Closed Bug 264172 Opened 20 years ago Closed 20 years ago

Inbox erased when virus scanner tried to quarantine mail

Categories

(Thunderbird :: General, defect)

x86
Windows 2000
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED DUPLICATE of bug 116443

People

(Reporter: fu, Assigned: mscott)

Details

(Keywords: dataloss)

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; rv:1.7.3) Gecko/20041001 Firefox/0.10.1
Build Identifier: Thunderbird 0.8 (20040913)

A new message with a Virus arrives in my Inbox (Global Inbox is not activated,
Adaptive Junk Mail activated), Symantec AntiVirus CE catches the virus and a
Window pops up, telling me that the found virus cannot be put into quarantine,
because of permission problems (Thunderbird locks the Inbox at this time, I
guess). I dismiss the Symantec-Popup and I can see the culprit message in the
Inbox, but the mouse-cursor is still an hourglass. I can switch to another
mailfolder, that changes the cursor. Switching back to Inbox gives me the
hourclass. So I close Thunderbird and see if there are any processes left (no),
then restart it: the inbox is empty, the rest of the mail intact.

This happened two times this week.  Luckily I have a copy of the Inbox on
another computer.

Might be, that the virus-mail is also considered as junk mail by the adaptive
filter and moving the message out of the inbox somehow messes up when AntiVirus
tries to put the message into quarantine?

I have Symantec AntiVirus Corporate Edition v8.00.9374 on Win2000 and
Thunderbird 0.8 running.

Reproducible: Sometimes
Steps to Reproduce:
I'm not really looking forward to reproducing this a third time :(

0. Subscribe to newsgroups with your work-email
1. Receive Virus
2. Let the clever Symantec Guys do some surgery on the living Inbox
3. Let Thunderbird do some surgery as well
4. Pray
5. Regret having subscribed to newsgroups ten years ago..
Actual Results:  
wined about my mail...

Expected Results:  
umm..

- no Thunderbird extensions installed
Here's some additional information:

The two incidents were not quiet identical, and I can reconstruct the second
incident, while the first one "just happened".

FIRST INCIDENT:
What I still know: some mail arrives that looks junky.. some minutes later the
computer gets slower and slower, Thunderbird does not respond and consumes a lot
of CPU. I kill Thunderbird and restart it and find my Inbox erased.

SECOND INCIDENT (see also original bug report):
1. Virus arrives
2. Norton wants to clean the virus from the file, but can't (access denied)
3. So Norton quarantines the file
4. Restarting Thunderbirds yields an empty Inbox
5. The Inbox can be reconstructed from within Norton, but when starting
Thunderbird, Norton intervenes immediately with a popup window:

  Scan type:  Realtime Protection Scan
  Event:  Virus Found!
  Virus name: W32.Netsky.P@mm!enc
  File:  C:\..\Thunderbird\Profiles\..\someserver.com\Inbox
  Location:  Quarantine
  Action taken:  Clean failed : Quarantine succeeded : Access denied
  Date found: Wed Oct 13 13:49:18 2004


Thanks for looking after that bugger!
stefan.
Keywords: dataloss
this is a dup. It's hard for us to prevent Norton from doing this, and keep
using the mailbox format we use, which is all messages in a folder in the same file.
Whiteboard: DUPEME

*** This bug has been marked as a duplicate of 116443 ***
Status: UNCONFIRMED → RESOLVED
Closed: 20 years ago
Resolution: --- → DUPLICATE
Whiteboard: DUPEME
You need to log in before you can comment on or make changes to this bug.