ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
Clamscan crashes since 0.88.1
rin!go


Joined: 25 May 2006
Posts: 34
Reply with quote
I've been using ClamWin for quite some time. It's setup to run weekly full scans of my C: and D: drives (both are hard drives).
Was working smoothly until version 0.88.1 - the one without cygwin. Once upgraded, clamscan crashes after some time - 30 minutes to 1 hour, on random files (not always the same). Looks more like time/memory than a specific file. I've tried 0.88.1 cygwin version that I found somehwere on this forum - and it works fine. Today downloaded 0.88.2.3 - and same problem. Scan runs for some time, and booom: clamscan.exe - Application Error "The instruction at 0x1001f2a6" referenced memory at "0xe600008c". The memory could not be "read"."

O/S: Windows 2000 server, all service packs and updates.
There is nothing in the logs. It just scans and at some point crashes.

Is there anything I could try to troubleshoot this error? Any way to get cygwin versions for the new releases/updates?

Thanks.
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
try running clamscan.exe on the command line with --debug switch:

"c:\program files\clamwin\bin\clamscan.exe" --debug --recursive --database="c:/documents and settings/all users.winnt/.clamwin/db" c:/

and then capture what happens when it crashes.
View user's profileSend private message
rin!go


Joined: 25 May 2006
Posts: 34
Reply with quote
Here we go. Here are the last lines of the debug output before the crash:
Code:

LibClamAV debug: Recognized RAR file
LibClamAV debug: in scanrar()
LibClamAV debug: ExtrFile(): dup(3) = 4
LibClamAV debug: Couldn't read next filename from archive (I/O error): 0
LibClamAV debug: RAR: Number of archived files: 1
LibClamAV debug: RAR: 030530p.rar, crc32: 0xd895e58, encrypted: 4, compressed: 5712, normal: 5637, method: 51, ratio: 0 (max: 250)
LibClamAV debug: ExtrFile(): dup(3) = 5
LibClamAV debug: unrarlib: Allocated 1048576 bytes.
LibClamAV debug: unrarlib: Allocating 5637 bytes
LibClamAV debug: unrarlib: Unpack()
LibClamAV debug: CurUnpRead == -1610607024, TotalRead == 5712, Count == 2480, UnpPackedSize == 0
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
can you email me 030530p.rar file to clamwin at clamwin dot com?
View user's profileSend private message
rin!go


Joined: 25 May 2006
Posts: 34
Reply with quote
Well, that's a tricky thing. The structure is like: text file, wrapped into the password protected .rar archive, which is, in it's case, also wrapped into another password protected .rar archive:
030530pd.rar - password protected
|--030530p.rar - also password protected
|---030530.txt - text file

I've tried creating similar test file but it doesn't crash clamwin. The original one does.
I'm kinda hesitant about sending this file over since it has security sensitive data in it (although protected with two levels of passwords).

Would this information help or you'd still need the file?
View user's profileSend private message
rin!go


Joined: 25 May 2006
Posts: 34
Reply with quote
Just a thought: from the debug log looks like clamwin unpacked password protected file without checking if it's in fact password protected. So the unpacked file, of course, is not a valid .rar archive. But it still tried to check it.

Looks like clamwin shouldn't even try to touch password protected archives - it doesn't make any sense anyway.
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
rin!go wrote:

Would this information help or you'd still need the file?


I'd need the file to reproduce and debug, but I understand your concerns about privacy. Maybe if you try to do couple more rar files (rar2 or rar3) then it will reoccur?
View user's profileSend private message
rin!go


Joined: 25 May 2006
Posts: 34
Reply with quote
Ok, just sent you a file. Double archiving seems not to make any difference. Sigle archive also crashes clamwin.
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
rin!go wrote:
Ok, just sent you a file. Double archiving seems not to make any difference. Sigle archive also crashes clamwin.

thanks. investigating now
View user's profileSend private message
rin!go


Joined: 25 May 2006
Posts: 34
Reply with quote
I was wondering if this was fixed in the new 0.88.3 version?
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
should be
View user's profileSend private message
rin!go


Joined: 25 May 2006
Posts: 34
Reply with quote
Nope Sad
The problem doesn't appear on the file I've sent you last time, true. But it still crashes Clamwin on the original one. I've just sent it to you.
View user's profileSend private message
rin!go


Joined: 25 May 2006
Posts: 34
Reply with quote
it still crashes on some file, but so far I can't figure out which one it is.
It crashes when scheduled scan runs on the C: drive, but when I try to run it manually with debug on as in the example above - it completed with no errors :-/
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 898
Location: Italy
Reply with quote
these kind of problem can be related to some stuff that should be fixed when ported native, anyway I always need to reproduce it to be able to fix Sad
rar code of stable version is in any case a bit dumb, clamav delopers switched to a new code for rar in devel version
View user's profileSend private message
rin!go


Joined: 25 May 2006
Posts: 34
Reply with quote
Ok, this time it crashed when I ran it with debug mode. The problem is... It only crashes when runs in full scan. When I tried to scan that directory where it crashed - nothing. Looks like it was working on one of .chm files. Some sort of a leak?
Here are the last lines of the debug output:
Code:

LibClamAV debug: Section: 1 Offset: 7361188 Length: 2066, Name: /FILES/returnaddress_icon.gif
LibClamAV debug: Section: 1 Offset: 7363254 Length: 1389, Name: /FILES/routingslip_icon.gif
LibClamAV debug: Section: 1 Offset: 7364643 Length: 3615, Name: /FILES/selectiveconsumer_icon.gif
LibClamAV debug: Section: 1 Offset: 7368258 Length: 2814, Name: /FILES/serviceactivator_icon.gif
LibClamAV debug: Section: 1 Offset: 7371072 Length: 3804, Name: /FILES/shareddatabase_icon.gif
LibClamAV debug: Section: 1 Offset: 7374876 Length: 3783, Name: /FILES/smartproxy_icon.gif
LibClamAV debug: Section: 1 Offset: 7378659 Length: 2578, Name: /FILES/splitter_icon.gif
LibClamAV debug: Section: 1 Offset: 7381237 Length: 12853, Name: /FILES/style.css
LibClamAV debug: Section: 1 Offset: 7394090 Length: 2519, Name: /FILES/testmessage_icon.gif
LibClamAV debug: Section: 1 Offset: 7396609 Length: 4148, Name: /FILES/transactionalclient_icon.gif
LibClamAV debug: Section: 1 Offset: 7400757 Length: 2079, Name: /FILES/wiretap_icon.gif
LibClamAV debug: Section: 0 Offset: 0 Length: 0, Name: /NFO/
LibClamAV debug: Section: 1 Offset: 7402836 Length: 63939, Name: /NFO/lib.gif
LibClamAV debug: Section: 1 Offset: 7466775 Length: 399, Name: /NFO/lib.html
LibClamAV debug: Section: 1 Offset: 7467174 Length: 3493, Name: /NFO/lib_bgr.gif
LibClamAV debug: Section: 0 Offset: 0 Length: 60, Name: ::DataSpace/NameList
LibClamAV debug: Section: 0 Offset: 6525 Length: 5724353, Name: ::DataSpace/Storage/MSCompressed/Content
LibClamAV debug: Section: 0 Offset: 106 Length: 28, Name: ::DataSpace/Storage/MSCompressed/ControlData
LibClamAV debug: Section: 0 Offset: 98 Length: 8, Name: ::DataSpace/Storage/MSCompressed/SpanInfo
LibClamAV debug: Section: 0 Offset: 60 Length: 38, Name: ::DataSpace/Storage/MSCompressed/Transform/List
LibClamAV debug: Section: 0 Offset: 0 Length: 0, Name: ::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9D31-11D0-9B27-00A0C91E9C7C}/InstanceData/
LibClamAV debug: Section: 0 Offset: 134 Length: 2000, Name: ::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9D31-11D0-9B27-00A0C91E9C7C}/InstanceData/ResetTable
LibClamAV debug: ---- Chunk ----
LibClamAV debug: Signature:     PMGL
LibClamAV debug: Free Space:    3185
LibClamAV debug: Prev Block:    3
LibClamAV debug: Next Block:    -1
LibClamAV debug: Num entries:   22

LibClamAV debug: ---- Reset Table ----
LibClamAV debug: Num Entries:   245
LibClamAV debug: Entry Size:    8
LibClamAV debug: Table Offset:  40
LibClamAV debug: Uncom Len:     8016083
LibClamAV debug: Com Len:       5724353
LibClamAV debug: Frame Len:     32768

LibClamAV debug: ---- Control ----
LibClamAV debug: Length:                6
LibClamAV debug: Signature:     LZXC
LibClamAV debug: Version:       2
LibClamAV debug: Reset Interval:        65536
LibClamAV debug: Window Size:   65536
LibClamAV debug: Cache Size:    1

LibClamAV debug: ---- Content ----
LibClamAV debug: Offset:        31305
LibClamAV debug: Length:        5724353

LibClamAV debug: Compressed offset: 31305

View user's profileSend private message
Clamscan crashes since 0.88.1
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 2  

  
  
 Reply to topic