I've been using ClamWin for quite some time. It's setup to run weekly full scans of my C: and D: drives (both are hard drives).
Was working smoothly until version 0.88.1 - the one without cygwin. Once upgraded, clamscan crashes after some time - 30 minutes to 1 hour, on random files (not always the same). Looks more like time/memory than a specific file. I've tried 0.88.1 cygwin version that I found somehwere on this forum - and it works fine. Today downloaded 0.88.2.3 - and same problem. Scan runs for some time, and booom: clamscan.exe - Application Error "The instruction at 0x1001f2a6" referenced memory at "0xe600008c". The memory could not be "read"."

O/S: Windows 2000 server, all service packs and updates.
There is nothing in the logs. It just scans and at some point crashes.

Is there anything I could try to troubleshoot this error? Any way to get cygwin versions for the new releases/updates?

Thanks.

try running clamscan.exe on the command line with --debug switch:

"c:\program files\clamwin\bin\clamscan.exe" --debug --recursive --database="c:/documents and settings/all users.winnt/.clamwin/db" c:/

and then capture what happens when it crashes.

Here we go. Here are the last lines of the debug output before the crash:

can you email me 030530p.rar file to clamwin at clamwin dot com?

Well, that's a tricky thing. The structure is like: text file, wrapped into the password protected .rar archive, which is, in it's case, also wrapped into another password protected .rar archive:
030530pd.rar - password protected
|--030530p.rar - also password protected
|---030530.txt - text file

I've tried creating similar test file but it doesn't crash clamwin. The original one does.
I'm kinda hesitant about sending this file over since it has security sensitive data in it (although protected with two levels of passwords).

Would this information help or you'd still need the file?

Just a thought: from the debug log looks like clamwin unpacked password protected file without checking if it's in fact password protected. So the unpacked file, of course, is not a valid .rar archive. But it still tried to check it.

Looks like clamwin shouldn't even try to touch password protected archives - it doesn't make any sense anyway.

I'd need the file to reproduce and debug, but I understand your concerns about privacy. Maybe if you try to do couple more rar files (rar2 or rar3) then it will reoccur?

Ok, just sent you a file. Double archiving seems not to make any difference. Sigle archive also crashes clamwin.

thanks. investigating now

I was wondering if this was fixed in the new 0.88.3 version?

should be

Nope
The problem doesn't appear on the file I've sent you last time, true. But it still crashes Clamwin on the original one. I've just sent it to you.

it still crashes on some file, but so far I can't figure out which one it is.
It crashes when scheduled scan runs on the C: drive, but when I try to run it manually with debug on as in the example above - it completed with no errors :-/

these kind of problem can be related to some stuff that should be fixed when ported native, anyway I always need to reproduce it to be able to fix
rar code of stable version is in any case a bit dumb, clamav delopers switched to a new code for rar in devel version

Ok, this time it crashed when I ran it with debug mode. The problem is... It only crashes when runs in full scan. When I tried to scan that directory where it crashed - nothing. Looks like it was working on one of .chm files. Some sort of a leak?
Here are the last lines of the debug output: