You are here

Clamwin Portable puts text files on host machine \appdata\local\temp\

9 posts / 0 new
Last post
marko
Offline
Last seen: 11 years 1 month ago
Joined: 2006-01-16 05:24
Clamwin Portable puts text files on host machine \appdata\local\temp\

After a failed DB definition update at work (probably corporate firewall related) I read the error message. At the end of the failed connection attempts I got to this

Giving up on database.clamav.net...
Update failed. Your network may be down or none of the mirrors listed in c:\users\\appdata\local\temp\tmpcbjuy5 is working. Check http://www.clamav.net/support/mirror-problem for possible reasons.

--------------------------------------
Completed
--------------------------------------

The contents of tmpcbjuy5 below

DNSDatabaseInfo current.cvd.clamav.net
DatabaseMirror database.clamav.net
MaxAttempts 3

Its not a major problem as my temp folder gets the occasional clean out but it would be better not to write to the host machine at all.

Regards.

Mir
Mir's picture
Offline
Last seen: 11 years 9 months ago
Joined: 2007-12-03 16:07
interesting

i will look into this some more later. i am sure Tim Clark will pop in with a heroic answer before i can get around to it Wink

Krayt
Krayt's picture
Offline
Last seen: 12 years 4 months ago
Joined: 2010-02-03 15:24
Virus "Suspicious.AD"

C:\users\username\appdata\local\temp\clamav-[...].00000b78.clamtmp

Norton 360 detected viruses called "Suspicious.AD" in this files. Are this viruses or only definitions of viruses to detect those viruses?

dboki89
Offline
Last seen: 9 years 3 months ago
Joined: 2009-11-30 20:44
Only Definitions, no need to worry

It's known that some AV products, from time to time, "detect" viruses in the mentioned temporary files. ClamWin creates and uses these files for detection of viruses and other malware on your computer. As you can see, (1) it says "Suspicious" vs. bluntly claiming it's a virus or trojan or whatever, and (2) if you scan ClamWin(Portable) itself, there would be no detection of anything "suspicious".

Basically, those are just the malware definitions... No need to worry, and they are only there during ClamWin's scan. Smile

Regards

My posts are old and likely no longer relevant.

Tim Clark
Tim Clark's picture
Offline
Last seen: 13 years 1 week ago
Joined: 2006-06-18 13:55
Not an heroic answer

Not an heroic answer, but a request for more information.

Did your just install new version of CWP 95.2.1 that was just released or was it the previous version?

Did you close CWP and wait a moment or two before you read the message, or did you read it while CWP was still running?

Other than the update error message were there any other problems, e.g. did CW crash during any of the update attempts?

Can you replicate the problem?, i.e. If you delete the file in question and run another update does it happen again? Obviously if you have a successful update that message would not need to be created and the test would be invalid.

I can't replicate the situation as I don't know how to force an update to fail, and even if I knew how I don't think I would do it on purpose.

Tim

Things have got to get better, they can't get worse, or can they?

Darkbee
Darkbee's picture
Offline
Last seen: 3 years 11 months ago
Joined: 2008-04-14 09:41
No Internets

Tim ClarkI can't replicate the situation as I don't know how to force an update to fail

Turn off your Internet connection? Wink

Tim Clark
Tim Clark's picture
Offline
Last seen: 13 years 1 week ago
Joined: 2006-06-18 13:55
and even if I knew

and even if I knew how I don't think I would do it on purpose.

Things have got to get better, they can't get worse, or can they?

Tim Clark
Tim Clark's picture
Offline
Last seen: 13 years 1 week ago
Joined: 2006-06-18 13:55
Follow up

Giving up on database.clamav.net...
Update failed. Your network may be down or none of the mirrors listed in c:\docume~1\tim\locals~1\temp\tmpbttsou is working. Check http://www.clamav.net/support/mirror-problem for possible reasons.

I checked and the file tmpbttsou did exist in that location, but as soon as I closed CW it disappeared.

Is it possible you had the file open to read when you closed CW so the CWP launcher could not delete it ?

Tim

Things have got to get better, they can't get worse, or can they?

marko
Offline
Last seen: 11 years 1 month ago
Joined: 2006-01-16 05:24
Hi Tim, Just to confirm the

Hi Tim,
Just to confirm the tmpXXXXX file does get deleted automatically when clamwin closes. Clamwin was still open at the time I checked, the file is gone now.

Other info
Clamwin v 0.96.2.1 (a fresh install yesterday).
I performed a manual install of the database update DB verson (main:52; daily:11862).
I also checked the DB update from home - works perfectly.

Log in or register to post comments