ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
Clamwin 0.88.1: Clamtray uses 100% CPU after scheduled scan
egciuffo


Joined: 19 Apr 2006
Posts: 7
Reply with quote
hallo!
since clamwin 0.88.1 clamtray.exe uses 100% of CPU after it doing a scheduled scan.
the same thing on a PC and on a laptop. the only possibility to continue to use the PCs is to quit clamtray.exe.
does anybody know why?
OS: windows 2000

thanks!
View user's profileSend private message
montana


Joined: 17 Apr 2006
Posts: 5
Location: HOLLYWOOD, CALIFORNIA
Reply with quote
Did you use clam win b4 this new update or did you just start using it?

Monty
View user's profileSend private message
egciuffo


Joined: 19 Apr 2006
Posts: 7
Reply with quote
i've used clamwin since 0.83 i think, without any problems, until version 0.88.1. i did an update and a new install, always the same problem.
Sad
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
scheduler did not change in 0.88.1
try to remove ClamWin_Scheduler_Info file from your %TEMP% folder (usually c:\documents and settings\<username>\Local Settings\Temp)
View user's profileSend private message
egciuffo


Joined: 19 Apr 2006
Posts: 7
Reply with quote
i canceled everything in temp, but still the same.
thisway the program is unusable.
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
remove the scheduled scans and see if the problem goes away. then re-add the scheduled scan
View user's profileSend private message
hcremer


Joined: 26 Apr 2006
Posts: 5
Reply with quote
Hello,

I'm running Clamwin on a server system (WIN2003SBS) and I installed the new version by update last friday and I ran into similar problems. I'm doing 2 scheduled scans on 2 different drives every night at 3 and 4 am and it worked fine until last friday. I now need to cancel 2 clamscan.exe tasks with the taskmanager evey morning as it is slowing down the system because of nearly 100% cpu usage so all people using the server are complaining.
As the system is used by people all day, I can only do a reinstall/shutdown on fridays when everybody is out of here.

Did remove the scheduled scans and re-adding the scheduled scan solve the problem?

Thanks in advance for replying.

Best regards,
hcremer
View user's profileSend private message
egciuffo


Joined: 19 Apr 2006
Posts: 7
Reply with quote
so, i removed all scheduled scans and readded them, but that did not resolve anything.

i noticed, that during a (scheduled) scan Clamtray.exe takes more and more CPU usage (up to 100% after about two hours of scan) and clamscan.exe goes down to 0-10% CPU usage and never finishes the scan (at least not within one workin day).
but, as soon as i quit the clamscan.exe with the task manager, Clamtray.exe turns back to 0-2% of CPU usage.
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
really odd... How long does it take to svan the same data if you scan form clamwin GUI?
View user's profileSend private message
hcremer


Joined: 26 Apr 2006
Posts: 5
Reply with quote
first of all thank you for the fast reply!
I have exactly the same strange behaviour as described by egciuffo.
Apart from this, some files can't be scanned anymore because of Windows file access rights (maybe before the cygwin-based scanner was not able to scan them too, but didn't put it into the logfiles).

I still have a file called cygwin1.dll in C:\Programme\ClamWin\bin. Is this still needed or just left from a past installation (I'm using Clamwin since version 0.86.2 on this system) and always upgraded when the update-log mentioned it.

I also had some false positives since last fridays upgrade.

Yesterday, I started a manual scan on a remote desktop, but needed to cancel it after 2 hours or so as people complained about low performance.
View user's profileSend private message
egciuffo


Joined: 19 Apr 2006
Posts: 7
Reply with quote
[quote="alch"]really odd... How long does it take to svan the same data if you scan form clamwin GUI?[/quote]

it is about the same: it never ends the scan (at least not within one day) and CPU usage is on top again.
View user's profileSend private message
magarj


Joined: 27 Apr 2006
Posts: 2
Reply with quote
Hello,
I am running 0.88.1 on W2K Server and it is doing the same thing (100% CPU after a scan). Is this spcific to Server OS?

Thanks,

JAM
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
Question to all that reported 100% cpu:

when you say it is doing the same, which process is consuming all cpu: clamtray.exe or clamscan.exe?
also if you open the ClamWinScanLog.txt what does it say?
View user's profileSend private message
hcremer


Joined: 26 Apr 2006
Posts: 5
Reply with quote
If I remember well, clamtray.exe is consuming 97-100% cpu when a scheduled clamscan.exe is active.
I just ran a manual scan and had clamtray. exe with very low percentage 2 clamwin.exe's with very low percentage and clamscan.exe with percentages varying between 60 % and 99 %
ClamWinScanLog.txt could not be found on my HD's.

I replaced confidential content with ... and XXX

ClamScanLog.txt had the following entries since last thursday the 3:00am is the C:\ and the 4:00am is the E:\ :

--------------------------------------
Scan started: Fri Apr 21 03:00:01 2006

--------------------------------------
Scan started: Fri Apr 21 04:00:01 2006

ERROR: Can't open file E:\EXCHANGE\MDBDATA\priv1.edb
ERROR: Can't open file E:\EXCHANGE\MDBDATA\priv1.stm
ERROR: Can't open file E:\EXCHANGE\MDBDATA\pub1.edb
ERROR: Can't open file E:\EXCHANGE\MDBDATA\pub1.stm

-- summary --
Known viruses: 51930
Engine version: 0.88
Scanned directories: 3545
Scanned files: 58966
Infected files: 0
Data scanned: 20736.97 MB
Time: 12735.239 sec (212 m 15 s)
--------------------------------------
Scan started: Sat Apr 22 03:00:03 2006

--------------------------------------
Scan started: Sat Apr 22 04:00:01 2006

ERROR: Can't open file E:/EXCHANGE/MDBDATA/priv1.edb
ERROR: Can't open file E:/EXCHANGE/MDBDATA/priv1.stm
ERROR: Can't open file E:/EXCHANGE/MDBDATA/pub1.edb
ERROR: Can't open file E:/EXCHANGE/MDBDATA/pub1.stm
ERROR: Can't open file E:/HOME/...

lots of these

...
ERROR: Can't open file E:/HOME/...
E:/HOME/XXX/Eigene Dateien/Software/FileZilla_2_2_16_setup.exe: Trojan.Clicker.VB-20 FOUND
E:/HOME/XXX/Eigene Dateien/Software/FileZilla_2_2_16_setup.exe: moved to 'C:/Dokumente und Einstellungen/All Users/.clamwin/quarantine/FileZilla_2_2_16_setup.exe'
ERROR: Can't open file E:/HOME/...

some more
...
ERROR: Can't open file E:/HOME/XXX/XXX.doc

-- summary --
Known viruses: 52180
Engine version: 0.88.1
Scanned directories: 3545
Scanned files: 59074
Infected files: 1
Data scanned: 22285.59 MB
Time: 30125.187 sec (502 m 5 s)
--------------------------------------
Scan started: Sun Apr 23 04:00:04 2006

ERROR: Can't open file E:/EXCHANGE/MDBDATA/priv1.edb
ERROR: Can't open file E:/EXCHANGE/MDBDATA/priv1.stm
ERROR: Can't open file E:/EXCHANGE/MDBDATA/pub1.edb
ERROR: Can't open file E:/EXCHANGE/MDBDATA/pub1.stm
ERROR: Can't open file E:/HOME/...

lots of these

ERROR: Can't open file E:/HOME/XXX/XXX.doc

-- summary --
Known viruses: 52402
Engine version: 0.88.1
Scanned directories: 3545
Scanned files: 59132
Infected files: 0
Data scanned: 22292.68 MB
Time: 44350.156 sec (739 m 10 s)
--------------------------------------
Scan started: Sun Apr 23 03:00:01 2006

ERROR: Can't open file C:/Exchsrvr/MDBDATA/tmp.edb
ERROR: Can't open file C:/pagefile.sys
ERROR: Can't open file C:/Programme/Microsoft SQL Server/MSSQL$SHAREPOINT/Data/master.mdf
ERROR: Can't open file C:/Programme/Microsoft SQL Server/MSSQL$SHAREPOINT/Data/mastlog.ldf
ERROR: Can't open file C:/Programme/Microsoft SQL Server/MSSQL$SHAREPOINT/Data/model.mdf
ERROR: Can't open file C:/Programme/Microsoft SQL Server/MSSQL$SHAREPOINT/Data/modellog.ldf
ERROR: Can't open file C:/Programme/Microsoft SQL Server/MSSQL$SHAREPOINT/Data/tempdb.mdf
ERROR: Can't open file C:/Programme/Microsoft SQL Server/MSSQL$SHAREPOINT/Data/templog.ldf
ERROR: Can't open file C:/System Volume Information/{3808876b-c176-4e48-b7ae-04046e6cc752}
ERROR: Can't open file C:/System Volume Information/{4d4b24a4-cb54-11da-b127-000d61064a01}{3808876b-c176-4e48-b7ae-04046e6cc752}
ERROR: Can't open file C:/System Volume Information/{4d4b24ae-cb54-11da-b127-000d61064a01}{3808876b-c176-4e48-b7ae-04046e6cc752}
ERROR: Can't open file C:/System Volume Information/{4d4b24c6-cb54-11da-b127-000d61064a01}{3808876b-c176-4e48-b7ae-04046e6cc752}
ERROR: Can't open file C:/System Volume Information/{4d4b24c7-cb54-11da-b127-000d61064a01}{3808876b-c176-4e48-b7ae-04046e6cc752}
ERROR: Can't open file C:/WINDOWS/NTDS/ntds.dit
ERROR: Can't open file C:/WINDOWS/NTDS/temp.edb
ERROR: Can't open file C:/WINDOWS/ntfrs/jet/ntfrs.jdb
ERROR: Can't open file C:/WINDOWS/ntfrs/jet/temp/tmp.edb
C:/WINDOWS/PCHEALTH/ERRORREP/UserDumps/clamscan.exe.20060422-034732-00.hdmp: W97M.1Table FOUND
C:/WINDOWS/PCHEALTH/ERRORREP/UserDumps/clamscan.exe.20060422-034732-00.hdmp: moved to 'C:/Dokumente und Einstellungen/All Users/.clamwin/quarantine/clamscan.exe.20060422-034732-00.hdmp'
ERROR: Can't open file C:/WINDOWS/system32/dhcp/dhcp.mdb
ERROR: Can't open file C:/WINDOWS/system32/dhcp/tmp.edb
ERROR: Can't open file C:/WINDOWS/system32/wins/wins.mdb
ERROR: Can't open file C:/WINDOWS/system32/wins/winstmp.mdb
ERROR: Can't open file C:/WINDOWS/Temp/LB37.tmp
ERROR: Can't open file C:/WINDOWS/Temp/LB38.tmp

-- summary --
Known viruses: 52402
Engine version: 0.88.1
Scanned directories: 3241
Scanned files: 45866
Infected files: 1
Data scanned: 9630.57 MB
Time: 54220.812 sec (903 m 40 s)
--------------------------------------
Scan started: Mon Apr 24 03:00:00 2006

C:/Dokumente und Einstellungen/All Users/.clamwin/quarantine/clamscan.exe.20060422-034732-00.hdmp: W97M.1Table FOUND
File excluded 'C:/Dokumente und Einstellungen/All Users/.clamwin/quarantine/clamscan.exe.20060422-034732-00.hdmp'
ERROR: Can't open file C:/Exchsrvr/MDBDATA/tmp.edb
ERROR: Can't open file C:/pagefile.sys
--------------------------------------
...

all further scans were cancelled using taskmanager
the stuff found seem to be false positives (checked with several online scanners)
View user's profileSend private message
magarj


Joined: 27 Apr 2006
Posts: 2
Reply with quote
alch asked:
-when you say it is doing the same, which process is consuming all cpu: clamtray.exe or clamscan.exe?

clamtray.exe initally is using 100% CPU, as soon as I end that process clamscan.exe shoots to 100% as well.

-also if you open the ClamWinScanLog.txt what does it say?

Here is the last day's scan log: (Edited path to XXX)

Scan started: Tue Apr 25 19:30:00 2006

ERROR: Can't open file C:/Documents and Settings/XXX
ERROR: Can't open file C:/Documents and Settings/XXX
--------------------------------------
Scan started: Wed Apr 26 21:30:00 2006


-- summary --
Known viruses: 53081
Engine version: 0.88.1
Scanned directories: 7
Scanned files: 30
Infected files: 0
Data scanned: 165.82 MB
Time: 338.245 sec (5 m 38 s)

Hope this helps!

JAM
View user's profileSend private message
Clamwin 0.88.1: Clamtray uses 100% CPU after scheduled scan
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 2  

  
  
 Reply to topic