Why can't my anti-virus program open certain files?

Home » Viruses and Malware » Malware Detection

Summary: Depending on how anti-virus programs work, certain files may not be scanned. In some cases that's expected and nothing to worry about.

•

Nothing.

I'm not at all surprised that those files can't be scanned. Depending on the technology used by your anti-virus program, and whatever else your computer is doing at the time, there may be other files that cause this as well.

The reason's actually pretty simple.

•

When a program opens a file in Windows it can specify whether other programs should be allowed to access the file at the same time, or that they should be prevented from doing so.

In the later case, when a program has opened a file in such a way as to disallow access by others, the most common error message you'll see typically has the phrase " file in use". Program A has "locked" the file, and when program B comes along to try and access that file it finds that it cannot, and thus reports that the file is in use.

That's essentially what's happening here: Windows itself is program A, and your antivirus program is program B.

The file pagefile.sys is the Windows virtual memory or "paging file". It's opened by Windows when it boots, and it locked the entire time that Windows is running. Only Windows itself can access the paging file.

The file hiberfil.sys is the Windows hibernation file. When you put your machine into hibernation (which is different than standby) Windows writes a complete image of system memory to the hibernation file. When you restart from hibernation, that image is simply reloaded into memory. Like the paging file Windows keeps the hibernation file locked; only Windows is allowed to read or write the hibernation file.

So why don't all anti-virus programs produce these errors?

It's pretty simple actually: most know about the special nature of these files, and either don't even try to scan them, or don't bother reporting the error if the attempt to do so fails.

Is that a risk? Not really. It's exceptionally rare that a virus would appear only in memory and not also on disk somewhere. By definition a virus would have to be written to disk in order to survive a reboot. And both of these files are simply representations of and management systems for memory.

The bottom line for me is simply to ignore the warnings for those two files.

If you see the same warning on other files, then you'll probably want to investigate. The most common cause is that there's another program running that has those files opened and locked. If you can, determine which program is doing so, and see if you can't shut down that program for the duration of your virus scan.

Related:

• Ask Leo! - Why can't my machine hibernate? And how's that different than Stand-by?

• Ask Leo! - How can I find out who is using a "file in use"?

Article C3394 - May 25, 2008