Lots of locked files. Should I be worried?

Discussion in 'NOD32 version 2 Forum' started by Chippy, May 15, 2005.

Thread Status:
Not open for further replies.
  1. Chippy

    Chippy Registered Member

    Joined:
    Dec 14, 2004
    Posts:
    19
    I was just surfing looking for a Nora Jones midi file, when I think I may have come across a trojan. Java fired up and Firefox locked up on me, but I could hear the disk thrashing away, which worried me. NOD reported nothing.

    So I shutdown and rebooted and two strange things happening. First, Explorer shut itself down with a DEP error. Its never done that before. Also, if I do a full NOD32 scan, I get all these locked files:

    [​IMG]

    NOD has never shown that before. The only locked file I have ever seen was pagefile.sys! So I rebooted and tried again. This time, Explorer is OK, but I still get all these locked files.

    I am concerned that perhaps something nasty is "lurking" in the locked files.

    Questions: Should I be worried? Why all the locked files? What should I do?

    Thanks in advance for any help and advice.

    Chip
     
  2. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
  3. Matt_Smi

    Matt_Smi Registered Member

    Joined:
    Jul 7, 2004
    Posts:
    359
    I also get those, I actually recognize some in your screenshot. I get more than that too; there are also files in my Ad-Aware and Spybot folder that are locked. They are normal and nothing to worry about, and from what I understand malware cannot get in there.
     
  4. Chippy

    Chippy Registered Member

    Joined:
    Dec 14, 2004
    Posts:
    19
    Thanks guys.

    Strange thing is though - why didn't I get these locked file errors before?

    Chip
     
  5. Matt_Smi

    Matt_Smi Registered Member

    Joined:
    Jul 7, 2004
    Posts:
    359
    When I first got NOD and ran a scan with "stock" settings I only got like two of these, but after I changed to "extra" settings I got a ton more. Did you change any settings in the program?
     
  6. Chippy

    Chippy Registered Member

    Joined:
    Dec 14, 2004
    Posts:
    19
    I dunno - I can't recall doing so. What do you mean by "extra" settings?

    Thanks

    Chip
     
  7. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
  8. Matt_Smi

    Matt_Smi Registered Member

    Joined:
    Jul 7, 2004
    Posts:
    359
    See the "extra settings for NOD32" sticky at the top of this forum. They are just settings to make NOD more efficient.
     
  9. alglove

    alglove Registered Member

    Joined:
    Jan 17, 2005
    Posts:
    904
    Location:
    Houston, Texas, USA
    By the way, almost all of those locked files (*.dat, *.dat.LOG, and C:\Windows\system32\config\* pertain to the Windows registry. The reason they are locked is because Windows is busy using the registry. This is totally normal.

    The other file, MountPointManagerRemoteDatabase, has something to do with the NTFS file system.
     
  10. rumpstah

    rumpstah Registered Member

    Joined:
    Mar 19, 2003
    Posts:
    486
    Only if you have one like this.
     

    Attached Files:

  11. Holden4th

    Holden4th Registered Member

    Joined:
    Mar 27, 2005
    Posts:
    69
    what if you scan insafe mode? Do some of the locked files not appear because they aren't being used by the computer when safe mode is activated?
     
  12. alglove

    alglove Registered Member

    Joined:
    Jan 17, 2005
    Posts:
    904
    Location:
    Houston, Texas, USA
    That is correct, Holden4th.
     
  13. jayt

    jayt Registered Member

    Joined:
    Aug 30, 2004
    Posts:
    345
    Location:
    PA - USA
    It would still seem that there should be some way to exclude scanning all these locked and password protected files (without using some arcane switch or going into safe mode to scan). Many other AVs have such a feature. Even the free ones like antivir has such a feature. Is it not possible?
     
    Last edited: May 19, 2005
  14. jayt

    jayt Registered Member

    Joined:
    Aug 30, 2004
    Posts:
    345
    Location:
    PA - USA
    bumpup
     
  15. Stephanos G.

    Stephanos G. Registered Member

    Joined:
    Mar 29, 2005
    Posts:
    720
    Location:
    Cyprus
    I guess not at the moment :D
     
  16. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    From memory, it is to do with having "Scan All Files" ticked in the Nod32 scanner setup.

    You could always add to the Future Changes to Nod32 thread, that a tick box be added to not display the locked files unless infected.

    Cheers :D
     
  17. alglove

    alglove Registered Member

    Joined:
    Jan 17, 2005
    Posts:
    904
    Location:
    Houston, Texas, USA
    But how can you know if a file is infected, when the file is locked and therefore not available for scanning?
     
  18. jayt

    jayt Registered Member

    Joined:
    Aug 30, 2004
    Posts:
    345
    Location:
    PA - USA
    Thank you Blackspear. :) Unticking "scan all files" does do the trick. And I agree with alglove, what is the point in scanning a file if it is locked or password protected?
    I guess my only question now is: does unticking the "scan all files" leave me less protected?
     
  19. windstrings

    windstrings Registered Member

    Joined:
    Oct 20, 2004
    Posts:
    337
    It always scanned them before... with your old configuration you just didn't have the "scroll files" ticked.
     
Thread Status:
Not open for further replies.