Unofficial ClamWin patch for Win98SE

[tomsglr]

Well I don't kmow about the hash, but I don't think they are identical. The one I renamed was 1880KB, number 2 was 64KB, and number 3 was 26KB. I haven't noticed any problems, so I guess they aren't needed. Thanks

[CyberyogiCoWindler]

I am trying to install on Win98SE "clamav-0.98.7-win32.msi", but the installer requests to install the .NET 4 framework. So I downloaded "dotNetFx40_Client_setup.exe", which however only displays this error requester:

"There is not enough disk space on your drive for the new files to be uncompressed and installed. Please run this application again after you have freed some space on your drive."

 

I have about 2GB free, which should be plenty enough to uncompress the 868KB file. I already tried various KernelEx settings, but it doesn't help. So I downloaded "clamav-0.98.7-win32.zip" but I don't know how to manually install or start it.

Edited May 8, 2015 by CyberyogiCoWindler

[schwups]

The topic is about ClamWin and not ClamAV. I don't think that there is a workaround to run ClamAV.

[CyberyogiCoWindler]

Thanks. It was indeed the wrong file (I remembered it much bigger). The correct ClamWin installer is "clamwin-0.98.6-setup.exe" (about 100MB).

The only strange behaviour I get from ClamSentinel is that memory test opens a DOS box with the following message:

"[DllMain] Error setting up low-fragmentation heap: 120"

Then it rests some minutes with:

"Loading virus signature database, please wait..."

After this it does start to scan (a bit slowly?) the currently loaded DLLs etc. I am not sure if there is something wrong due to the stange heap error. Is this normal or something serious?

[schwups]

It is more an information than an error.

 

https://msdn.microsoft.com/en-us/library/windows/desktop/aa366750(v=vs.85).aspx

https://support.microsoft.com/en-us/kb/929136/

[CyberyogiCoWindler]

severe bug: Thunderbird crashes ClamWin


I already have submitted the following bug report to the ClamWin forum:
http://forums.clamwin.com/viewtopic.php?t=4286

I am using ClamWin with German Win98SE/KernelEx on a historical PC (DFI K6BV3+ Motherboard, AMD K6-3+ @550MHz, 768MB RAM, 160GB HDD) which is actually optimized for DOS Games (2 real ISA sound cards, 3Dfx Voodoo 1 graphics card etc.). As firewall I am running ZoneAlarm AntiVirus 6.1.744.001 (with its outdated antivirus part disabled). The start sequence is controlled through StartRight (finishes ZoneAlarm initialization before starting the antivirus).

Previously I had Avast 4.8 AntiVirus, which turned unbearably slow (booting 20 minutes, Avast updates >30 min), so I uninstalled it and switched to ClamWin 0.98.6 with Clam Sentinel 1.22.

- Thunderbird crashes ClamWin

Much worse is, when I run the ClamWin virus scan (which takes many hours per 16GB partition) and it finds my Mozilla Thunderbird e-mail folder (contains some 10000 e-mails of over a decade), it first complains about plenty of ancient phishing mails (they are scam, not malware! There is no harmful code in it, thus an antivirus should not care about them unless manually requested to do so.) Even worse, once it finds the biggest(?) of my e-mail-folders, it completely locks up and freezes my PC. I can only move the mouse pointer, but neither icons nor systray nor screen redraw responds. With ctrl-alt-del I see the taskmanager and can kill ClamWin. If I do so, the PC works again but I not even get a ClamWin log file, so I can only photograph the error by digicam. When I don't and exit taskmanager and then press ctrl-alt-del again, I instead get a popup requester that ClamWin has used up all resources. (I can kill it also from here.)

Thunderbird 2.0.0.24 (20100228) stores all e-mails inside a single file (one per folder) in subfolders of "\Windows\Anwendungsdaten\Thunderbird\Profiles" (in English version likely "\Windows\Application Data\Thunderbird\Profiles")

Also Avast 4.8 had displayed an anormaly scanning this folder:

E:\WINDOWS\Anwendungsdaten\Thunderbird\Profiles\c9spw8g1.default\Mail\Local Folders\=CO=Windler (kein Spam)\p layingit.FONTDIV#4025862408

"Prüfung nicht möglich. Die Datei ist eine Dekomprimierungsbombe."
(i.e "Testing impossible. The file is an decompression bomb.")

The strange thing is that a subfolder named "p layingit.FONTDIV#4025862408" does not exist, and even copying the contents of the folder into a new one and deleting the old (to get rid of potentially invisible folders) did not change Avast's behaviour. (ClamWin choked by a different mail folder.)

I suspect that a bug in Thunderbird always corrupts the last accessed(?) e-mail folder file and fixes this during next start, because Thunderbird itself has no problem to access them. With "Dekomprimierungsbombe" (decompression bomb, uncompression bomb) Avast certainly does not refer those deadly vacuum bombs of Putin, but a kind of faulty recursive pointer somewhere in the internal directory tree inside a compressed file, that causes an infinite loop during decompression and so eats up all memory. The FAT32 file system on that partition is not corrupt (at least scandisk doesn't complain).

Please urgently fix this! The freeze makes ClamWin almost useless to me since I can not scan my main partition. Avast at least handled the situation without a lockup. And please make ClamWin update the log file on disk every few seconds or after each read file (changeable in preferences if it would be too slow) and not only after a finished (it never will...) virus scan.

- exclude directories fails

I tried everything to exclude the corrupted e-mail folder files or their path, but ClamWin simply ignores it and scans it anyway (causing a crash). This may have to do with the lack of regular expression support in Win98SE. Please use a different (and easier to use) solution to exclude directories.

ClamWin also alerts plenty of false-positive code found in documents those are not executable. E.g. renamed WAV sound files .wa~ made trouble. There are likely many others I couldn't identify due to the crash.

- ClamWin shutdown fails

When I want to shutdown Win98SE I often get a popup requester that ClamWin has to quit first (I click ok), which however never happens, so I have to kill it ungently with Process Explorer or the taskmanager to shutdown Windoze. I suspect that Sentinel somehow prevents ClamWin from shutdown because it runs a 2nd copy in memory. Why is it so important to shutdown ClamWin cleanly? Can't it just write the log files to disk and stall like other programs?


other flaws:

- Please add a pause/resume button to the virus scan window.

The virus scan can take many hours and strongly slows down (or completely freezes, see above) my PC. Thus make it possible to pause and resume, because I e.g. may fail to bid on eBay auctions when the PC is occupied with a scan. Although I only start it manually, the need of aborting the entire scan (which takes hours to repeat) can not be a proper solution.

- Please make scan targets saveable.

Setting up proper combinations of selected and excluded directories (to avoid crash or false positive data-only files) can be time consuming and complicated. Please make the manual selection saveable as scan jobs and allow to exclude certain drives (e.g. CD burner to prevent buffer-underruns) permanently.

- Please change the animation.

The animation to the left of the virus scan window keeps running while the scan hasn't yet begun (it takes minutes to load the virus database into RAM). Please start the animation only during scan and stop it while paused or loading from disk or whatever, because it feels like scam when it pretends to scan but actually doesn't. Please also animate the tray icon (or make it change colour) during background scan (run by Sentinel) to inform the user that it is on and currently working (and so see whether e.g. a browser slowdown is caused by it).

- icon colour

During first start (after update?), the button background in Win98SE sometimes appears pink instead of default, which looks ugly.

[schwups]

Disable KernelEX for ClamWin to correct button background. It could have other effects.