ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
File Excluded
bear204428


Joined: 23 Oct 2006
Posts: 2
Location: Worcester
Reply with quote
I understand that when running a scan, if a virus is detected it is then moved to quarantine (assuming quarantine option is set), what I dont understand is why later in the scan, it then says that the original file is then excluded. If I run the scan again, exactly the same happens, i.e. it appears to be quarantined each time but when I run another scan, it is not quarantined. I can not send the log as this is being run on another computer which can not conenct to the interent due to virus issues!!

If this makes sense Smile HELP
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
when clamwin encounters an infected file in quarantine folder then obviously it can't move the file into itself - hence the "excluded" message
View user's profileSend private message
bear204428


Joined: 23 Oct 2006
Posts: 2
Location: Worcester
Reply with quote
alch wrote:
when clamwin encounters an infected file in quarantine folder then obviously it can't move the file into itself - hence the "excluded" message


But the new virus it says it is finding is not in the Clamwin Quarantine folder, it is in, in this case, Temporary Internet Files - which as a matter of interest are empty anyway! (I do have all files shown under options).

Each time I run the programme, I get the same results, it is as if it moving the files to quarantine and yet leaving a copy in the original source.
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
can you paste the scan report?
View user's profileSend private message
budtse


Joined: 14 Jan 2006
Posts: 372
Location: Belgium
Reply with quote
Hi guys,

There does seem to be a problem with clamscan moving files to quarantine.

I just had a discussion with micty on irc who had a similar problem. Strange thing is that each time he ran a scan, some files where moved, but most where excluded (he had over 150 infected files on that box).

He tried scanning with clamscan from the command line, which gave the same result. Also specifying an other quarantine folder did not help (i suspected it could be a filename conflict).

There was another discussion about this issue on this forum at http://forums.clamwin.com/viewtopic.php?p=1535 http://forums.clamwin.com/viewtopic.php?p=1535. Seems like there's no call to "unlink" ??? I remember i posted to the clamav developer list at the time, but got no response and forgot all about it.

Could one of you who know more about it than i do have a look at this please ?

thanks,
budtse
View user's profileSend private message
budtse


Joined: 14 Jan 2006
Posts: 372
Location: Belgium
Reply with quote
Allright, here's something that will be usefull :

Seems like when 2 files with the same name are infected, only the first one is moved (according to micty).
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 898
Location: Italy
Reply with quote
yes correct, on win32 rename() fails if the destination file exists while on unix not, I'll fix it asap
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 898
Location: Italy
Reply with quote
the problem was different anyway is fixed in svn, dunno if this is enough to make a new release, let's alch decide
try using this one: http://oss.netfarm.it/clamav/files/clamscan.7z http://oss.netfarm.it/clamav/files/clamscan.7z
uncompress in the clamwin/bin directory but make a backup of the old clamscan.exe or you'll not be able to use the incremental updater
View user's profileSend private message
budtse


Joined: 14 Jan 2006
Posts: 372
Location: Belgium
Reply with quote
Great,
thanks for the quick response.
View user's profileSend private message
File Excluded
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic