Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

An unknown file appear on my server. The filename is test.php.LCK. I download and open in notepad, the contents are:

"my computer name" || "my email address"

I am very sure I did not put the file to the server and I am the only one who manage the server. Questions:

Q1: Is that a virus?

Q2: What can it harm to my server?

Q3: How to removed it from my server?(just shift+delete?) (I ran a full scan on the server using norton antivirus 2008, but nothing found)

Q4: How to protect my server from this file?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

This is a lock file from Dreamweaver. See this page for more information about it. It is simply Dreamweaver's way of knowing that you were working on the file at one point, and it should not let your (hypothetical) coworkers work on it.

share|improve this answer
1  
Thanks godness. I though it was a virus. I am relieved now fyuh... –  beautex00 Aug 11 '09 at 3:54
add comment

It's probably a lockfile, meaning it was put there by a program or script as a way of saying, "Hey, I'm running, so don't let another instance of the program/script run or we'll run over each other's toes!"

A quick google of "test.php.LCK" shows that there are a lot of other sites showing this file and information.

I very much doubt it's a virus. You don't give specs on what you're running, but the Norton hints that you're running IIS on Windows? You can try using procmon, process explorer, regmon and filemon from the sysinternals suite (free download) to see if any of them show what has an open file handle on that particular file.

In the end it's probably nothing to "protect" against. Lock files are a mechanism used by scripts and many UNIX applications to add a kind of flag preventing other instances from running. You should only delete them if the program crashes and leaves the lockfile behind, preventing another instance from running when you restart the process that crashed.

share|improve this answer
    
This is interesting, "Norton hints that you're running IIS on Windows"?? yeah, you are absolutely correct. How you know I am using IIS on windows? Just from the word "Norton"? Unbelieveable.. –  beautex00 Aug 11 '09 at 4:00
    
I'm an AI and work on probabilities. –  Bart Silverstrim Aug 11 '09 at 14:07
    
Where else is 'Norton Antivirus' running than Windows (yes mac, but usually that is named '...for mac')? So the guess is indeed quite obvious. –  Server Horror Jun 14 '11 at 17:40
1  
Maybe I should be more explicit next time. START ADDING YOUR SPECS WHEN YOU ASK QUESTIONS. Subtlety is obviously not a strong point for some here. –  Bart Silverstrim Jun 14 '11 at 18:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.