about 'Disk 0 Master Boot Record can’t be scanned. Error code 32'

Avast Free Antivirus / Premium Security
1

Hi,

Recently, my ‘full virus scan’ report showed an abnormal result – Disk 0 Master Boot Record can’t be scanned. Error code is 32, claiming something like ‘the file is used by another program’.

My Window 10 version is 1809 (OS 17763.379), 64-bit and Avast version is 19.4.2374 build 19.4.4318.439 , virus definition 190411-0.

Actually I am not sure whether this issue is caused by Avast or my computer as just after my window 10 updated with KB4493509, next time when I switched on my computer (Note: the previous description is not ‘correct’, it should be ‘reboot’), the screen freezed(after window loaded and my desktop wallpaper appeared). I had no choice but directly pressed the ‘on/off’ button to shut down my computer. I tried it twice and same issue remained. Then I applied ‘restoring point’ approach and my window properly functioned again (i.e. no freezing screen). After that, I updated avast to the version mentioned above (without installing any new window 10 update again) and immediately carried out full-virus scan to check for virus. No virus was found but the result reported ‘Disk 0 Master Boot Record can’t be scanned’, which never happened before with any version of avast. I also run boot-time scan later and the result indicated no infected file was found.

  1. Like to share this to see whether any user experience the same issue, even without ‘my window update issue’ before.

  2. Even full virus system scan can’t scan MBR, can I use boot-time scan instead to scan MBR to ensure it is not infected? Sometimes I am confused as the number of files scanned by my boot-time scan is always fewer than full virus scan (300,000 vs 500,000), don’t know whether scanning area of boot time scan covered all files scanned by the latter one. In fact, total size of file scanned during full virus scan is always larger than the space of hard disk consumed (80GB scanned vs 40GB in used).

  3. Is it necessary to carry out the method ‘ try “fixmbr” from installation CD’ in the following link?
    https://forum.avast.com/index.php?topic=69186.msg581377#msg581377

Thank you for your advice and time.

2

–Point # 1: Disk 0 Master Boot Record can’t be scanned likely because Avast is already scanning it during the usual anti-rootkit scan routinely done by Avast 8 minutes in after the system starts up. Trying to scan with another process at this time (Avast Full Scan) would result in an “access denied error”. —> To prove this is the case, try waiting 10-12 minutes after you’ve shut down and start a new boot and scan again and see if the error repeats. It’s likely you started your full scan too soon.
–Point # 2: Boot-time scan should only be used if a normal scan finds a virus or malware and a regular scan cannot be used to remove it.

  • It does not offer better detection as it uses the same virus definitions as does the regular scan.
  • Where a boot-time scan works better is by allowing you to remove malware that needs Windows to run and uses that fact to prevent easy removal of itself.
  • Windows is not running during a boot-time scan.
    —> Because Windows is not running during a boot-time scan the normal self-defense mechanisms normally in place to prevent removal of needed Windows system files are not able to prevent deletion of Windows files. Removal of a Windows system file will always result in a damaged or dead Windows system.

–Point # 3: fixmbr is to be used only if your system reports there is no operating system present and does not boot to Windows. I don’t think this is the case here. [EDIT:] No malware was found, fixmbr is not needed.

3

Thanks, mchain.

Thank you for your reply and spend valuable time to help and explain more to me.

I tried full virus scan twice before I posted the original post. The first one is exactly the case you mentioned, i.e. run the scan shortly after switching on my computer. However, for the second trial, the full virus scan was run after turning on my computer for more than 1 hour. The report also shows ‘MBR can’t be scanned’, it is accessed by other process, error code 32.

Originally, my main concern is though full virus scan(I check all the box in settings page, including ‘rootkit’) declared my computer as clean, in fact it haven’t scanned the MBR(never happened before) and I am not sure whether that part is ‘actually clean’. However, if boot-time scan can scan that part(i.e. MBR) instead and the report shows free of virus, then to a certain extent it is still ok for me.

I may run another full virus scan when I use that computer again later. In addition, just a supplementary of facts for interest, just discovered other users may also experience the window updated issue mentioned in the first post, someone claimed it is due to ‘incompatibility between certain antivirus applications’

https://answers.microsoft.com/en-us/windows/forum/all/kb4493509-update-problems/5d544746-92f2-4f61-928f-0b45e7d1a053

4

If you see the same error again on your next full scan, please attach a screenshot of the error box so we can see.

5

Finally, I uninstalled avast and then re-installed it for another trial. The version for free avast anitvirus is 19.4.2374 - build 19.4.4318.451. For virus definition, it is 190412-8.

After carrying out full virus scan and checking corresponding report, the result is shown below(direct copy from the report)

Avast Scan Report

  • This file is generated automatically
  • Scan name: Full Virus Scan
  • Started on: Saturday, April 13, 2019 3:28:42 PM
  • VPS: 190412-8, 2019/04/12

Infected files: 0
Total files: 530369
Total folders: 43439
Total size: 84.8 GB

No file is reported as ‘unable to scan’. Therefore,‘Disk 0 Master Boot Record can’t be scanned because other process is accessing it. Error code 32’ (not exact wordings, but similar meaning) is no longer stated in the report.

However, according to my experience with older versions of Avast, there should be some files that can’t be scanned during full-virus scan, therefore the result seems unusual to me.

My assumptions are:
Case 1: Avast can scan those related files now.

Case 2: Older versions allow user to choose what to indicate in the scanning report, but with the newest version, those files that can’t be scanned are not shown in report by default. In the main setting page, users can only decide generate report or not.

Case 3: Other possible causes.

If case 1 is true, I appreciate the developmental effort by avast team because more files can be scanned now for a higher security level.

If case 2 is true, it is difficult to determine whether my full virus scan can scan MBR again or not. In previous versions, files not scanned are listed in the report. That’s the reason why some times ago, one avast user checked the report and discovered lots of files can’t be scanned, thus he/she reported the incident here and let avast identify the problem as quick as they could. This really serves as a ‘double checking process’ and help making avast better and better.

https://forum.avast.com/index.php?topic=209475.0

Let see whether other users experience these ‘changes’ in their full virus scan report too or it is an unique incident come across by me.

6

Hi!

As a follow-up, I would like to add some information and clarification here.

Recently after reading some threads in the forum, I realized there is a so-called geek:area. After entering that special setting page, I added ‘SoftErrors’ and ‘Skipped’ in reporting items for full virus scan.

After carrying out full virus scan (about 1hour after turning on my computer), some items are shown as below (direct copy from scanning report)

Disk 0 Master Boot Record [E] 程序無法存取檔案，因為檔案正由另一個程序使用。 (32)
C:$Extend$RmMetadata$TxfLog$Tops [E] 存取被拒。 (5)
C:$Extend$RmMetadata$TxfLog$TxfLog.blf [E] 存取被拒。 (5)
C:\swapfile.sys [E] 程序無法存取檔案，因為檔案正由另一個程序使用。 (32)
C:\hiberfil.sys [E] 程序無法存取檔案，因為檔案正由另一個程序使用。 (32)
C:$Extend$RmMetadata$TxfLog$TxfLogContainer00000000000000000051 [E] 存取被拒。 (5)
C:$Extend$RmMetadata$TxfLog$TxfLogContainer00000000000000000040 [E] 存取被拒。 (5)
C:\Program Files (x86)\Google\Update\Download{8A69D345-D564-463C-AFF1-A69D9E530F96}\73.0.3683.103\73.0.3683.103_chrome_installer.exe|>chrome.7z|>Chrome-bin\73.0.3683.103\73.0.3683.103.manifest [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Update\Download{8A69D345-D564-463C-AFF1-A69D9E530F96}\73.0.3683.103\73.0.3683.103_chrome_installer.exe|>chrome.7z|>Chrome-bin\73.0.3683.103\chrome_100_percent.pak [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Update\Download{8A69D345-D564-463C-AFF1-A69D9E530F96}\73.0.3683.103\73.0.3683.103_chrome_installer.exe|>chrome.7z|>Chrome-bin\73.0.3683.103\chrome_200_percent.pak [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Update\Download{8A69D345-D564-463C-AFF1-A69D9E530F96}\73.0.3683.103\73.0.3683.103_chrome_installer.exe|>chrome.7z|>Chrome-bin\73.0.3683.103\d3dcompiler_47.dll [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Update\Download{8A69D345-D564-463C-AFF1-A69D9E530F96}\73.0.3683.103\73.0.3683.103_chrome_installer.exe|>chrome.7z|>Chrome-bin\73.0.3683.103\default_apps\docs.crx [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Update\Download{8A69D345-D564-463C-AFF1-A69D9E530F96}\73.0.3683.103\73.0.3683.103_chrome_installer.exe|>chrome.7z|>Chrome-bin\73.0.3683.103\default_apps\drive.crx [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Update\Download{8A69D345-D564-463C-AFF1-A69D9E530F96}\73.0.3683.103\73.0.3683.103_chrome_installer.exe|>chrome.7z|>Chrome-bin\73.0.3683.103\default_apps\external_extensions.json [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Update\Download{8A69D345-D564-463C-AFF1-A69D9E530F96}\73.0.3683.103\73.0.3683.103_chrome_installer.exe|>chrome.7z|>Chrome-bin\73.0.3683.103\default_apps\gmail.crx [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Update\Download{8A69D345-D564-463C-AFF1-A69D9E530F96}\73.0.3683.103\73.0.3683.103_chrome_installer.exe|>chrome.7z|>Chrome-bin\73.0.3683.103\default_apps\youtube.crx [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Update\Download{8A69D345-D564-463C-AFF1-A69D9E530F96}\73.0.3683.103\73.0.3683.103_chrome_installer.exe|>chrome.7z|>Chrome-bin\73.0.3683.103\Extensions\external_extensions.json [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Update\Download{8A69D345-D564-463C-AFF1-A69D9E530F96}\73.0.3683.103\73.0.3683.103_chrome_installer.exe|>chrome.7z|>Chrome-bin\73.0.3683.103\icudtl.dat [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.103\Installer\chrome.7z|>Chrome-bin\73.0.3683.103\73.0.3683.103.manifest [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.103\Installer\chrome.7z|>Chrome-bin\73.0.3683.103\chrome_100_percent.pak [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.103\Installer\chrome.7z|>Chrome-bin\73.0.3683.103\chrome_200_percent.pak [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.103\Installer\chrome.7z|>Chrome-bin\73.0.3683.103\d3dcompiler_47.dll [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.103\Installer\chrome.7z|>Chrome-bin\73.0.3683.103\default_apps\docs.crx [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.103\Installer\chrome.7z|>Chrome-bin\73.0.3683.103\default_apps\drive.crx [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.103\Installer\chrome.7z|>Chrome-bin\73.0.3683.103\default_apps\external_extensions.json [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.103\Installer\chrome.7z|>Chrome-bin\73.0.3683.103\default_apps\gmail.crx [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.103\Installer\chrome.7z|>Chrome-bin\73.0.3683.103\default_apps\youtube.crx [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.103\Installer\chrome.7z|>Chrome-bin\73.0.3683.103\Extensions\external_extensions.json [E] 7ZIP archive is corrupted. (42139)
C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.103\Installer\chrome.7z|>Chrome-bin\73.0.3683.103\icudtl.dat [E] 7ZIP archive is corrupted. (42139)
C:\pagefile.sys [E] 程序無法存取檔案，因為檔案正由另一個程序使用。 (32)
\?\Volume{078d9df5-0000-0000-0000-100000000000}$Extend$RmMetadata$TxfLog$TxfLogContainer00000000000000000001 [E] 存取被拒。 (5)
\?\Volume{078d9df5-0000-0000-0000-100000000000}$Extend$RmMetadata$TxfLog$TxfLogContainer00000000000000000002 [E] 存取被拒。 (5)
\?\Volume{078d9df5-0000-0000-0000-100000000000}$Extend$RmMetadata$TxfLog$TxfLog.blf [E] 存取被拒。 (5)
\?\Volume{078d9df5-0000-0000-0000-100000000000}$Extend$RmMetadata$TxfLog$Tops [E] 存取被拒。 (5)
\?\Volume{078d9df5-0000-0000-0000-40c1e8000000}$Extend$RmMetadata$TxfLog$TxfLog.blf [E] 存取被拒。 (5)
\?\Volume{078d9df5-0000-0000-0000-40c1e8000000}$Extend$RmMetadata$TxfLog$TxfLogContainer00000000000000000001 [E] 存取被拒。 (5)
\?\Volume{078d9df5-0000-0000-0000-40c1e8000000}$Extend$RmMetadata$TxfLog$TxfLogContainer00000000000000000002 [E] 存取被拒。 (5)
\?\Volume{078d9df5-0000-0000-0000-40c1e8000000}$Extend$RmMetadata$TxfLog$Tops [E] 存取被拒。 (5)

Infected files: 0
Total files: 528486
Total folders: 43040
Total size: 85.4 GB

Here are some remarks and my observations.

1.For my full virus scan setting, I click all the box including ‘rookits’. The scanning areas are ‘all harddisks’

2.Even I turn the languages from ‘Traditional Chinese’ to ‘English’, some words in the reports are still indicated as ‘Traditional Chinese’. Hope the error code can help readers understanding the corresponding types.

  1. From ‘Day 1’ I used avast, reported items related to ‘C:$Extend$RmMetadata’, ‘Volume’ , ‘C:\swapfile.sys’, etc are shown in the report. I know it is common that ‘some files can’t be scanned’ and I do not have doubt about these items (Yes, I know many users ask that before =P)

  2. Only items related to Chrome(7zip) and Disk 0 Master Boot Record are ‘relatively new’ (The latter one is even ‘more recent’). For 7zip, in fact before I uninstalled Avast secure browser, some 7-zip files related to Avast secure browser cannot be scanned also.

  3. Back to my title of the original post here (Disk 0 Master Boot Record can’t be scanned), the traditional Chinese description in English is something like ’the file is being accessed by another process’, which never happen before I post my original thread here. (added after modified: the reason why I specially request for advice for the ‘master boot record issue’ is it seems that ‘suddenly’ some programs appear and use the Master Boot Record, in turn blocking avast to scan it. If antivirus can’t scan it, it doesn’t imply it is infected, but in another way round, it doesn’t imply it is clean either. Therefore, I hope I could find some ways to scan it, just like some times ago )

For your reference please. Thank you.