Pagefile.sys Infection: Win32:PcClient-OD [Trj]

Viruses and worms
1

Hi everyone,

Recently a scan revealed that the pagefile.sys on one of my hard drives (not my primary, just a file store) was infected with Win32:PcClient-OD [Trj]. The bizarre thing is that my system was set to “Automatically manage paging file size for all drives” and I don’t think there even was a pagefile. Further, I’ve now manually configured the pagefiles, and set that drive’s to “None” - and I still receive the warning.

After a search on these forums it looks like there are a fair number of false positives in regards to paging files, could that be the case here?

Any help would be greatly appreciated. Thank you.

2

It is hard to tell and by default the pagefile.sys is excluded from on-demand scans. So I don’t know why it would be scanned on your recent scan (so exactly what scan where you doing ?).

If you have set the figure/drives size to none have you also deleted the pagefile.sys file that was being alerted on. So what is the location of this pagefile.sys file ?

You need a pagefile.sys in at least one location (so I don’t know if windows would ignore this instruction on ‘all’ drives), your primary partition so there is somewhere to store data, the easiest is for windows to manage the size.

3

Hi David, thanks for your reply.

For my scan settings:
Drives: E:
Scan all files
Content (thorough but slow)
Test Whole Files
All Packers

The pagefile it was picking up was E:\pagefile.sys. My pagefile was on my primary partition (C:).

Instead of having the pagefile set to “none” I manually gave it a size, restarted, and re-ran the scan. This time there was no virus detected.

Although my issue seems to be resolved for the moment, I’m still curious to know what happened. Thoughts?

4

The pagefile.sys file is somewhat weird in that data is constantly being swapped in and out so there might be a time when some of the data matches a virus signature.

5

Interesting. Would I have to format the drive(s) and scan/ rescan the files moved to a backup to be totally safe?

6

No, I don’t believe you need do anything else having manually resized it. That after reboot would have cleared the old file.

You could however, set it to No Paging file for that partition/drive and click Set, which would remove the file completely after reboot, see image.