Locked Files

[Rainwalker]

Greetings,
Whenever I do a Full Scan two locked files always show up. I am concerned that there are files not being scanned. They show up as:
c:\hiberfil.sys
c:\pagefile.sys
I suspect there is a simple answer but I don't know what it is. Any thoughts anyone ?

[Dan Perez]

Hey,

Yes, those are special files. hiberfil.sys is where you system state information is stored when your system goes into hibernation mode. pagefile.sys is where items in RAM get stored temporarily under certain conditions. It acts as an extention to your physical RAM. It's okay if neither of those get scanned.

HTH,

Dan

[Rainwalker]

Thank you again.

[linney]

As an add on to this subject: in XP you get maybe a hundred of these "locked files" in the log after a scan by NOD32. Is that a problem I should be concerned with.

Am I correct in thinking a file could become infected before it was locked by Windows?

Where can I find some good reading along the lines of "What Are Locked Files" or "Locked Files Explained" especially as they relate to virus scanning.

[martindijk]

No worries, Rainmaker.

Iam running ME, and when NOD does a scan it allways skips my swapfile cause it is in use, but that's quiet normal, so no harm is done.

rgds,
Martin

[anders]

-{ Quote: " quoting: linney link=board=39;threadid=10998;start=0#msg71650 date=1057387263]Am I correct in thinking a file could become infected before it was locked by Windows?" }-

A locked file could be infected, however, on a normal system, I don't think there are any executables that are locked.

The pagefile and hibernation file are locked, so are files in \windows\system32\config..

However, if you notice that a bunch of .EXEs are locked, you should be concerned, however, then the scanner ought to detect the malware in memory.

Best regards,
Anders