When ClamWin 0.98.7 is running on Win98SE and I click at its task CLAMSCAN.EXE in Process Explorer v11.11 (to watch its open files, semaphores etc.), this in many situations (e.g. the memory scan by Sentinel) terminates CLAMSCAN.EXE immediately, i.e. the task disappears as soon I click on it. In other situations it at least seems to quit and restart the task.

Yet I never saw this phenomenon with other programs before. I am not sure if this is a bug or a feature of CLAMSCAN.EXE. May this have to do with too little heap space (previous version gave a warning in the DOS box during memory scan) that reduces even more by examination by Process Explorer, or is this a security feature that stops itself when it detects debugging activity to prevent virus programmers from spying out internal encryption passwords or such things? Why does it behave this way?

I can't imagine many viruses still infecting Win98 systems, but I guess its possible. Not many tools that run Windows 98 either, not any I know of that are still being updated/still getting virus signatures.

As your other issue with clamscan.exe, I am not seeing this using process hacker. Have you tried a restart and see if it still happens?

If you have just recently installed ClamWin, I suggest that you try a re-install just in case something didn't go right--it happens sometimes. Over time, the Clam AV engine used by ClamWin has evolved, and I fear that it is leaving Windows 98 behind as new functionality is incorporated. Most computer hardware now has larger memory, dual cores (or more), and is capable of much more processing than Windows 98 can perform. So it is possible you don't have enough horsepower. I hope a re-install works for you.

Regards,

This bug is no practical problem at all, only a strange behaviour, like when that process is somehow ticklish. May be that CLAMSCAN.EXE monitors the count of listeners to its message queue(?) and when there are additional listeners detected (here by Process Explorer polling its properties) it concludes a hacker attack and thus terminates/restarts itself. I doubt that it is designed Win98SE specific but may be a general internal sanity check of ClamAV that prevents allowing more listeners than known by itself (like a political election system that re-counts the number of ballot papers in the box to verify that there are no additional counterfeit ballots - if there are too many ballots, that something is bogus and the election has to be repeated).