I run a dual booting system with both XP pro and Vista Home Premium 64 bit installed . I have Avast Home on both OS’s and it keeps finding various trojans on my pc . They are always in this location D: system .pagefile. I do not go to any unsafe sites like porn or peer to peer. I also run three different antispyware programs daily. These are some samples of the trojans Avast is finding ( Win32:QQ ZHelper-X, Win32:VB-EIJ ) they are not always the same but are always found in the same location. Am I missing something or are these false reports? I ran a Symantec online scan , a Housecall online scan and they found nothing.Please help I don’t know what else to do with this problem.
In pagefile.sys, most probably a false positive.
As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button…
This link is a tutorial on how to help correct a virus detection that you believe to be false:
http://forum.avast.com/index.php?topic=25009.msg204838#msg204838
or http://forum.avast.com/index.php?topic=7779.msg62586#msg62586
Although the size of the file will not allow it to be submitted into online scanners like VirusTotal.
For the other providers (on-demand scanning such as the screen-saver or the Simple User Interface):
Right click the ‘a’ blue icon, click Program Settings.
Go to Exclusions tab and click on Add button…
Thanks for your quick reply . I was hoping that it was nothing serious. I never had this problem until I started dual booting between the two softwares. When I’m on XP and run the Avast scan it finds the Trojan’s in D:pagefile.sys which D drive would be Vista and then just the opposite when I’m using Vista. I currently am running Spybot, Spyware Terminator, Windows defender. Is there anything better that I could use or is that enough? Thanks again for your help.
The wildcard ? (any single character) would work, e.g. ?:\pagefile.sys would exclude pagefile.sys on any drive letter.
Better? I don’t think so.
But you could give a try to AVG Antispyware. Some users recommend SUPERantispyware and/or a-squared (take care about false positives).
If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
If you still detecting any strange behavior or even you’re sure you’re not clean, maybe it will be good to test your machine with anti-rootkit applications. I suggest AVG or Panda.
Also, if you still detecting strange behaviors or you want to be sure you’re clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.
After you’re clean, use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.
Finally, when you’re clean, check for insecure applications with Secunia Software Inspector to update insecure applications and avoid reinfection.
Here is my scan log
I’ve ran most of the programs you suggested and everything appears to be ok for now . I’ll wait for you to look at the HiJack this log scan that I sent to make sure thanks.
Your log seems ok. But I’m not an expert on these things.
Did you use RunScanner? It will be good…
Run HJT ajain and Fix this.
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
Other than that I don’t see anything obvious.
Just wondering why this is here since you are using windows XP ?
C:\Program Files\Vista Drive Icon\DrvIcon.exe
O4 - HKLM..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe
A google search returns many hits some suspect, http://www.google.com/search?q=DrvIcon.exe
I removed what you told me to do and also remove the drive icon changer. Here is the new scan and also the runscanner scan.Thanks for all your help . Sorry to be a pain but I just don’t want to mess my system up.
There is an automatic analysis button there… called: “Online malware analysis”.
I was just querying the entry, if you knew what it was and if you installed it for a purpose then there is likely to be no issue, it just seemed strange to be on an XP system.
If you removed the drive icon thing then it is back, did you not check your own HJT log or you didn’t remove this entry.
O4 - HKLM..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe