I don't know why
scanning the following one file is taken a very long time (49 minutes)
when unchecking 'Scan in Archives' option in preference window.

'C:\Program Files\Common Files\Java\Update\Base Images\jdk1.6.0.b105\tools.zip' (46.8MB)

in scan dialog window,
rotating line indicators repeat after progress indicator disappeared(after 100%)


but,
when checking the 'Scan in Archives' with minimum values('1') for it's sub items,
scanning the above file finishes as soon as progress indicator reaches 100%. (1 minute 31 seconds)

(clamwin version is 0.91.2)

When you configure Clamwin not to scan in archives, it still scans the raw file. When you configure it to scan in archives, there is a default of 10 megabytes to scan, although you can set it to any size you want. So it quits scanning at 10 MB when you select it to scan archives, but it keeps "chewing" on the raw file when you deselect the archive scan. 10 MB is probably enough to scan for most malware.

Regards,

I'm sorry, I don't understand it.

does not the rotating line indicators(/-\|) mean scanning in archives?
and,
does not the progressive indicator(percentage) mean scanning(chewing) raw file?

in both cases(checking/unchecking 'Scan in Archives'),
chewing on the raw file(progressive indicator) passed soon.

I dont understand why the rotating line indecators repeat for a very long time after chewing on the above file(tools.zip) in case I configure ClamWin not to scan in archives.

ClamWin still scans an archived file--even if you configure it not to scan in archives. It just scans the file without attempting to "unzip" it.

It's not generally a good idea, but if you always have a problem scanning a particular file, you can configure ClamWin to filter/exclude that particular file from subsequent scans. First, make sure the file is clean by scanning it with another antivirus or upload it to VirusTotal before you exclude it from scans.

Regards,

maybe, my english is very poor...

Of course, I know ClamWin will scan archives as just raw files.
then, it should scan compressed files of each archive OR should not, depending on the preference setting.

the 'ClamWin Help' says,

then, I thinked the rotating line indicators appear only when ClamWin scans compressed files (through unzip,unrar, ...) which exist in each archive file.

I said,
strangely, with 'Scan in Archives' option unchecked, rotating line indicators appeared when the ClamWin scaned the above 'tools.zip'. the indicators repeat for a huge time. (delay scanning very much)

thereafter, I tried to check the 'Scan in Archives' option with
'Do not Scan Archives Larger Than 1 MegaBytes'
'Do not Extract More Than 1 Files'
'Do not Extract More Than 1 Sub-Archives',
in this case, scanning the 'tools.zip' ends up shortly without the rotating line indicators. (only progressive indicator appear)

None of my archive files are large enough to notice, but I think I see what you're driving at: there appears to be a "mismatch" between the progress/% indicator and the archive scanning bar indicator--perhaps when some additional compresson is involved in an archived file. In that case, the compression scanning continues even if you have configured ClamWin not to scan in archives. Is that correct?

This might not be related, but I've noticed that when scanning SOME .exe files, after the progress/% indicator finishes, then the archive scanning bar indicator appears--giving the appearance that some additional scanning is taking place after the % indicator is finished. I thought that after the progress/% indicator finishes, the scan was finished.

Can some ClamWin guru shed some light on this? Is this normal, or is it something that should be addressed?

Regards,

I checked one of my large .exe files with Clamwin, and this appears to me to be what happens:

The progress/% indicator tells how you much of the file has been loaded into ClamWin. The spinning bar actually tells you that ClamWin is scanning the file.

Regards,