Disable virus scan of attachments?

[AmandaK]

Hi,

how can I stop Thunderbird (3.0b3) from scanning all attachments when I save them? I have no anti virus program installed, but nevertheless everytime I save an attachment I get this annoying popup windows telling me that Thunderbird is scanning the file.

I have also disabled the option to allow third party anti virus programs to quarantine infected emails.

In Firefox I could disable the scanning by setting browser.download.manager.scanWhenDone to false, but there is no such value in Thunderbird.

Any help?

Thanks, AmandaK

-- using Thunderbird 3.0b3

[tanstaafl]

http://kb.mozillazine.org/Browser.downl ... anWhenDone

I don't see that with either TB3 beta 3 or the latest nightly build. I haven't read of anything that hints that Shredder will automatically launch whatever anti-virus program you have. The only settings that mention scan that I could find were for plugins, and that's a different type of scanning.

Moved from Thunderbird support to Thunderbird builds since its for a beta.

[rsx11m]

I think it's done in the background for TB/SM since UI elements are not implemented (download manager backend is core functionality).

[tanstaafl]

rsx11m:

It happens on your system?

Does it depend upon the anti-virus program? I'm running the free version of Avast with just the web shield and standard shield providers, not one for email. Anything I download via any browser (Firefox, IE, Opera, Chrome) gets transparently scanned (my only indication is if it thinks it found a virus) so in my case it seems to depend totally on the web shield provider.

You should mention it in http://kb.mozillazine.org/Thunderbird_3 ... nd_Changes

[rsx11m]

It happens on your system?

Now you got me, I can't really tell. I've crafted a test message with the EICAR fake virus as attachment, and I'm getting an anti-virus popup when opening it (referring to a *.part file in the Temp folder) or when trying to save it. The message and the paths are the same regardless of the scanWhenDone setting (I created that with a New > Boolean from the right-click context menu of the Config Editor). The problem is how to distinguish a quarantine action caused by an explicit request by the Thunderbird download manager from an action caused by the real-time scan?

[tanstaafl]

Avast has 7 different providers (a component dedicated to scanning a certain type of object) so I think you could tell the difference using it. AVG supposedly only has 2 providers, so you probably could not tell the difference with it unless it identifies who called it in its log file.

If your anti-virus program has a separate provider for email I suggest (for test purposes) you temporarily disable/stop it. If Thunderbird tells it to scan the message I'd assume it passes it the temporary filename and a different provider (one that knows how to scan a individual file) would scan it. In my case that would be the "standard shield" provider - what gets called if I right click on a file in windows explorer and chose the scan option. I don't have the "Internet Mail" provider installed, which is what automatically scans the message when its downloaded.

You could install SysInternals's Process Monitor and log file i/o, but that would be a lot of work.

What anti-virus program are you using?

[JoeS]

Be careful when playing with AV scans.
That's why Options |Security | Anti-virus >>"Allow antivirus clients to quarantine individual messages" was created.
AFAIK Thunderbird never request a scan, it's all on the AV agent.
But complete inbox files have been known to be quarantined.

[rsx11m]

Avast has 7 different providers (a component dedicated to scanning a certain type of object) so I think you could tell the difference using it. AVG supposedly only has 2 providers, so you probably could not tell the difference with it unless it identifies who called it in its log file.

There is just a single source, I'm using Norton/Symantec (and now I see you guys laughing at the other end...). It is my thinking that just the default anti-virus application would be called, e.g., same way as when you right-click a file and select it as an option from the context menu. The log files are identical for both scenarios. Frankly, I'm happy that it barks when a virus is detected, thus don't really want to change that.

One observation: Downloading from Firefox 3.0.x from their web site, the anti-virus box pops up first that the file has been quarantined, only then I see briefly the Firefox download manager. Thus, I assume the file is grabbed by the real-time scan as soon as it was written and is moved away before scanWhenDone even gets a chance to do its job.

[tanstaafl]

You've obviously never heard of the recommendation to "use anybody but norton/symantec"

http://mxr.mozilla.org/comm-central/sou ... canner.cpp appears to have a long comment providing an overview of the code to support AV scanning. Part of says:

Download scanner attempts to make use of one of two different virus scanning interfaces available on Windows - IOfficeAntiVirus (Windows 95/NT 4 and IE 5) and IAttachmentExecute (XPSP2 and up)............

Both interfaces are synchronous and can take a while, so it is not a good idea to call either from the main thread. Some antivirus scanners can take a long time to scan or the call might block while the scanner show its UI so if the user were to download many files that finished around the same time, they would have to wait a while if the scanning were done on exactly one other thread.

The code overview has a section called "Memory/resource leaks due to timeout" which talks about the need to keep certain threads still running. That makes me wonder if we might run into more problems with restarting Thunderbird (i.e. no longer just worrying about the lock in the profile).

My PC has the security center disabled. I don't think I ever configured the security center to tell it about Avast. I wonder if that effects Thunderbird's attempt to find all AV scanners.

One of the comments is "If skipWinSecurityPolicyChecks is set, do not use attachment execute, fall back on the older interface." WinSecurityPolicyChecks seems to use a browser.download.manager.skipWinSecurityPolicyChecks setting. I didn't find a setting to skip using IOfficeAntiVirus but there was a comment about "If we (somehow) already timed out, then don't bother scanning". Unfortunately it doesn't appear to use a setting to store that information.

[AmandaK]

So neither Thunderbird nor Firefox should scan any download when no Av scanner is installed, right? Then why does it happen to me? I have nothing installed that could scan my downloads. That's very strange. And annyoing.

[larry54]

This is an old thread but since from googling I can't find anywhere else with an answer to this thread's problem, I will put it here for others who might google in the future...as I also had this problem and just found the solution.

You simply put browser.download.manager.scanWhenDone into Thunderbird's about:config as a new boolean with value "false" just like Firefox, and it does the trick..