D:\pagefile.sys  trojan

system · 2008-02-12T21:42:50.000Z

Hi, recently my computer has been behaving very badly, it freezes up, very hard to go anywhere and so on. I did an Avast scan and it found a Win32:Agent-SG [trj] in D:\pagefile.sys. The recomended action was to move to chest but it says the disk doesnt have enough room and increasing the chest size doesn’t help either. I don’t want to delate the file without knowing what i’m doing so I thought I would ask for some help.
Thank you very much.

Update: Zonealarm detected a rootkit in my windows, system file. It wont let me delete it or do anything at all. It’s a Rootkit.Win32.Agent.zl. I Get pop-ups all the time, my computer freeze and shuts itself down.

DavidR · 2008-02-12T22:31:39.000Z

I though that the pagefile.sys files were excluded from scans.

The pagefile.sys can be very large and I wouldn’t advise increasing the size of the chest (Program Settings, Chest) I have ?:/pagefile.sys entered in my Program Settings, Exclusions, Add and copy and paste the above into the text input. The ? is a wildcard that will cater if you have a pagefile.sys in more than one partition (as I have).

I believe you can have your settings to clear the pagefile.sys on shutting down as another option.

system · 2008-02-13T03:06:49.000Z

Hi thank you for your answer. Does that mean it’s a false positive and I should ignore it?

system · 2008-02-13T05:22:19.000Z

I can’t remove this virus, what should i do? I use avast, it’s can detect, but can’t remove. Virus still exist. any body can help me?

system · 2008-02-13T07:58:51.000Z

dhanis_4us -

Please start your own thread about your problem as it is different from the problem in this thread. That way, you will more likely get the help you need.

And … welcome to the forums.

DavidR · 2008-02-13T16:09:54.000Z

jess111 post:3:

Hi thank you for your answer. Does that mean it’s a false positive and I should ignore it?

I don’t think it is possible to say one way or another as there is no way to upload it (as it is too big) to a multi-engine scanner.

The pagefile.sys is strange in that there could be fragments of information swapped in to the page file, this could possibly be a string that matches a virus signature.

system · 2008-02-15T06:40:48.000Z

thank you for your time. What would you advice that I do? Leave it or try to look elsewhere for a program that can remove it?

Maxx_original · 2008-02-15T07:54:51.000Z

exclude the pagefile.sys from scanning

system · 2009-03-23T05:21:25.000Z

The below woked 100% for me!!! Have carried out 3 through scans and Avast found no viruses
Use at your own risk!
Be careful in using the below as I understand there is “Some Risk” by playing around with the Computer’s Window’s Pagefile! The problem is after doing the below you may find your computer may not “Boot” at start-up??
a) Windows XP Virus in Pagefile.
During the early part of Avast Full /Archives scan it locates this Trojan with their notification box showing [An example] C:\Program Files\Alwil Software\Avast4\DATA\moved\pagefile.sys
Win32:Zlob-RF [trj] Trojan Horse 090321-0, 21/03/2009.
b) Avast suggest you send it to the “Chest” from which you notified the Paging file is too large to transfer to the “Chest”
c) Next go into = “Control Panel – open – Icon System –Advanced – Settings [top one] - Advanced – Change Virtual Memory [Make a note of the Pagefile sizes your computer is set to. so you will be able to customise it back to it’s previous settings]
d) Within – Change Virtual Memory “Delete” the Minium and maximum sizes [so there is no figures within – both boxes must clear/clean] – put radio dot into - No Paging File” = Restart your computer”.
e) During the next Through Scan and Avast when locates this Virus, click on the Button “Delete”.
f) Next stop the scan and Restart your computer and redo a New Full Scan. You should be clean of this virus.
g) Go into “Change Virtual Memory” and reconfigure the “Pagefile” back to its original settings and restart your computer…
h) Redo a New Full Scan to be sure you are clean.
Information on this file in the registers Pagefile.sys relates to a file that is currently used by Microsoft Windows to store frames of memory that do not currently fit into physical memory. The paging file allows the memory requirement to run all tasks to exceed the amount of physical memory and swapping allows multiple processes to run at the same time
Virtual memory extension
Now this is questionable? If you take above the Page File problems they may relate to me loosing some financial data/photos that I had had created a few days before? If you relate the Pagefile manages the frames of memory and the above virus contained just went in and upset/removed some of my data??

Lisandro · 2009-03-23T21:52:21.000Z

maybeok0 post:9:

loosing some financial data/photos that I had had created a few days before?

No, pagefile.sys has nothing to do with other saved files.

maybeok0 post:9:

If you relate the Pagefile manages the frames of memory and the above virus contained just went in and upset/removed some of my data??

Other virus could have messed your files and trace of them were detected in memory.
But, generally, this is due to false positives on pagefile.sys that could be removed from scanning.

Announcements