Locked Files

Discussion in 'NOD32 version 2 Forum' started by Rainwalker, Jul 4, 2003.

Thread Status:
Not open for further replies.
  1. Rainwalker

    Rainwalker Registered Member

    Joined:
    May 18, 2003
    Posts:
    2,106
    Location:
    USA
    Greetings,
    Whenever I do a Full Scan two locked files always show up. I am concerned that there are files not being scanned. They show up as:
    c:\hiberfil.sys
    c:\pagefile.sys
    I suspect there is a simple answer but I don't know what it is. Any thoughts anyone ?
     
  2. Dan Perez

    Dan Perez Retired Moderator

    Joined:
    May 18, 2003
    Posts:
    1,495
    Location:
    Sunny San Diego
    Hey,

    Yes, those are special files. hiberfil.sys is where you system state information is stored when your system goes into hibernation mode. pagefile.sys is where items in RAM get stored temporarily under certain conditions. It acts as an extention to your physical RAM. It's okay if neither of those get scanned.

    HTH,

    Dan
     
  3. Rainwalker

    Rainwalker Registered Member

    Joined:
    May 18, 2003
    Posts:
    2,106
    Location:
    USA
    Thank you again.
     
  4. linney

    linney Registered Member

    Joined:
    Feb 17, 2002
    Posts:
    174
    As an add on to this subject: in XP you get maybe a hundred of these "locked files" in the log after a scan by NOD32. Is that a problem I should be concerned with.

    Am I correct in thinking a file could become infected before it was locked by Windows?

    Where can I find some good reading along the lines of "What Are Locked Files" or "Locked Files Explained" especially as they relate to virus scanning.
     
  5. martindijk

    martindijk Registered Member

    Joined:
    Jun 13, 2003
    Posts:
    537
    Location:
    Gorredijk - the Netherlands
    No worries, Rainmaker.

    Iam running ME, and when NOD does a scan it allways skips my swapfile cause it is in use, but that's quiet normal, so no harm is done.

    rgds,
    Martin
     
  6. anders

    anders Eset Staff Account

    Joined:
    Oct 25, 2002
    Posts:
    410
    A locked file could be infected, however, on a normal system, I don't think there are any executables that are locked.

    The pagefile and hibernation file are locked, so are files in \windows\system32\config..

    However, if you notice that a bunch of .EXEs are locked, you should be concerned, however, then the scanner ought to detect the malware in memory.

    Best regards,
    Anders
     
Thread Status:
Not open for further replies.