Win32:Adloader-AC [Trj] False positive????

Viruses and worms
1

Hi all, this is driving me nuts. Please bear with me.

I dual boot my PC with XP and Vista64 Premium.

When under XP, C drive is my XP drive, F drive is my Vista drive.

I’ve recently reformatted everything, installed just XP (no software). Then I installed Vista. At present ALL I’ve got installed into Vista are Firefox, Thunderbird, Everest ultimate, Office 2007, Nvida drivers, Auzen sound card drivers and Avast. Apart from the initial install I’ve not used Vista for anything (UAC is enabled) (waiting for the official SP1 to give it another try).

Then I concentrated on my XP install and installed the various games/apps I wanted. I finally got it exactly how I want XP to be, so before I created a backup, I did a full scan with Avast.

Only one problem: Win32:Adloader-AC [trj] has been found in F:\pagefile.sys

I tried to delete it and it said it had gone.
I then booted Vista and turned off the pagefile
I booted XP, ran spybot and AVG Anti Spyware (formelyEwido), they both passed fine
I reran avast and again it found the trojan in pagefile.sys on my F: drive. Again I deleted it.
I rebooted and re-ran avast, this time no problems found (I suspect because I didn’t reboot into vista after turning off pagefile, it was still there the first time)
I rebooted to Vista, ran avast, no problems found.
I turned on the pagefile and again ran avast, no problems found.
I reboot to XP, run avast on my Vista drive and it comes up with: Win32:Adloader-AC [trj] has been found in F:\pagefile.sys
Again I delete it.
I reboot to Vista, run Avast, and it’s clean
Just to make sure, again I reboot into Vista and run avast, again it’s clean.
I then reboot into XP, run Avast, low and behold: Win32:Adloader-AC [trj] has been found in F:\pagefile.sys

This time WITHOUT deleting the trojan from Vistas pagefile, I reboot to Vista, run Avast and it passes 100%, nothing found at all
I reboot to XP, run avast and again avast finds the trojan in Vistas pagefile.sys

This leads me to believe it’s a false positive?

many thanks

Phil

2

Hi pjo123,

Here it is also reported: http://forum.telecharger.01net.com/telecharger/securite_virus_et_assimiles/trojan_et_spywares/win32adloader-ac_trj__vrai_virus__vrai_trojan__resolu-419016/messages-1.html

Leads me to believe it is a FP. Did you upload to virustotal, and what were the results there,

polonus

3

Thanks

No I didn’t upload it.

Since then I’ve installed both XP and Vista updates and now the scan passes every time.

If I have the problem again, I will upload it to virustotal