Technology in terms you understand. Sign up for the Confident Computing newsletter for weekly solutions to make your life easier. Click here and get The Ask Leo! Guide to Staying Safe on the Internet — FREE Edition as my thank you for subscribing!

Why can't my anti-virus program open certain files?

Question:

While running Antivir Personal Edition Classic, these 2 messages
displayed: “[WARNING] C:\hiberfil.sys The file could not be opened!”
& “[WARNING] C:\pagefile.sys The file could not be opened!” What do
I do now?

Nothing.

I’m not at all surprised that those files can’t be scanned.
Depending on the technology used by your anti-virus program, and
whatever else your computer is doing at the time, there may be other
files that cause this as well.

The reason’s actually pretty simple.

Become a Patron of Ask Leo! and go ad-free!

When a program opens a file in Windows it can specify whether other
programs should be allowed to access the file at the same time, or that
they should be prevented from doing so.

In the later case, when a program has opened a file in such a way as
to disallow access by others, the most common error message you’ll see
typically has the phrase “
file in use
“. Program A has “locked” the file, and when program B
comes along to try and access that file it finds that it cannot, and
thus reports that the file is in use.

That’s essentially what’s happening here: Windows itself is program
A, and your antivirus program is program B.

The file pagefile.sys is the Windows virtual memory or “paging
file”. It’s opened by Windows when it boots, and it locked the entire
time that Windows is running. Only Windows itself can access the paging
file.

The file hiberfil.sys is the Windows hibernation file. When you put
your machine into hibernation (which is
different than standby
) Windows writes a complete image of system
memory to the hibernation file. When you restart from hibernation, that
image is simply reloaded into memory. Like the paging file Windows
keeps the hibernation file locked; only Windows is allowed to read or
write the hibernation file.

So why don’t all anti-virus programs produce these errors?

It’s pretty simple actually: most know about the special nature of
these files, and either don’t even try to scan them, or don’t bother
reporting the error if the attempt to do so fails.

Is that a risk? Not really. It’s exceptionally rare that a virus
would appear only in memory and not also on disk somewhere. By
definition a virus would have to be written to disk in order to survive
a reboot. And both of these files are simply representations of and
management systems for memory.

The bottom line for me is simply to ignore the warnings for those
two files.

If you see the same warning on other files, then you’ll probably
want to investigate. The most common cause is that there’s another
program running that has those files opened and locked. If you can,
determine which program is doing so, and see if you can’t shut down
that program for the duration of your virus scan.

Do this

Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.

I'll see you there!

1 thought on “Why can't my anti-virus program open certain files?”

  1. For me, the bottom line is if my virus scanner is THAT dumb, it’s not a good scanner and should be dumped for something better. Fast.

    Reply

Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.