My computer (Vista) was being slower than usual for a few days, so I ran an avast boot scan. Avast found that C:\hiberfil.sys is infected with Win32:Driver-BVO [Trj]. The file was obviously too big to be moved to the chest. Avast can’t repair the file either, saying “Error: The system cannot find the file specified”.
I found that it is possible to get rid of C:\hiberfil.sys all together through command prompt, but it didn’t work: after I entered the powercfg -h off command, I read that it couldn’t do it because of “one or more legacy drivers installed”;“an internal system component has disabled hibernation”. The hiberfil.sys file is still there. I do seem to be able to send it to the recycling bin, however. Perhaps it is a good idea?
If you have encountered this problem before, please let me know how to deal with it. Keep in mind that my priority is to get rid of Win32:Driver-BVO [Trj], I don’t care what happens to hiberfil as long as it isn’t infected anymore.
Dear Pondus, I like the BootScan feature because it has happened before that the regular scan didn’t find the problem, while the bootscan did and eliminated it.
This time around, I admit I did the BootScan right away. Are you saying that I should do a regular scan and stop worring about it if it comes up clean? I understand there is a risk of a false positive with the BootScan, but when I read Win32:Driver-BVO [Trj], I tend to worry. Am I wrong?
I looked at the other threads and most of them revolve around removing hiberfil alltogether. Could you tell me your opinion on doing so? I will take another look at the topics, however.
well…i would be suspicious if i dont have any problems, and then suddenly bootscan tell me that i am infected but the default scan made for routine scan are not
do you have latest virus update?
have you run a quick scan with Malwarebytes for a second opinion ?
Yes, I have the updates. The (regular) scan is running now. Once again, do you think I should not be worried about the BootScan and the trojan if the regular scan comes up clean?
I also re-read the other hiberfil.sys topics.
The most constructive solution seems to be disabling-enabling hibernation, making Windows create a new hiberfil.sys file. I would like some help with that, seeing as I have Vista and the command prompt doesn’t let me disable hibernation (see earlier post).
The hibernation option does appear in the Start menu despite what was written in command prompt.
If you believe I should get Malwarebytes, I will, but it does not solve anything. If it finds the Trojan too, I doubt it will remove it if Avast can’t. If it doesn’t find it, then I am still going to be worried because of that one Boot Scan.
I do not understand why I can’t seem to get rid of hiberfil.sys when other people have without problem. What does “an internal system compound has disabled hibernation” mean?
It’s strange that I couldn’t disable hibernate from Safe mode with command prompt, but managed to do it through the regular command prompt. Maybe it was a glitch that got fixed by one of the scans I ran.
I think this is all for now. Thank you for your help!