[clamav-users] clamscan: permission denied on many files being used by another process

[Kris Deugau]

Michael Wang wrote:
> I understand "more" is not clamscan, I was just showing that the file in 
> question cannot be opened with clamscan nor with "more" as 
> administrator. I also understand if clamscan cannot read a file, it 
> cannot scan it. My question is how I can let clamscan to read a file, as 
> I have shown that even I cannot "more" a file used by another process as 
> administrator.

Welcome to Windows.  If a file is open by some process, it fundamentally 
cannot be opened by any other process (possibly depending on the first 
process' open mode), *by definition*.  This is a very low-level 
restriction imposed by the Windows filesystem API.

Conventional antivirus scanners get around this by a) hooking into 
Windows' filesystem API (~~"scan-on-access", which IIRC Clam doesn't 
support - at least not well - on Windows) or b) scanning the memory 
space of the offending process (ClamAV doesn't scan memory chunks).

-kgd