4

I recently downloaded Avast and I ran a full deep scan on the MacOS. It detected the Beryllium virus on my bootcamp partition. Resolving the problem through Avast is not successful. I then booted up Windows 10 and run a full scan (full and offline modes) using both Avast and Microsoft Defender, however Beryllium was not detected. I then went back to MacOS and did a full scan with Avast and still detected Beryllium. What should I do moving forward?

enter image description here

brianleeeh
  • 47
  • 2

2 Answers2

11

The pagefile.sys file is used by Windows as virtual memory. Basically, Avast running under macOS is giving you a false positive and thus can be ignored. I tested this by performing a clean install of Windows 10 (20H2) in a VMware Fusion Player (12.1.1) virtual machine. Next, I installed Avast and found no malware. However, I wanted Avast to scan pagefile.sys for viruses. Below is the procedure I used.

  1. I restarting Windows to boot to the Windows Recovery Environment. Basically, I held down the shift key while restarting Windows.

  2. I navigated to a Windows Command Prompt window.

  3. I entered the following commands. Basically, I wanted a copy of pagefile.sys.

    c:
attrib -h -s pagefile.sys
copy pagefile.sys pagefile.bin
attrib +h +s pagefile.sys
exit

  4. I booted back to Windows.

  5. Using the File Explorer, I selected to run a scan on pagefile.bin, as shown below. For a better view, click on the image or open the image in a new window.

    The result is shown below.

So Avast under Windows is ignoring the pagefile.sys file, but does not under macOS. Being this test was made from a clean install of Windows, I assume this found malware threat is a false positive and can therefore be ignored.

David Anderson
  • 35,470
  • 11
  • 50
  • 95
  • Addendum: If you want avast to shut up, it should be safe to delete `pagefile.sys` from the macOS side; then the next time you boot Windows, it will automatically re-create it with clean contents. – zwol Apr 29 '21 at 13:46
  • 1
    @zwol: After doing some further testing, I found there may be no malware threat detected or a different malware threat detected such as `Chan` or `Sf:ShellCode-R[Trj]`. Both Microsoft Defender Antivirus and Avast have patterns used to detect malware. I *think* some of these patterns are being written to virtual memory (`pagefile.sys`) when Microsoft Defender Antivirus or Avast executes. So, while what you suggest will probably work, the fix may be temporary. If I am right, then any execution of Microsoft Defender Antivirus or Avast may recreate the problem. – David Anderson Apr 29 '21 at 15:57
0

Kaspersky Threats says that the Beryllium virus is harmless, so you mightn't need to worry about it. I have zero knowledge of computer code, so if you still want it gone, I have no idea how.

random internet person
  • 1
  • 1