Norton AntiVirus 9.0.x - may delete Apple Mail 'inbox'

  The following note appeared on the MacInTouch website this morning:

> A bug in Symantec's Norton AntiVirus program, which affected
>several MacInTouch readers, can delete email [in Mail for Mac OS X,
>aka "Apple Mail"] all too easily. Symantec is working on a fix and
>we have some recommendations in the meantime ...

   Turning off Norton AntiVirus' "Scan Compressed Files" option is the
recommended workaround. (One reader reports having been told in a
phone call to Symantec tech support to turn off the AutoProtect
option completely ...)

   Details from one reader report and a Symantec representative appear below.

   We'll post an update when a fix - or an interim support document,
in advance of a fix - becomes available for this issue.

Aron Roberts
Workstation Software Support Group

--
Some excerpts from MacInTouch's notes this morning:
[Greg Rombach] I've just experienced and reproduced a serious issue 
with Norton Anti-Virus 9.0, an issue which Symantec's Tech Support 
just confirmed.
   If Norton Anti-Virus 9.0 [...] detects the MyDoom virus in Apple 
Mail, it may delete the mbox from inside the INBOX.mbox package, thus 
emptying the InBox.
   The first indication of a problem will be a NAV dialog box 
announcing that the file "mbox" is infected with the MyDoom virus and 
that the file has been deleted. The only option is "OK". After Apple 
Mail is restarted, the InBox is empty. [...]
...
[Mike Romo, Symantec] I just wanted to let you know that we have been 
able to reproduce the problem and are working on a fix. In the 
meantime, we suggest that everyone using Norton AntiVirus should go 
to the System Preferences: Auto Protect pref pane, and turn off "Scan 
Compressed Files".
   Users should not worry about being exposed to viruses. Remember 
that if you save an attachment to your drive (or try to run it from 
the email program) , Norton AntiVirus will then be able to detect any 
virus because at that point it is no longer in the compressed inbox 
of your mail program. So you're not really opening up any security 
holes by turning that AutoProtect Compression Scanning off.
   As I say, we are working on this Mail.app bug and will hopefully 
get a product update out ASAP. I will let you know as soon as this is 
fixed.
   I just wanted to add that the issue is definitely not related to 
the Feb 04 defs -- we want users to get those defs since they have a 
Python file fix that dramatically reduces scan times. Again, this is 
a serious issue and we strongly suggest people turn off "scan 
compressed files" in the AutoProtect system preference.
------------------------------------------------------------------------
The following was automatically added to this message by the list server:
For information about MAGNet, its meetings and events, and its
mailing list, including information on subscribing and unsubscribing,
see the MAGNet Web site at <http://magnet.berkeley.edu/>.