585916 - Digital Guardian from Verdasys prevents Thunderbird from sending e-mails via enterprise IMAP+SMTP server

Status: RESOLVED WORKSFORME

(Thunderbird :: General, defect)

Description

[Dan Sabau]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.19) Gecko/2010031422 Firefox/3.0.19 GTB7.1
Build Identifier: Thunderbird 3.1.1

on all the workstations with Mozilla Thunderbird versions 3.0.5, 3.0.6, 3.1.0, 3.1.1 I get the following error:
"The message could not be sent using SMTP server vmail.astrasig.ro for an unknown reason. Please verify that your SMTP server settings are correct and try again, or contact your network administrator." 

this is the SMTP log with kaspersky av for ws on:
0[1924140]: SMTP Connecting to: vmail.astrasig.ro
0[1924140]: SMTP entering state: 0
0[1924140]: SMTP Response: 220 vmail.astrasig.ro ESMTP Postfix
0[1924140]: SMTP entering state: 14
0[1924140]: SMTP Send: EHLO [127.0.0.1] 

this is the SMTP log with kaspersky av for ws off:
0[1924140]: SMTP Connecting to: vmail.astrasig.ro
0[1924140]: SMTP entering state: 0
0[1924140]: SMTP Response: 220 vmail.astrasig.ro ESMTP Postfix
0[1924140]: SMTP entering state: 14
0[1924140]: SMTP Send: EHLO [10.104.36.51]

this behaviour is caused by the application Digital Guardian from verdasys.com ( http://www.verdasys.com/solution_packs.php ) (initially falsely detected as a rootkit).

on removal of this application, we have regained thundrebird functionality.

unfortunately this is not a solution. please work on the compatibility between these applications.

Reproducible: Always

Steps to Reproduce:
1. start thunderbird
2. create mail
3. the error described above
Actual Results:  
1. install Digital Guardian from verdasys.com ( http://www.verdasys.com/solution_packs.php )
2. try to send mail with Thunderbird

Expected Results:  
Thunderbird reported:
"The message could not be sent using SMTP server vmail.astrasig.ro for an unknown reason. Please verify that your SMTP server settings are correct and try again, or contact your network administrator." 

no

Comment 1

[Michael A. Pasek]

Packet capture shows session establishment, then:
<-- 220 server.name ESMTP
FIN -->

It is unknown whether it is TB that's sending the FIN, or Digital Guardian.  The "FIN" happens immediately, not after any timeout period, and the reporter says the error message appears quickly, too.  What I could not understand was why there weren't additional LOG entries; I couldn't find a path that wouldn't at least log state SMTP_FREE.

There may not be a bug in TB other than the error should not be "unknown", and additional log entries should be created.

Comment 2

[Ludovic Hirlimann [:Usul]]

Contacted.

Comment 3

[Dan Sabau]

If the "C:\Program Files\DGAgent\" folder is not visible, you have to take DGAgent out of stealth, edit or create "Thunderbird.exe.ini" and add the follwing lines:

#HKGRP_MOZILLA
nspr4.dll!PR_Write=0

After a reboot, everything worked out fine.