Simple user interface-notepad

[ckiwi]

Hi, new here.
I have e-mailed avast and still not sure if I explained my question properly. After doing a scan and checking the report that is on the notepad, at the end of each item scanned says-"The process cannot access the file because it is being used by another process (32). At the bottom, it says: Infected files: 0. Is this anything to worry about? To me, sounds like nothing is being scanned because (32) wont let it.
Thanks

[Lisandro]

Generally not. Files in use can't be scanned but it's not a symptom of infection.
Can you schedule a boot time scanning?

[DavidR]

@ ckiwi
What would have helped was some common examples of locations and file names of the in use files ?

Is there a Process ID 32 in the task manager, if so what process (Image Name) is it ?

[ckiwi]

Sorry for not getting back right away, I got lost in all the info in the forums. I have so many questions to ask. But, yes I can do a boot scan and I was going to send examples from the scan report but closed it out, and started to do another scan, but I dont like the idea of doing a scan while I am on the computer. (I read somewhere to close everything before starting a scan so everything can be scanned). So I can get back to you on both scans tomorrow if thats ok. (my boot time scan takes about 1 1/2 hours) Where would I find the Process ID 32 in the task manager. That is at the end of everything scanned saying it is being used by (32) and can not be scanned. I hope I am making sence to you.
Also, for my other questions, should I find the closest forum it relates too.?

[DavidR]

Task Manager (don't know which OS you are using) but the Processes tab (in XP) ensure that you have the Process ID (PID) column selected in the View Columns option.

[ckiwi]

Visa and I have the task manager up. Under Processes what am I looking for.

[ckiwi]

lol sorry, Vista and at the bottom of the task manager it says Processes 58?

[DavidR]

That is a total, not the Process ID (PID), in your view you should have a column heading like in my image, did you click on that to expand it ?

In my image which may differ from yours as I'm using XP Pro, the Menu item View, allows for the selection of other columns not displayed. I can't help you with that as I don't use Vista. If you are able to see a list like that in my image and have the PID column. Then you are looking for the one with a PID of 32, to the left of that would be what the Process is called and it is that information we seek.

[spg SCOTT]

That is a total, not the Process ID (PID), in your view you should have a column heading like in my image, did you click on that to expand it ?

In my image which may differ from yours as I'm using XP Pro, the Menu item View, allows for the selection of other columns not displayed. I can't help you with that as I don't use Vista. If you are able to see a list like that in my image and have the PID column. Then you are looking for the one with a PID of 32, to the left of that would be what the Process is called and it is that information we seek.

To get the PID in vista task manager:
Open TaskManager --> View --> Select Columns --> Tick 'PID' (first one)

[DavidR]

Thanks Scott.

[spg SCOTT]

Thanks Scott.

You're welcome, hope it helps the OP...

[ckiwi]

Thanks Scott,  have checked the pid box. now what? and here is a few entries from my scan

* avast! Report
* This file is generated automatically
*
* Task 'Simple user interface' used
* Started on December-30-09 12:22:47 AM
* VPS: 091229-0, 29/12/2009
*

C:\Boot\BCD [E] The process cannot access the file because it is being used by another process (32)
C:\Boot\BCD.LOG [E] The process cannot access the file because it is being used by another process (32)
C:\pagefile.sys [E] The process cannot access the file because it is being used by another process (32)
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log [E] The process cannot access the file because it is being used by another process (32)
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log [E] The process cannot access the file because it is being used by another process (32)
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb [E] The process cannot access the file because it is being used by another process (32)
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb [E] The process cannot access the file because it is being used by another process (32)
C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752} [E] Access is denied (5)
C:\System Volume Information\{40c58a3a-f265-11de-9d29-001921a550ac}{3808876b-c176-4e48-b7ae-04046e6cc752} [E] Access is denied (5)
C:\Users\Windows\AppData\Local\Microsoft\Windows\UsrClass.dat [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Windows\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Windows\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Windows\AppData\Local\Microsoft\Windows Defender\FileTracker\{5E3764D2-D898-4927-8BB0-A98D48380C0E} [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Windows\AppData\Local\Microsoft\Windows Live Contacts\{34496d8d-0a4c-49df-8abf-f101f6559829}\DBStore\contacts.edb [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Windows\AppData\Local\Microsoft\Windows Live Contacts\{34496d8d-0a4c-49df-8abf-f101f6559829}\DBStore\LogFiles\edb.log [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Windows\AppData\Local\Microsoft\Windows Live Contacts\{34496d8d-0a4c-49df-8abf-f101f6559829}\DBStore\LogFiles\edbtmp.log [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Windows\AppData\Local\Microsoft\Windows Live Contacts\{34496d8d-0a4c-49df-8abf-f101f6559829}\DBStore\tempedb.edb [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Windows\AppData\Local\Microsoft\Windows Live Contacts\{428034a4-1563-4f6c-8477-a1799510703a}\DBStore\contacts.edb [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Windows\AppData\Local\Microsoft\Windows Live Contacts\{428034a4-1563-4f6c-8477-a1799510703a}\DBStore\LogFiles\edb.log [E] The process cannot access the file because it is being used by another process (32)
C:\Users

[DavidR]

The idea is to check the Task Manager immediately after the scan.

However, now seeing a bit of your log, this is a futile exercise as 32 doesn't relate the the Process ID, but to the error itself.

Windows file system error 32 is (you've guessed it) "The process cannot access the file because it is being used by another process. "

Now having a look at the files in use by another process would seem to be legitimate, Live Contacts protecting its data and other system based files. Though many of them I wouldn't have expected to either be access denied error 5. Nor would I have expected to see restore points in use by another process unless system restore was actually running something.

So what other security software do you have installed, especially anything that would protecte the registry or any restore type software.

[ckiwi]

Hi, I have avast and windows security. But, just remembered that a computer place put "Nero" on my computer and I did try a backup on it. Then seeing as I did not use any other features on it, I deleted it. When I do a scan of my computer a box comes up saying Nero/backup file?can not be scanned and is a Decompressed bomb? When I went to Backup Status and Configuration, just to see, did a search and typed Nero a list of Nero things came up, but none of the boxes are checked. Does this have anything to do with, anything? And in checking out some other restore points-Windows Image Backup: Access is denied. The main thing is, is Avast scan doing it's job and I do not need to worry about this PID 32 thing.
Sorry to ramble, I just want to make sure my computer is not infected with anything.
Cathi

[DavidR]

Files that can't be scanned are just that, not an indication they are suspicious/infected, just unable to be scanned.

Many programs (usually security based ones) password protect their files for legitimate reasons such as AdAware and Spybot Search & Destroy, there are others (and avast doesn't know the password or have any way of using it even if it did know it).

When you run scans with the above programs and you delete harmful entries that they detect, a copy is kept (in quarantine/restore/backup) in case you need to reverse what you did. These are usually password protected, you should do some housekeeping and delete old backup/recovery/quarantine entries (older than two weeks or so), this will reduce the numbers of files that can't be scanned.

By examining 1) the reason given by avast! for not being able to scan the files, 2) the location of the files, you can get an idea of what program they relate to. You may need to expand the column headings to see all the text.

If you can give some examples of those file names, the locations and reason given why it can't be scanned might help us further ?

- Decompression Bomb, a file that is highly compressed (as a back-up file is likely to be), which could be very large when decompressed. This used to be a tactic long ago to swamp the system, also see http://forum.avast.com/index.php?topic=15389.msg131213#msg131213.
 
The name really is the most dangerous thing about this and I wish they would change it or simply not report it, a real PITA.

I don't use Nero Backup so I can't really help with that, but I don't believe toy have a problem.