Hello everybody,
Avast detected a virus Win32:Codbas-14 (Trj). Recommended action was to “move to chest”.
When I tried to do this, another message appears " The process cannot access the file because it is used by another process".
So is my computer infected ? I did a selective startup and scanned my computer for virus. Doesn’t seem to find any. Please advise. Thanks.
What build of avast! do you have?
Additionally, what is the full filename of the detected virus?
My Avast build is 4.5.549.
Virus name is Win32:Codbas-14 [Trj]
The file is in C:\Documents and Settings\Teh~\Local Settings\Temporary Internet Files \Content.IE5\4PIJ4DYN\popprg[1].js"file
Pls advuse. Thanks !
Yes, your system is/was infected. The location of the file tells you how. (Temporary internet files) Looking at the name of the file (popprg[1].js) I would say it is/was caused by one of those malicious sites you visited.
To make sure your system is clean follow the instructions in the malware removal section. (Click the link in my signature)
Hello Eddy
I followed your instructions (Safe mode + Avast (thorough scan) + Adaware + Spybot. But no virus is detected.
By the way, I have 2 drives, C & E. Avast doesn’t seem to stop once scan is complete. It starts with C, then E and goes back to C and E again. I stopped the scan when I realised this is happening. Is this normal ?
Since no virus is detected, is my system cleaned then ?
What about the virus message received in the first place ?
Most probably you’re clean.
The first message refers to that infection, once cleaned, you’re clean. Avast send the file to Chest and nothing wrong with that.
You can schedule a boot time scanning or run a throughout scanning (including archives).
You can scan your system on-line for sure (see http://www.security-ops.tk/)
Definetivelly not…
Are you refering to Screen saver module of scanning or a common scanning by avast?
Hello Technical
I don’t get what you mean…
First there is this popup warning “Virus was Found”. There are some options to choose from. Recommended action is “move to chest”. But usually I choose to delete (If I remember correctly). Then next message " The process cannot access file…" So was the virus moved to chest automatically even though I did not select the option?
What is the screen saver module of scanning that you refer to ? I thought there is only one way to scan ? What is the difference ?
Sorry, I wrote bad…
First, if you delete the virus it was not sent to Chest.
But, send it to Chest is the wiser option as you won’t harm your system and can think better on it (sometimes you could see it’s a false positive, not a real virus, if you can understand me…).
The screen saver module could be found here:
Start Menu > Control Panel > Video > Screen saver properties
Choose avast screen saver
Click Configurations
Choose your ‘own’ screensaver and set avast scanning settings
The difference of the scanning methods will be given by your settings 
[quote author=Technical
First, if you delete the virus it was not sent to Chest.
But, send it to Chest is the wiser option as you won’t harm your system and can think better on it (sometimes you could see it’s a false positive, not a real virus, if you can understand me…).
I can’t exactly remember which action I chose. It’s either delete or move to chest. But this is the part I don’t quite understand. Nonwithstanding which action I choose, if the next message I see is “The process cannot access file…etc”, doesn’t this means that the virus is not deleted or moved to chest? I mean Avast cannot access the file to delete or move it.
Subsequently if I scan my PC, the virus should still be present. How to explain the non-detection then ?
No, not necessarily. A temporary infected file was saved into your HDD. It could be deleted by the infected process just before avast could do it. It was detected by avast and deleted by the infected process. Other possibility, two different residents of avast are detecting the file (Standard Shield and Script Blocker, or Internet Mail…), the first one deleted the file (are you using silent mode?) and the second couldn’t.
I’m not saying it’s not strange but the message supposes avast could not handle the infection as the file was in use. You should do a boot time scanning. But, if in the second scanning you’re clean, that means the infected file was deleted before.
I agree that the behavior in your system is strange…
Hello Technical
I did a boot time scanning as you suggested. I am glad no virus was found. This is what matters most to me.
Thanks for your replies on this issue.
Well, you’re clean and this is good 8)
This is what matters… Happy New Year
Cut & paste from Eddy:
Only true virus infected files can be repaired, the others just need to be deleted.