Win32:Agent-SG [trj] in C:\windows\memory.dmp

[system]

Hi,

Please help.

A recent scan has discovered Win32:Agent-SG [trj] in C:\windows\memory.dmp.

When I try to send to the chest I’m told ‘Not enough disc space’ even though I have 44.8 GB available. The file size is 786,000KB.

I’ve deleted the whole file (outside of Avast) then restored a previous back up but it’s still there.

When I check with other AV companies - they don’t recognise the virus.

Tech support sugest (i) boot scan (ii) scan in Safe Mode. Neither worked.

Window Defender can’t find it

What should I do next?

Eddie

[DavidR]

1. you can increase the sizes of the chest, Program Settings, Chest.
2. I would personally just delete it as the memory.dmp is of little use to you as it is just an image of your memory after a crash, possibly caused by vitus infection and this is retained in the image.
3. You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner
   Or Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. You can’t do this with the file in the chest, you will need to move it out.

However as I said the memory.dmp file is a redundant file unless you are using it with a debug program.

[Vlk]

This is most likely a false positive. You can safely delete the file if you want (it contains auxiliary data about your last “blue screen”).

Thanks
Vlk

[DavidR]

Thanks Vlk.

@ EmeraldPat
I just thought about my item 3), you can’t upload this to either virustotal or jotti as it exceeds the maximum file size, I must have been sleeping as I suggested that ;D

[system]

@DavidR post:2

1. you can increase the sizes of the chest, Program Settings, Chest.
2. I would personally just delete it as the memory.dmp is of little use to you as it is just an image of your memory after a crash, possibly caused by vitus infection and this is retained in the image.
3. You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner
   Or Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. You can’t do this with the file in the chest, you will need to move it out.

However as I said the memory.dmp file is a redundant file unless you are using it with a debug program.

DavidR & Vik.

Thanks for the response (DavidR you were right about size)

Last question ‘When I delete, will my XP Pro regenerate should it ever be needed?’

Thanks

[Lisandro]

@EmeraldPat post:5

Last question ‘When I delete, will my XP Pro regenerate should it ever be needed?’

Can you rephrase? Are you referring to Windows XP System Restore feature?

[DavidR]

The memory.dmp has nothing to do with regeneration, it is just used by techs to try and find why a system crashed, it is a redundant file. It isn’t like system restore which can step to a restore point or a last known good setup, etc. memory is cleared on boot anyway and you can’t reload this file back into memory.

This is a dead parrot, deceased, shuffled of its mortal coil, gone to meet his maker, this file is no more, useless, without worth, you can safely delete it.

[system]

@Tech post:6

@EmeraldPat post:5

Last question ‘When I delete, will my XP Pro regenerate should it ever be needed?’

Can you rephrase? Are you referring to Windows XP System Restore feature?

Tech,

In my simple jargon, what I meant is ‘If needed will XP create.’

However, reading on & the good support I’ve had from David & Vik I’m going to delete & sleep easy.

Many thanks to all who have contributed.

[system]

@DavidR post:7

The memory.dmp has nothing to do with regeneration, it is just used by techs to try and find why a system crashed, it is a redundant file. It isn’t like system restore which can step to a restore point or a last known good setup, etc. memory is cleared on boot anyway and you can’t reload this file back into memory.

This is a dead parrot, deceased, shuffled of its mortal coil, gone to meet his maker, this file is no more, useless, without worth, you can safely delete it.

Thanks again.

[DavidR]

No problem, welcome to the forums.

If you have a blue screen the file will be created again, if the file existed at the time of the BSOD it would be replaced.