hallo!
since clamwin 0.88.1 clamtray.exe uses 100% of CPU after it doing a scheduled scan.
the same thing on a PC and on a laptop. the only possibility to continue to use the PCs is to quit clamtray.exe.
does anybody know why?
OS: windows 2000

thanks!

Did you use clam win b4 this new update or did you just start using it?

Monty

i've used clamwin since 0.83 i think, without any problems, until version 0.88.1. i did an update and a new install, always the same problem.

scheduler did not change in 0.88.1
try to remove ClamWin_Scheduler_Info file from your %TEMP% folder (usually c:\documents and settings\<username>\Local Settings\Temp)

i canceled everything in temp, but still the same.
thisway the program is unusable.

remove the scheduled scans and see if the problem goes away. then re-add the scheduled scan

Hello,

I'm running Clamwin on a server system (WIN2003SBS) and I installed the new version by update last friday and I ran into similar problems. I'm doing 2 scheduled scans on 2 different drives every night at 3 and 4 am and it worked fine until last friday. I now need to cancel 2 clamscan.exe tasks with the taskmanager evey morning as it is slowing down the system because of nearly 100% cpu usage so all people using the server are complaining.
As the system is used by people all day, I can only do a reinstall/shutdown on fridays when everybody is out of here.

Did remove the scheduled scans and re-adding the scheduled scan solve the problem?

Thanks in advance for replying.

Best regards,
hcremer

so, i removed all scheduled scans and readded them, but that did not resolve anything.

i noticed, that during a (scheduled) scan Clamtray.exe takes more and more CPU usage (up to 100% after about two hours of scan) and clamscan.exe goes down to 0-10% CPU usage and never finishes the scan (at least not within one workin day).
but, as soon as i quit the clamscan.exe with the task manager, Clamtray.exe turns back to 0-2% of CPU usage.

really odd... How long does it take to svan the same data if you scan form clamwin GUI?

first of all thank you for the fast reply!
I have exactly the same strange behaviour as described by egciuffo.
Apart from this, some files can't be scanned anymore because of Windows file access rights (maybe before the cygwin-based scanner was not able to scan them too, but didn't put it into the logfiles).

I still have a file called cygwin1.dll in C:\Programme\ClamWin\bin. Is this still needed or just left from a past installation (I'm using Clamwin since version 0.86.2 on this system) and always upgraded when the update-log mentioned it.

I also had some false positives since last fridays upgrade.

Yesterday, I started a manual scan on a remote desktop, but needed to cancel it after 2 hours or so as people complained about low performance.

[quote="alch"]really odd... How long does it take to svan the same data if you scan form clamwin GUI?[/quote]

it is about the same: it never ends the scan (at least not within one day) and CPU usage is on top again.

Hello,
I am running 0.88.1 on W2K Server and it is doing the same thing (100% CPU after a scan). Is this spcific to Server OS?

Thanks,

JAM

Question to all that reported 100% cpu:

when you say it is doing the same, which process is consuming all cpu: clamtray.exe or clamscan.exe?
also if you open the ClamWinScanLog.txt what does it say?

If I remember well, clamtray.exe is consuming 97-100% cpu when a scheduled clamscan.exe is active.
I just ran a manual scan and had clamtray. exe with very low percentage 2 clamwin.exe's with very low percentage and clamscan.exe with percentages varying between 60 % and 99 %
ClamWinScanLog.txt could not be found on my HD's.

I replaced confidential content with ... and XXX

ClamScanLog.txt had the following entries since last thursday the 3:00am is the C:\ and the 4:00am is the E:\ :

--------------------------------------
Scan started: Fri Apr 21 03:00:01 2006

--------------------------------------
Scan started: Fri Apr 21 04:00:01 2006

ERROR: Can't open file E:\EXCHANGE\MDBDATA\priv1.edb
ERROR: Can't open file E:\EXCHANGE\MDBDATA\priv1.stm
ERROR: Can't open file E:\EXCHANGE\MDBDATA\pub1.edb
ERROR: Can't open file E:\EXCHANGE\MDBDATA\pub1.stm

-- summary --
Known viruses: 51930
Engine version: 0.88
Scanned directories: 3545
Scanned files: 58966
Infected files: 0
Data scanned: 20736.97 MB
Time: 12735.239 sec (212 m 15 s)
--------------------------------------
Scan started: Sat Apr 22 03:00:03 2006

--------------------------------------
Scan started: Sat Apr 22 04:00:01 2006

ERROR: Can't open file E:/EXCHANGE/MDBDATA/priv1.edb
ERROR: Can't open file E:/EXCHANGE/MDBDATA/priv1.stm
ERROR: Can't open file E:/EXCHANGE/MDBDATA/pub1.edb
ERROR: Can't open file E:/EXCHANGE/MDBDATA/pub1.stm
ERROR: Can't open file E:/HOME/...

lots of these

...
ERROR: Can't open file E:/HOME/...
E:/HOME/XXX/Eigene Dateien/Software/FileZilla_2_2_16_setup.exe: Trojan.Clicker.VB-20 FOUND
E:/HOME/XXX/Eigene Dateien/Software/FileZilla_2_2_16_setup.exe: moved to 'C:/Dokumente und Einstellungen/All Users/.clamwin/quarantine/FileZilla_2_2_16_setup.exe'
ERROR: Can't open file E:/HOME/...

some more
...
ERROR: Can't open file E:/HOME/XXX/XXX.doc

-- summary --
Known viruses: 52180
Engine version: 0.88.1
Scanned directories: 3545
Scanned files: 59074
Infected files: 1
Data scanned: 22285.59 MB
Time: 30125.187 sec (502 m 5 s)
--------------------------------------
Scan started: Sun Apr 23 04:00:04 2006

ERROR: Can't open file E:/EXCHANGE/MDBDATA/priv1.edb
ERROR: Can't open file E:/EXCHANGE/MDBDATA/priv1.stm
ERROR: Can't open file E:/EXCHANGE/MDBDATA/pub1.edb
ERROR: Can't open file E:/EXCHANGE/MDBDATA/pub1.stm
ERROR: Can't open file E:/HOME/...

lots of these

ERROR: Can't open file E:/HOME/XXX/XXX.doc

-- summary --
Known viruses: 52402
Engine version: 0.88.1
Scanned directories: 3545
Scanned files: 59132
Infected files: 0
Data scanned: 22292.68 MB
Time: 44350.156 sec (739 m 10 s)
--------------------------------------
Scan started: Sun Apr 23 03:00:01 2006

ERROR: Can't open file C:/Exchsrvr/MDBDATA/tmp.edb
ERROR: Can't open file C:/pagefile.sys
ERROR: Can't open file C:/Programme/Microsoft SQL Server/MSSQL$SHAREPOINT/Data/master.mdf
ERROR: Can't open file C:/Programme/Microsoft SQL Server/MSSQL$SHAREPOINT/Data/mastlog.ldf
ERROR: Can't open file C:/Programme/Microsoft SQL Server/MSSQL$SHAREPOINT/Data/model.mdf
ERROR: Can't open file C:/Programme/Microsoft SQL Server/MSSQL$SHAREPOINT/Data/modellog.ldf
ERROR: Can't open file C:/Programme/Microsoft SQL Server/MSSQL$SHAREPOINT/Data/tempdb.mdf
ERROR: Can't open file C:/Programme/Microsoft SQL Server/MSSQL$SHAREPOINT/Data/templog.ldf
ERROR: Can't open file C:/System Volume Information/{3808876b-c176-4e48-b7ae-04046e6cc752}
ERROR: Can't open file C:/System Volume Information/{4d4b24a4-cb54-11da-b127-000d61064a01}{3808876b-c176-4e48-b7ae-04046e6cc752}
ERROR: Can't open file C:/System Volume Information/{4d4b24ae-cb54-11da-b127-000d61064a01}{3808876b-c176-4e48-b7ae-04046e6cc752}
ERROR: Can't open file C:/System Volume Information/{4d4b24c6-cb54-11da-b127-000d61064a01}{3808876b-c176-4e48-b7ae-04046e6cc752}
ERROR: Can't open file C:/System Volume Information/{4d4b24c7-cb54-11da-b127-000d61064a01}{3808876b-c176-4e48-b7ae-04046e6cc752}
ERROR: Can't open file C:/WINDOWS/NTDS/ntds.dit
ERROR: Can't open file C:/WINDOWS/NTDS/temp.edb
ERROR: Can't open file C:/WINDOWS/ntfrs/jet/ntfrs.jdb
ERROR: Can't open file C:/WINDOWS/ntfrs/jet/temp/tmp.edb
C:/WINDOWS/PCHEALTH/ERRORREP/UserDumps/clamscan.exe.20060422-034732-00.hdmp: W97M.1Table FOUND
C:/WINDOWS/PCHEALTH/ERRORREP/UserDumps/clamscan.exe.20060422-034732-00.hdmp: moved to 'C:/Dokumente und Einstellungen/All Users/.clamwin/quarantine/clamscan.exe.20060422-034732-00.hdmp'
ERROR: Can't open file C:/WINDOWS/system32/dhcp/dhcp.mdb
ERROR: Can't open file C:/WINDOWS/system32/dhcp/tmp.edb
ERROR: Can't open file C:/WINDOWS/system32/wins/wins.mdb
ERROR: Can't open file C:/WINDOWS/system32/wins/winstmp.mdb
ERROR: Can't open file C:/WINDOWS/Temp/LB37.tmp
ERROR: Can't open file C:/WINDOWS/Temp/LB38.tmp

-- summary --
Known viruses: 52402
Engine version: 0.88.1
Scanned directories: 3241
Scanned files: 45866
Infected files: 1
Data scanned: 9630.57 MB
Time: 54220.812 sec (903 m 40 s)
--------------------------------------
Scan started: Mon Apr 24 03:00:00 2006

C:/Dokumente und Einstellungen/All Users/.clamwin/quarantine/clamscan.exe.20060422-034732-00.hdmp: W97M.1Table FOUND
File excluded 'C:/Dokumente und Einstellungen/All Users/.clamwin/quarantine/clamscan.exe.20060422-034732-00.hdmp'
ERROR: Can't open file C:/Exchsrvr/MDBDATA/tmp.edb
ERROR: Can't open file C:/pagefile.sys
--------------------------------------
...

all further scans were cancelled using taskmanager
the stuff found seem to be false positives (checked with several online scanners)

alch asked:
-when you say it is doing the same, which process is consuming all cpu: clamtray.exe or clamscan.exe?

clamtray.exe initally is using 100% CPU, as soon as I end that process clamscan.exe shoots to 100% as well.

-also if you open the ClamWinScanLog.txt what does it say?

Here is the last day's scan log: (Edited path to XXX)

Scan started: Tue Apr 25 19:30:00 2006

ERROR: Can't open file C:/Documents and Settings/XXX
ERROR: Can't open file C:/Documents and Settings/XXX
--------------------------------------
Scan started: Wed Apr 26 21:30:00 2006


-- summary --
Known viruses: 53081
Engine version: 0.88.1
Scanned directories: 7
Scanned files: 30
Infected files: 0
Data scanned: 165.82 MB
Time: 338.245 sec (5 m 38 s)

Hope this helps!

JAM