1832802 - Thunderbird lags and becomes unresponsive when Microsoft Defender Real-time Protection is active

Status: RESOLVED INCOMPLETE

(Thunderbird :: Untriaged, defect)

Description

[Lukas.Wringer]

Steps to reproduce:

We are in the middle of switching to MS Defender - as this progresses we get more and more reports of severe Thunderbird problems.

When Thunderbird downloads and indexes messages (ege. when browsing through folders) the defender engine spikes in load and thunderbird becomes unusably slow and a lot of times completely unresponsive, especially with mailboxes bigger then 1GiB and/or multiple accounts.

When we temporarily disable real time protection thunderbird immediately recovers and finishes its tasks. But when we re enable the protection the problem comes back shortly afterwards.

This Problem appears in the old version 68.12.1 the current 102.x and even in Daily 115.x

Reading through some rather old similar bugs they always get "solved" by creating an exception for the users profile - which is just irresponsible. Mail is one of the biggest sources for viruses and it should be checked especially thoroughly.

Expected results:

As MS Defender is the default on any Windows 10 + 11 installations Thunderbird should work well with it.

The only mitigation we found so far is converting the accounts to 'maildir' storage which still creates a lot of load for defender - but Thunderbird keeps working fine. The only problem is, that 'maildir' is still not considered stable and could result in data loss right?

Comment 1

[Wayne Mery (:wsmwk)]

(In reply to Lukas.Wringer from comment #0)

As MS Defender is the default on any Windows 10 + 11 installations Thunderbird should work well with it.

In the past, AV vendors often provided automatic exceptions in their product for software with which it does not play well. I don't know that Defender ever did, but it doesn't matter - for now you have three choices, 1. live with it as is, 2. add the exception, 3. add the exception AND enable Thunderbird setting for Quarantine [1], under security. If defender is any good, then adding a directory exception doesn't ruin your protection - malware should still be detected when something opens an attachment that contains malware.

There is also some potential that Thunderbird is affected by ASME as described in bug 1441918 comment 95. Check what version of mpengine.dll is running.

The only mitigation we found so far is converting the accounts to 'maildir' storage which still creates a lot of load for defender - but Thunderbird keeps working fine. The only problem is, that 'maildir' is still not considered stable and could result in data loss right?

maildir is use at your own risk.

[1] Thunderbird first stores each incoming message in a temporary file in the system temp folder on your computer, allowing your antivirus software to only quarantine a single message. If the file is removed by the antivirus, then you get an error message about the file being missing. If the new message file still exists after being scanned by antivirus software, then it is moved to your Thunderbird inbox folder file.

Comment 2

[Wayne Mery (:wsmwk)]

Attachment: Screenshot 2023-05-13 at 10.00.20 AM.png

Comment 3

[Wayne Mery (:wsmwk)]

Does this also reproduce when using version 115 started in Help > Troubleshoot Mode?
If it does, and you have not already done so, please list complete steps to reproduce.

Comment 4

[Phoenix]

Resolved per whiteboard