270839 - Norton Antivirus file quarantine eats mail folders when using mail filters

Status: RESOLVED DUPLICATE of bug 116443

(Thunderbird :: General, defect)

Description

[junk]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20040914 Firefox/0.10
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20040914 Firefox/0.10

We use Norton Antivirus for virus detection on our Windows systems.  Typically,
whenever Norton detects a virus it will quarantine (remove) the infected file. 
Most virus programs work this way.

In this particular instance the user had a virus in one of their email messages.
 When a filter was created to move this message from one mail folder to another,
Norton detected the virus and subsequently the whole folder the message was
being moved to was quarantined.

Reproducible: Always
Steps to Reproduce:
1.  Receive message with email virus (or test case virus...eicar)
2.  Install antivirus program.
3.  Move infected message from one folder to another via a mail filter (or
perhaps even dragging...I didn't try it).

Actual Results:  
The entire mail folder gets quarantined, user loses all messages that were in
that particular folder.

Expected Results:  
Only the infected message should be quarantined.

The resolution of this is kind of tricky.  When filtering it may make sense to
write each message out before adding it to the other folder.  I imagine the
performance hit on this might be significant, but I can see this being a real
problem for deployment of Thunderbird on the Windows platform. 

Currently, I have told Norton to not scan the user's Mail profile.  This is
obviously not an ideal solution if you want a final line of defense for email
viruses on the user's desktop.

Comment 1

[WADA:World Anti-bad-Duping Agency]

DUP of Bug 116443.
Search bugzilla for Product=Thunderbird and mail&news before open bug, please,
because almost all components execpt UI is shared between Thunderbird and
Mozilla Mail&News.

Comment 2

[Mike Cowperthwaite]

Agreed, dupe.

*** This bug has been marked as a duplicate of 116443 ***