Pagefile.sys monkey-2

system · 2006-10-09T04:42:15.000Z

Hi all,

I am new to the forum and have just set up my beta computer with a dual boot windows XP sp2 and Vista. I am using avast with the vista RC2 and when it does a complete scan of the computer if finds an infection in c:\pagefile.sys stating its a worm/trojan monkey-2. The C drive is the XP install which was a fresh SP2 install with all upgrades done and then MS Onecare installed. Vista is on the D drive.

I can not see the pagefile.sys file nor can I get a positive with any other scanner from within XP or VIsta.

Help…is this a false positive? ???

igor0 · 2006-10-09T08:51:31.000Z

Probably yes.
In any case, the content of the pagefile is not reused between reboots, so you don’t have to worry about getting infected this way.

system · 2006-10-09T12:21:56.000Z

I ran avast in boot mood and it did not find the monkey-2. I guess it is some clich.

It might be that is a dual boot system because when I scan XP ( c drive ) it finds nothing.

Anyother thoughts?

What is Monkey-2…I can’t find anything about it!

Lisandro · 2006-10-09T15:19:33.000Z

kbtarl post:3:

It might be that is a dual boot system because when I scan XP ( c drive ) it finds nothing.

It should be detected by both Vista and XP… strange… Are both avast installation running the last avast version and the last virus datatase?

kbtarl post:3:

Anyother thoughts?

Yes. I though pagefile.sys is added to the default Exclusions of Standard Shield. Did you remove it from the Exclusion list?

system · 2006-10-22T19:05:06.000Z

I am seeing the opposite problem - When Avast! XP scans my Vista RC2 drive it indicates Trojan “Win32:Agent-SG [Trj]” in d:\pagefile.sys.

The Vista installation is only a couple of days old. Would this be a false positive as well?

Lisandro · 2006-10-22T22:06:20.000Z

mjourney post:5:

I am seeing the opposite problem - When Avast! XP scans my Vista RC2 drive it indicates Trojan “Win32:Agent-SG [Trj]” in d:\pagefile.sys.
The Vista installation is only a couple of days old. Would this be a false positive as well?

Most probably… If you scan booting from Vista, does avast detect the same file?
Anyway, you can add it to the Exclusion lists:

For the Standard Shield provider (on-access scanning):
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize.
Go to Advanced tab and click on Add button…

For the other providers (on-demmand scanning):
Right click the ‘a’ blue icon, click Program Settings.
Go to Exclusions tab and click on Add button…

Announcements