ClamWin Free Antivirus :: View topic - Permission Denied of some files starting with 0.94

Posted: Tue Apr 21, 2015 3:37 am

Perhaps, RRK, but I don't recall seeing these types of messages until about a year or so ago, and ClamWin was not running as a service before then either. I think Microsoft probably made a security patch about that time that caused the messages to appear. I started seeing a couple of other security quirks then also--such as the inability to change some configuration files in %appdata% folders like the Clam Sentinel/ClamWin configuration files and some other folders (in Windows 8/8.1 anyway) under certain conditions. Didn't you run into this on your Windows 7 machine with the Securite extra signatures?

Regards,

Posted: Tue Apr 21, 2015 4:28 am

I remember a service patch that happened about a year ago. Could have been from that. I did have issues trying to setup the updater for Securite using the ClamWin config file. If Appdata is effected, then I would assume it is a Administrator permission issue. There is an option during ClamWin installation to set ClamWin to be installed to all users or just yourself. Which do you use? I installed it for just myself.

Posted: Tue Apr 21, 2015 12:53 pm

I re-installed ClamWin as admin as soon as I noticed this some time ago. It seemed to help a bit, but I still see files that are not scanned-notice them mostly in a manual memory scan. None of them seem infected per Virus Total though.

Regards,

Posted: Tue Apr 21, 2015 1:41 pm

When I use to be a malware hunter for Avast and Malwarebytes, I attempted to use MSE, Avast, Malwarebytes, Super Antispyware, and Avira and none of them could scan certain system files either. I don't think is necessarily something ClamWin can fix, unless Microsoft changes the permissions again.

Posted: Mon Sep 25, 2017 6:54 pm

GuitarBob wrote:

Most permission denied files are okay. ClamWin is unable to scan files that are in use when it is scanning and also files that are locked by the Windows operating system. You can upload files to either the Jotti scanner or the Virus Total scanner where they will scan your file with multiple antivirus programs. I like to see at least 2 of these scanners verify an infected file before I believe it: AntiVir, Bitdefender, Kaspersky, NOD32, and Sophos. Jotti is at https://virusscan.jotti.org/en and Virus Total is at https://www.virustotal.com/ on the web.

Regards,

If it's unable to scan files that are in use, how do I get ClamWin to scan them when they're not in use? Like before Windows starts up?

Posted: Mon Sep 25, 2017 7:19 pm

ClamWin is unable to do an early scan before Windows boots up. As has been said, nowadays most permissions denied situations are okay--it's too visible to malware hunters. To scan these files, you might try and see if you can manually scan it via right click context menu when/if the file is not active, but many such files are always active.

One final thought: try a scan of these files in Windows Safe Mode. They may not be active then.

Regards,

Posted: Sat Sep 30, 2017 11:02 pm

GuitarBob wrote:

ClamWin is unable to do an early scan before Windows boots up. As has been said, nowadays most permissions denied situations are okay--it's too visible to malware hunters. To scan these files, you might try and see if you can manually scan it via right click context menu when/if the file is not active, but many such files are always active.

One final thought: try a scan of these files in Windows Safe Mode. They may not be active then.

Regards,

So ClamWin has no way to scan files in a filesystem when that filesystem's OS is not running?

I thought I read something about running ClamWin from a USB without needing to boot up Windows... can anyone advise or give experience info on Portable ClamWin on a USB or Removable Drive?

https://www.clamwin.com/content/view/118/89/

Posted: Sun Oct 01, 2017 12:29 am

As the ClamWin developers point out on the main ClamWin web page, ClamWin is an "on demand" scanner. It scans when you manually tell it to scan or when you have scheduled a scan. It is not a "real-time" scanner that scans as files are accessed on a computer. That is why the developers recommend (per the info on the main page) that you use it as a backup scanner to a real time one.

Google for ClamWin Portable, and you will find it. The portable version is not supported by this official ClamWin project, and it is not as configurable as the official ClamWin. It scans just like ClamWin, however, and uses the same virus signatures.

Regards,

Posted: Sun Oct 01, 2017 8:48 pm

GuitarBob wrote:

As the ClamWin developers point out on the main ClamWin web page, ClamWin is an "on demand" scanner. It scans when you manually tell it to scan or when you have scheduled a scan. It is not a "real-time" scanner that scans as files are accessed on a computer. That is why the developers recommend (per the info on the main page) that you use it as a backup scanner to a real time one.

My reply wasn't about real-time scanning, it was about scanning files that couldn't be scanned because they were in use.

GuitarBob wrote:

Google for ClamWin Portable, and you will find it. The portable version is not supported by this official ClamWin project, and it is not as configurable as the official ClamWin. It scans just like ClamWin, however, and uses the same virus signatures.

The link I provided in my reply is about Portable ClamWin on a USB or Removable Drive, and one method it says I can use is to just copy files from the ClamWin installed folders (in Program Files and AppData) to the USB drive along with some modifications based on a Conf file they posted there for download (I'm assuming the developers since it's on clamwin.com, what do I know).

Anyways, just because I found that page, I posted it just looking for advice, so thanks for the input, but by "portable version" I'm guessing you just mean the PortableApps version, and that the makeshift version posted on ClamWin.com is an actual developer-supported portable version and will scan all files in C:\ or any other drives without having to worry about Windows using the files.

Posted: Sun Oct 01, 2017 11:56 pm

The portable version described on ClamWin.com is just the same thing as the Portable App--it is installed on and runs from a USB. I've tried it, and I never got it to work, however. I think the Portable App version has been used much more, and that is what I have on a USB. I believe this is the first time I've heard anyone mention the version described on the ClamWin page. There have been lots of changes to ClamWin since it was first described, and it will have the same capabilities/limitations of ClamWin.

Regards,