Helping people with computers... one answer at a time.

Depending on how anti-virus programs work, certain files may not be scanned. In some cases that's expected and nothing to worry about.

While running Antivir Personal Edition Classic, these 2 messages displayed: "[WARNING] C:\hiberfil.sys The file could not be opened!" & "[WARNING] C:\pagefile.sys The file could not be opened!" What do I do now?


I'm not at all surprised that those files can't be scanned. Depending on the technology used by your anti-virus program, and whatever else your computer is doing at the time, there may be other files that cause this as well.

The reason's actually pretty simple.

When a program opens a file in Windows it can specify whether other programs should be allowed to access the file at the same time, or that they should be prevented from doing so.

In the later case, when a program has opened a file in such a way as to disallow access by others, the most common error message you'll see typically has the phrase " file in use". Program A has "locked" the file, and when program B comes along to try and access that file it finds that it cannot, and thus reports that the file is in use.

That's essentially what's happening here: Windows itself is program A, and your antivirus program is program B.

The file pagefile.sys is the Windows virtual memory or "paging file". It's opened by Windows when it boots, and it locked the entire time that Windows is running. Only Windows itself can access the paging file.

The file hiberfil.sys is the Windows hibernation file. When you put your machine into hibernation (which is different than standby) Windows writes a complete image of system memory to the hibernation file. When you restart from hibernation, that image is simply reloaded into memory. Like the paging file Windows keeps the hibernation file locked; only Windows is allowed to read or write the hibernation file.

So why don't all anti-virus programs produce these errors?

It's pretty simple actually: most know about the special nature of these files, and either don't even try to scan them, or don't bother reporting the error if the attempt to do so fails.

Is that a risk? Not really. It's exceptionally rare that a virus would appear only in memory and not also on disk somewhere. By definition a virus would have to be written to disk in order to survive a reboot. And both of these files are simply representations of and management systems for memory.

The bottom line for me is simply to ignore the warnings for those two files.

If you see the same warning on other files, then you'll probably want to investigate. The most common cause is that there's another program running that has those files opened and locked. If you can, determine which program is doing so, and see if you can't shut down that program for the duration of your virus scan.

Article C3394 - May 25, 2008 « »

Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

1 Comment
May 27, 2008 9:09 AM

For me, the bottom line is if my virus scanner is THAT dumb, it's not a good scanner and should be dumped for something better. Fast.

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to to ask your question.