266912 - ClamAV/Clamwin extension.

Status: RESOLVED DUPLICATE of bug 80439

(Thunderbird :: Filters, enhancement)

Description

[Jesper Krogh]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040917 Firefox/0.9.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040917 Firefox/0.9.3

This should probably be implemented as an extension instead. But it would be
really nice if Thunderbird could take advantage of an ClamAV/Clamwin
installaion. On Linux the result could probably just be used to sort virus-mails
from the others. On Windows, it can help prevent infection. 



Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Comment 1

[Mike Cowperthwaite]

*** Bug 267894 has been marked as a duplicate of this bug. ***

Comment 2

[Gervase Markham [:gerv]]

This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/

Comment 3

[Raoul Nakhmanson-Kulish]

Any activity here? Mozilla Mail/Thunderbird still have no virus detection, tthis
is a really annoying in comparision to another mail clients.

Comment 4

[Andreas Blochberger]

And this is a platform independent feature, but i can't change that

Comment 5

[ÑêÍ]

What if the "message filter" feature be extended in such a way that an external
program can scan individual emails and give yes or no answers according to
whatever criterion it carries. Then we can do virus-scaning like this:

  if Message-Body  get-yes-when-scanned-by  "Virus-Scanning-Prog-A"
    move Message to "mail with virus" folder

Even better, it could be this (requires further extending, though):

  if Message-Body  get-yes-when-scanned-by  "Virus-Scanning-prog-A"
    process Message with "Virus-killing-prog-B"

I'm proposing this because message filtering can be run both on message
retrieval and later on user demand ("Run filters on folder"). Users are given a
chance to identify infected mails ALREADY IN THE MBOX FILE.

I really need this feature. I've used Thunderbird for more than a year without
doing any virus scanning on mails until recently. (Yes I use linux and I'm very
lucky.) I installed clamav only a few days ago to find 2 virus in my inbox.
Without this feature I can't imagine a way to pick out the 2 infected mails
from a 200M+ mbox.

Comment 6

[Ray Booysen]

Messages can be filtered on custom headers already.

Comment 7

[Raoul Nakhmanson-Kulish]

> Messages can be filtered on custom headers already.
Note that virus SMTP engine can easily spoof any custom mail headers.

Comment 8

[ÑêÍ]

(In reply to comment #6)
> Messages can be filtered on custom headers already.

I've searched many places for "custom headers" and it looks to be something (non-standard?) added to the mail header and can be made visible to the user.
If it is, then it doesn't solve my problem - a virus will not put something in the mail header saying "This is infected".

What I want is that TB iterate through all messages and let an external anti-virus  program scan them ONE BY ONE. And I think message filter is a reasonable place to add this extention.

If the anti-virus scans the mbox file (a single large file), it may delete or quarantine the whole mbox. this problem is addressed in bug 116443 (https://bugzilla.mozilla.org/show_bug.cgi?id=116443). There they only prevented an infected mail from getting in, but didn't sort infected mails out from mbox. 

Comment 9

[ÑêÍ]

Today I found the exact feature that I asked, in Evolution. It allows setting up a filter to pipe message contents to a external program and looks to the return value for decision. I set up a filter with command "clamdscan -" and it worked and found the infected mails :).

Thunderbird developers really need take a look at this nice feature and consider adding it to thunderbird.