ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
Bug-Report! Thunderbird crashes ClamWin
CYBERYOGI =CO=Windler


Joined: 14 May 2015
Posts: 6
Location: Germany
Reply with quote
I am using ClamWin with German Win98SE/KernelEx on a historical PC (DFI K6BV3+ Motherboard, AMD K6-3+ @550MHz, 768MB RAM, 160GB HDD) which is actually optimized for DOS Games (2 real ISA sound cards, 3Dfx Voodoo 1 graphics card etc.). As firewall I am running ZoneAlarm AntiVirus 6.1.744.001 (with its outdated antivirus part disabled). The start sequence is controlled through StartRight (finishes ZoneAlarm initialization before starting the antivirus).

Previously I had Avast 4.8 AntiVirus, which turned unbearably slow (booting 20 minutes, Avast updates >30 min), so I uninstalled it and switched to ClamWin 0.98.6 with Clam Sentinel 1.22.

- Thunderbird crashes ClamWin

Much worse is, when I run the ClamWin virus scan (which takes many hours per 16GB partition) and it finds my Mozilla Thunderbird e-mail folder (contains some 10000 e-mails of over a decade), it first complains about plenty of ancient phishing mails (they are scam, not malware! There is no harmful code in it, thus an antivirus should not care about them unless manually requested to do so.) Even worse, once it finds the biggest(?) of my e-mail-folders, it completely locks up and freezes my PC. I can only move the mouse pointer, but neither icons nor systray nor screen redraw responds. With ctrl-alt-del I see the taskmanager and can kill ClamWin. If I do so, the PC works again but I not even get a ClamWin log file, so I can only photograph the error by digicam. When I don't and exit taskmanager and then press ctrl-alt-del again, I instead get a popup requester that ClamWin has used up all resources. (I can kill it also from here.)

Thunderbird 2.0.0.24 (20100228) stores all e-mails inside a single file (one per folder) in subfolders of "\Windows\Anwendungsdaten\Thunderbird\Profiles" (in English version likely "\Windows\Application Data\Thunderbird\Profiles")

Also Avast 4.8 had displayed an anormaly scanning this folder:

E:\WINDOWS\Anwendungsdaten\Thunderbird\Profiles\c9spw8g1.default\Mail\Local Folders\=CO=Windler (kein Spam)\p layingit.FONTDIV#4025862408

"Prüfung nicht möglich. Die Datei ist eine Dekomprimierungsbombe."
(i.e "Testing impossible. The file is an decompression bomb.")

The strange thing is that a subfolder named "p layingit.FONTDIV#4025862408" does not exist, and even copying the contents of the folder into a new one and deleting the old (to get rid of potentially invisible folders) did not change Avast's behaviour. (ClamWin choked by a different mail folder.)

I suspect that a bug in Thunderbird always corrupts the last accessed(?) e-mail folder file and fixes this during next start, because Thunderbird itself has no problem to access them. With "Dekomprimierungsbombe" (decompression bomb, uncompression bomb) Avast certainly does not refer those deadly vacuum bombs of Putin, but a kind of faulty recursive pointer somewhere in the internal directory tree inside a compressed file, that causes an infinite loop during decompression and so eats up all memory. The FAT32 file system on that partition is not corrupt (at least scandisk doesn't complain).

Please urgently fix this! The freeze makes ClamWin almost useless to me since I can not scan my main partition. Avast at least handled the situation without a lockup. And please make ClamWin update the log file on disk every few seconds or after each read file (changeable in preferences if it would be too slow) and not only after a finished (it never will...) virus scan.

- exclude directories fails

I tried everything to exclude the corrupted e-mail folder files or their path, but ClamWin simply ignores it and scans it anyway (causing a crash). This may have to do with the lack of regular expression support in Win98SE. Please use a different (and easier to use) solution to exclude directories.

ClamWin also alerts plenty of false-positive code found in documents those are not executable. E.g. renamed WAV sound files .wa~ made trouble. There are likely many others I couldn't identify due to the crash.

- ClamWin shutdown fails

When I want to shutdown Win98SE I often get a popup requester that ClamWin has to quit first (I click ok), which however never happens, so I have to kill it ungently with Process Explorer or the taskmanager to shutdown Windoze. I suspect that Sentinel somehow prevents ClamWin from shutdown because it runs a 2nd copy in memory. Why is it so important to shutdown ClamWin cleanly? Can't it just write the log files to disk and stall like other programs?


other flaws:

- Please add a pause/resume button to the virus scan window.

The virus scan can take many hours and strongly slows down (or completely freezes, see above) my PC. Thus make it possible to pause and resume, because I e.g. may fail to bid on eBay auctions when the PC is occupied with a scan. Although I only start it manually, the need of aborting the entire scan (which takes hours to repeat) can not be a proper solution.

- Please make scan targets saveable.

Setting up proper combinations of selected and excluded directories (to avoid crash or false positive data-only files) can be time consuming and complicated. Please make the manual selection saveable as scan jobs and allow to exclude certain drives (e.g. CD burner to prevent buffer-underruns) permanently.

- Please change the animation.

The animation to the left of the virus scan window keeps running while the scan hasn't yet begun (it takes minutes to load the virus database into RAM). Please start the animation only during scan and stop it while paused or loading from disk or whatever, because it feels like scam when it pretends to scan but actually doesn't. Please also animate the tray icon (or make it change colour) during background scan (run by Sentinel) to inform the user that it is on and currently working (and so see whether e.g. a browser slowdown is caused by it).

- icon colour

During first start (after update?), the button background in Win98SE sometimes appears pink instead of default, which looks ugly.


Code:
                        MAY THE SOFTWARE BE WITH YOU!

*============================================================================*
I                  CYBERYOGI Christian Oliver(=CO=) Windler                  I
I         (teachmaster of LOGOLOGIE - the first cyberage-religion!)          I
I                                      !                                     I
*=============================ABANDON=THE=BRUTALITY==========================*
                      {http://weltenschule.de/e_index.html}
View user's profileSend private message
ROCKNROLLKID


Joined: 23 Sep 2013
Posts: 561
Location: **UNKNOWN**
Reply with quote
I am not to sure if the developers are going to want to dedicate time on fixing issues happening on older operating systems, since they have been long time abandon by now. Also, Avast 4.8 is about 7-8 years old now and has been adandon also, no longer getting virus signatures anymore.

That being said, ClamWin does not officially support Thunderbird, so that's probably the issue you are having with Thunderbird and ClamWin.

Your other requests will be up to the developers. Thank you for using ClamWin and taking the time to write use some suggestions.
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4210
Location: USA
Reply with quote
Knowledgeable users are encouraged to develop add-ins and other extensions to ClamWin--especially those using ClamWin in a business or network environment. ClamWin developer time and resources are very limited, and this is a nice way to give back for using a free, open source antivirus program. Contact the ClamWin developers if interested.

Regards,
View user's profileSend private message
CYBERYOGI =CO=Windler


Joined: 14 May 2015
Posts: 6
Location: Germany
Reply with quote
ROCKNROLLKID wrote:
I am not to sure if the developers are going to want to dedicate time on fixing issues happening on older operating systems, since they have been long time abandon by now. Also, Avast 4.8 is about 7-8 years old now and has been adandon also, no longer getting virus signatures anymore.

That being said, ClamWin does not officially support Thunderbird, so that's probably the issue you are having with Thunderbird and ClamWin.

Your other requests will be up to the developers. Thank you for using ClamWin and taking the time to write use some suggestions.


I do not request you to develop a dedicated Thunderbird plugin, but only a method to prevent the crash (i.e. fix the decompression bug by escaping infinite loops, which also may happen in other files and constitutes a potential trick for viruses to prevent ClamWin from scanning) and make the directory exclusion work properly.

ClamWin is the only antivirus suitable for Win98SE (others are flooded with bloat code or prevent execution on it) and because most competitors are considered more effective, Windows 98 users do constitute a major fraction of its fanbase. While Avast 4.8 was officially abandoned, it definitely did still receive antivirus database updates. It only became way too slow (adding them all by linear search?) to be bearable under Win98SE.
View user's profileSend private message
ROCKNROLLKID


Joined: 23 Sep 2013
Posts: 561
Location: **UNKNOWN**
Reply with quote
The infinite loop issue should be reported to ClamAV. You can report that issue here: http://www.clamav.net/contact.html Remember that ClamWin runs off the ClamAV engine so whatever happens with ClamAV happens with ClamWin.

You should also test the ClamWin version .98.7 which is still in beta phase and see if some of your issues may be fixed already.
View user's profileSend private message
Bug-Report! Thunderbird crashes ClamWin
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic