247126 - Norton antivirus detects virus in incoming mail and deletes whole mailbox

Status: RESOLVED DUPLICATE of bug 116443

(Thunderbird :: General, defect)

Description

[Phil Jordan]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040206 Firefox/0.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

Antivirus message pops up - I OK it. After this point I cannot access any emails
in the mailbox for the mail account in question. Restarting Thunderbird shows
the mailbox as empty.

THis may be related to problem 238499 reported with McAffee but I can't be sure
so reporting separately.

Reproducible: Always
Steps to Reproduce:
1.Virus laden email arrives
2.Norton spots it and (it or TB) pops up a message
3.OK message, mailbox window is "locked" so restart TB

Actual Results:  
TB restarts OK but mailbox now empty

Expected Results:  
M$ products in conjunction with NAV delete the individual emails as they arrive.

I hate to say it but that does seem to be the best response.

Comment 1

[Saajan Chana]

Also occurs on Windows XP.  It seems that NAV decides it can't disinfect the
mailbox file (although Cthulhu only knows why it didn't delete the message
before it even *got* to Thunderbird -- it sometimes does but more often not) so
quarantines the mailbox file.  What's even more annoying is when Thunderbird
continues to retrieve messages but can't find the mailbox file, so just discards
them silently; if nothing else, it would be nice if it would not delete the
message from the server under these conditions.

Comment 2

[Konstantin Spirov]

Other realtime immunity antivirus programs can cause total corruption in Inbox
too! The same happens with antivirus from free-av.com. 

When an attachment with a virus is received and saved, the most antivirus
programs prompt what to do, before the virus is saved on disk. If the user
specifies "move the file" or "delete the file" instead of "repair the file", the
Inbox is corrupted. It can be done even automatically by some programs!

The reason is that some antivirus programs recognize the whole inbox file as an
infected file and delete it. The problem can be solved easily if the file format
is upgradable - even simple bitwise XOR can solve it - but I am not familar with
the file format and I cannot suggest specific solution!

Possibly the problem is obvius for the developers in this project, but I
recognize it as a problem, because it was not obvious for me as a regular user.
Most of the users even will not understand what happened, they will only notice
that their mail dissappears.

http://forums.mozillazine.org/viewtopic.php?t=89097

Comment 3

[Fabian Rodriguez:MagicFab]

Confirming this bug. It also deletes/moves the Junk mail and Trash folders and
whatever folders have emails with viruses in them. These folders should be
easily modified/moved/deleted by other applications.

Platform: PC
OS: Windows 2000 Pro
Product: Thunderbird
Version: 0.7.2 (20040707)
Component should be changed to Mail Window Front End

This has also been reported on the MozillaZine forums:
http://forums.mozillazine.org/viewtopic.php?t=101013
http://forums.mozillazine.org/viewtopic.php?t=75470
http://forums.mozillazine.org/viewtopic.php?t=79453

Workaround:
http://kb.mozillazine.org/index.phtml?title=Thunderbird_:_FAQs_:_Anti-virus_Software

Comment 4

[Fabian Rodriguez:MagicFab]

This is a duplicate of bug #116443, marking as dependency
Can someone close it ?

Comment 5

[Aaron Kaluszka]

*** This bug has been marked as a duplicate of 116443 ***