ClamWin Free Antivirus :: View topic - Multiple clamscan.exe killing CPU on a scheduled scan

Posted: Thu Oct 23, 2008 8:15 am

I'm having the same problem, except I seem to be the record holder in thread count. I had 31 clamscan.exe threads, accounting for over 2 gigs of memory in total. I ended up killing them all. I'm running Windows Web Server 2008 64bit. My log just shows 31 scans starting at various times between 8 and 9:30. I can post it if you want, even though I doubt it will be much use to you.

Menno

Posted: Thu Oct 23, 2008 12:35 pm

could you paste %temp%\clamwin1.log ?

Posted: Thu Oct 23, 2008 12:54 pm

Sure:

System Locale: ('nl_BE', 'cp1252')
Default Encoding: cp1252
command line path:

That's all.

Posted: Thu Oct 23, 2008 1:45 pm

I have the same problem with version 0.94 in Windows XP SP2. I have a weekly scan scheduled on Thursday at 13:30. Today when I looked at the computer at 15:00 aprox, I had many processes (30 or 40) each of them of about 60MB.

Here is my ClamScanLog.txt where you can see a lot of lines with "Scan Started Thu Oct 23 XX:XX:XX 2008". I hope it helps.

Scan Started Tue Oct 07 08:50:03 2008
-------------------------------------------------------------------------------

*** Scanning Programs in Computer Memory ***
*** Memory Scan: using ToolHelp ***

*** Scanned 52 processes - 711 modules ***
*** Computer Memory Scan Completed ***

[Edit] Alch: Log removed [[/Edit]

Posted: Thu Oct 23, 2008 2:02 pm

Sorry, there was a mistake on my previous post: I have two scheduled scans at 13:40 (weekly on Thursday), one for unit C and one for unit D, both of them with "Scan programs loaded in computer memory" active. The last scan in the log (at 15:20) was made manually after killing all the processes.

Posted: Thu Oct 23, 2008 9:32 pm

eight wrote:

Sorry, there was a mistake on my previous post: I have two scheduled scans at 13:40 (weekly on Thursday), one for unit C and one for unit D, both of them with "Scan programs loaded in computer memory" active. The last scan in the log (at 15:20) was made manually after killing all the processes.

To all having this issue:
1. How often do you restart your computer?
2. Does closing down clamtray.exe and starting it again from c:\program files\clamwin\bin\ help the problem?

Posted: Fri Oct 24, 2008 6:56 am

1. Restart is once a week
2. closing clamtray won't close it's process, it continues to run until I close all the clamscan processes
3. this is the contet of my ClamWin1.log while it runs multiple instances:

Code:

System Locale: ('de_AT', 'cp1252')
Default Encoding: cp1252
command line path: "C:\Dokumente und Einstellungen\All Users\.clamwin\log\ClamScanLog.txt"
running task <function>(<__main__>, 'C:\\', 'Sysdrive', 1) on: 24-10-08 08:30:00. Frequency is: Weekly

Scanning: "C:\\"
clamscan.exe command line: "C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmp0ymq7p" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\"
"C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmp0ymq7p" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\" --memory
Schedule missed, returning: Fri Oct 24 08:32:00 2008
LastRun: Fri Oct 24 08:30:00 2008
running task <function>(<__main__>, 'C:\\', 'Sysdrive', 1) on: 24-10-08 08:32:00. Frequency is: Weekly

Scanning: "C:\\"
clamscan.exe command line: "C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmppsida8" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\"
"C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmppsida8" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\" --memory
Schedule missed, returning: Fri Oct 24 08:34:00 2008
LastRun: Fri Oct 24 08:32:00 2008
running task <function>(<__main__>, 'C:\\', 'Sysdrive', 1) on: 24-10-08 08:34:00. Frequency is: Weekly

Scanning: "C:\\"
clamscan.exe command line: "C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmp42suu2" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\"
"C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmp42suu2" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\" --memory
Schedule missed, returning: Fri Oct 24 08:36:00 2008
LastRun: Fri Oct 24 08:34:00 2008
running task <function>(<__main__>, 'C:\\', 'Sysdrive', 1) on: 24-10-08 08:36:00. Frequency is: Weekly

Scanning: "C:\\"
clamscan.exe command line: "C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmpiqvgph" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\"
"C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmpiqvgph" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\" --memory
Schedule missed, returning: Fri Oct 24 08:38:00 2008
LastRun: Fri Oct 24 08:36:00 2008
running task <function>(<__main__>, 'C:\\', 'Sysdrive', 1) on: 24-10-08 08:38:01. Frequency is: Weekly

Scanning: "C:\\"
clamscan.exe command line: "C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmputcc8f" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\"
"C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmputcc8f" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\" --memory
Schedule missed, returning: Fri Oct 24 08:40:01 2008
LastRun: Fri Oct 24 08:38:01 2008
running task <function>(<__main__>, 'C:\\', 'Sysdrive', 1) on: 24-10-08 08:40:01. Frequency is: Weekly

Scanning: "C:\\"
clamscan.exe command line: "C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmpnzmkfi" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\"
"C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmpnzmkfi" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\" --memory
Schedule missed, returning: Fri Oct 24 08:42:01 2008
LastRun: Fri Oct 24 08:40:01 2008
running task <function>(<__main__>, 'C:\\', 'Sysdrive', 1) on: 24-10-08 08:42:01. Frequency is: Weekly

Scanning: "C:\\"
clamscan.exe command line: "C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmporwbpn" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\"
"C:\Programme\ClamWin\bin\clamscan.exe" --tempdir "c:\temp" --keep-mbox --stdout --database="C:\Dokumente und Einstellungen\All Users\.clamwin\db" --log="c:\temp\tmporwbpn" --no-phishing-sigs --no-phishing-scan-urls --no-mail --infected --max-files=500 --max-scansize=150M --max-recursion=5 --max-filesize=100M --recursive --exclude="[^\]*\.dbx$" --exclude="[^\]*\.tbb$" --exclude="[^\]*\.pst$" --exclude="[^\]*\.dat$" --exclude="[^\]*\.log$" --exclude="[^\]*\.evt$" --exclude="[^\]*\.nsf$" --exclude="[^\]*\.ntf$" --exclude="[^\]*\.chm$" --exclude="[^\]*\.avi$" --exclude="[^\]*\.mkv$" --exclude="[^\]*\.ogm$" --exclude="[^\]*\.mp3$" --exclude="[^\]*\.vob$" --exclude="[^\]*\.mp4$" --exclude="[^\]*\.mpg$" --exclude="C\:\\pagefile\.sys$" --kill "C:\\" --memory
Schedule missed, returning: Fri Oct 24 08:44:01 2008
LastRun: Fri Oct 24 08:42:01 2008

Posted: Fri Oct 24, 2008 10:23 am

Thank you!
This is the key line. I will investigate

Code:

Schedule missed, returning:

Could you try (in the order below, not both at the same time, as it will help to pinpoint the problem):
1. delete %temp%\Clamwin_Scheduler_Info file
2. change schedule frequency to daily or hourly

Please let me know if 1 or 2 fixes the problem

Posted: Sat Oct 25, 2008 5:26 am

deleting %temp%\Clamwin_Scheduler_Info file worked

Posted: Wed Oct 29, 2008 12:33 pm

Kyoko wrote:

deleting %temp%\Clamwin_Scheduler_Info file worked

That worked for me too. I was wondering what has happened then...

Mauro.

Posted: Wed Oct 29, 2008 12:35 pm

There was a bug in Daylight Savings handling code. Will be fixed in the next release, but there should be no problem for another year anyway.

Posted: Wed Oct 29, 2008 1:34 pm

Hello,

It was indeed the Monday after the weekend we've changed to winter time here in Belgium.
I have not seen any other occurrences so it looks to be resolved from my end.

Thanks for your follow up.

Cheers,
Mario

Posted: Thu Oct 30, 2008 2:13 pm

Dear Site admin,

I do not have a %temp%\Clamwin_Scheduler_Info and still have the same problem. Would you advise?

Thanks.

Fernando
Windows Server 2003

Posted: Thu Oct 30, 2008 2:33 pm

itisfernando wrote:

Dear Site admin,

I do not have a %temp%\Clamwin_Scheduler_Info and still have the same problem. Would you advise?

Thanks.

Fernando
Windows Server 2003

Daylight Savings in the United States changes this weekend (it was last weekend in Europe). You can disable the schedule until the DST kicks in.

Posted: Thu Oct 30, 2008 2:37 pm

I'll give it a try.

Thanks.

Fernando