderbird and select "Allow anti-virus clients to quarantine individual incoming messages", when an email with virus comes AVG says a file  in temporary folder "temp\ [ some random characters ] is infected , move to vault or ignore and right away Thunderbird says the message can not be read, maybe it's a virus,  do I want to skip it ? yes and no ?  - and again it's modal, it halts the execution and doesn't process new emails until I choose yes or no, to skip the message.



Reproducible: Always

Steps to Reproduce:
1. Install AVG (maybe only 8.5?)
2. Set the message filter rule to move emails to Trash
2. wait for some emails with viruses to arrive
3. Notice how message boxes pop up reporting write failures and stopping any further email processing

Actual Results:  
In both cases, Thunderbird assumes there was some write error (though in theory it's right, there's probably no way to know that antivirus software blocks its writes) and pops up message boxes and stops further email processing.

Expected Results:  
IMHO Thunderbird should continue to process the next emails while opening a window like the "Error console", showing what emails failed to write to disk - I don't really know how it would be better but either way there shouldn't be any "modal" windows (or whatever they're called) requiring user confirmation to continue.

Maybe add a timer to that message box and have it dissapear in 10-30 seconds or add option to ignore write errors.

Comment 1

[Matthias Versen [:Matti]]

TB can not know what caused the I/O Error and the user should be informed if such an error happened because it can lead to dataloss.
I would not let the stupid AV software scan the mailbox folders (you can usually exclude them from the scan). Every attachment will be put in the temp folder before you can execute it.

Comment 2

[[:Aureliano Buendía]]

Marius do you have already execute this steps?

1. From Windows Control Panel-->Programs Uninstall (or similar... I don't use Windows Server 2003), choose the Add/Remove (or repair) components option and follow the setup wizard until you reach the email area
2. Select Advanced, then add the "Personal Email Scanner service" and remove the others (only have one installed at a time) and finish the wizard.
3. Restart your computer then test.

And if you can please post a feedback here.

Comment 3

[Wayne Mery (:wsmwk)]

Marius has not replied