243162 - Norton Antivirus deletes my Inbox after detecting a virus

Status: RESOLVED DUPLICATE of bug 116443

(Thunderbird :: Mail Window Front End, defect)

Description

[Pau Montero Parés]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.6) Gecko/20040206 Firefox/0.8
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

If I change my server configuration in the account settings from xxx.xxx.xxx to
yyy.yyy.yyy and check the SSL option, Norton Antivirus blocks or deletes my
inbox when some virus is detected. 

Reproducible: Always
Steps to Reproduce:
1. A fully functional pop3 account with norton antivirus.
2. Change the server name to another one
3. Mark the "Use secure connection (SSL)"
4. Download mail and wait for a virus

Actual Results:  
When you try to read the infected mail, thunderbird returns an error and deletes
the inbox

Comment 1

[Pau Montero Parés]

this is the message returned by thunderbird. 

The file C|Documents and Settings/jdp/Datos de
programa/Thunderbird/Profiles/joan/4gwsvfxx.slt/Mail/mail2.imente.com/Inbox?number=13374923
cannot be found. Please check the location and try again 

It's not a thunderbird problem, it's a norton problem because it shoudn't delete
the entire Inbox.

Comment 2

[Fabrizio Zavagli]

(In reply to comment #1)
> It's not a thunderbird problem, it's a norton problem because it shoudn't delete
> the entire Inbox.

I've got the same problem and am not 100% sure it's a Norton issue: in fact for
me the Inbox is not deleted but replaced with 0's. And not all of it: just from
from the virus-infected message up (yes, not down: all the bessages BEFORE it
get replaced with 0's, the rest is safe).

Now I've tried to set Auto-Protect to "block access to file" instead of "delete
infected file", we'll see what happens..

Fab.-

Comment 3

[ZF.Dang]

I find the same problems.

Comment 4

[Kevin Airgid]

Yes, I have exactly the same problem Norton deletes my whole inbox when I get a 
email with a virus! Nice! anyone know a fix to this? I've lost like 10 emails 
so far from clients!

Comment 5

[Kevin Airgid]

Hey, I think I found a fix. Check this out from Symantecs site. I think the 
inbox isn't deleted but just quaranteended by Norton... (can someone else 
reproduce this?)

http://service1.symantec.com/SUPPORT/ent-
security.nsf/6fffc7260966992188256bf300818635/712247a53df336e088256a22002724ad?
OpenDocument&prod=Norton%20AntiVirus&ver=2003%20for%20Windows%
202000/Me/98/XP&src=sg&pcode=nav&svy=&csm=no

Comment 6

[dave cuddihy]

I think I'm getting the same thing. Here's my repro:
1. Have a valid POP account, Thunderbird version 0.6 (20040502), and Symantec 
Antivirus Corporate Edition (v8.1.0.825) client running on my Desktop PC 
(Windows 2000 Server);
1a. In Symantec Antivirus, in the configuration, have File System Realtime 
Protection enabled and File Types set to All Files;
2. Mail one or more messages to aforementioned POP account containing viruses 
known to Symantec Antivirus Client.
3. Attempt to retrieve email from POP account using Thunderbird.

The behavior is: The Symantec warning dialog appears when it detects the virus. 
Thunderbird then warns about access to the file. After dismissing these 
warnings mail delivery proceeds as normal. Mail headers all appear in the main 
mail GUI, however the actual message content is blank.

Expected Behavior: I don't know how to veto a virus-protection program's 
request to lock, modify, or move a file. Assuming that's impossible, perhaps a 
graceful yet quick-to-implement solution would be to cancel the mail-retrieval 
operation, roll-back the inbox file(s) to their pre-retrieval state, and pop up 
a dialog like "Your virus software is interfering with mail retrieval. Go turn 
it off. [Retry] [Cancel]"


My work-around: In Symantec Antivirus, I changed the Real Time File Protection 
File selection from "All Files" to a specific list of file-extensions and made 
sure that the files I found in the following folder would not be scanned:
C:\Documents and Settings\...\Application 
Data\Thunderbird\Profiles\default\...\Mail\...

Comment 7

[Kevin Teuscher]

*** This bug has been marked as a duplicate of 116443 ***

Comment 8

[Fabian Rodriguez:MagicFab]

Workaround:
http://kb.mozillazine.org/index.phtml?title=Thunderbird_:_FAQs_:_Anti-virus_Software

Comment 9

[Jason Smith]

is it resolved or not ? http://nortonphonesupport.com/

Comment 10

[Nelson frain]

I think I found the solution to your problem.

have a look over here @ http://www.nortonsupport.org