4

I recently downloaded Avast and I ran a full deep scan on the MacOS. It detected the Beryllium virus on my bootcamp partition. Resolving the problem through Avast is not successful. I then booted up Windows 10 and run a full scan (full and offline modes) using both Avast and Microsoft Defender, however Beryllium was not detected. I then went back to MacOS and did a full scan with Avast and still detected Beryllium. What should I do moving forward?

enter image description here

Improve this question
0

2 Answers 2

Reset to default
11

The pagefile.sys file is used by Windows as virtual memory. Basically, Avast running under macOS is giving you a false positive and thus can be ignored. I tested this by performing a clean install of Windows 10 (20H2) in a VMware Fusion Player (12.1.1) virtual machine. Next, I installed Avast and found no malware. However, I wanted Avast to scan pagefile.sys for viruses. Below is the procedure I used.

  1. I restarting Windows to boot to the Windows Recovery Environment. Basically, I held down the shift key while restarting Windows.

  2. I navigated to a Windows Command Prompt window.

  3. I entered the following commands. Basically, I wanted a copy of pagefile.sys.

    c:
attrib -h -s pagefile.sys
copy pagefile.sys pagefile.bin
attrib +h +s pagefile.sys
exit

  4. I booted back to Windows.

  5. Using the File Explorer, I selected to run a scan on pagefile.bin, as shown below. For a better view, click on the image or open the image in a new window.

    The result is shown below.

So Avast under Windows is ignoring the pagefile.sys file, but does not under macOS. Being this test was made from a clean install of Windows, I assume this found malware threat is a false positive and can therefore be ignored.

Improve this answer
2
  • Addendum: If you want avast to shut up, it should be safe to delete pagefile.sys from the macOS side; then the next time you boot Windows, it will automatically re-create it with clean contents.
    – zwol
    Commented Apr 29, 2021 at 13:46
  • 1
    @zwol: After doing some further testing, I found there may be no malware threat detected or a different malware threat detected such as Chan or Sf:ShellCode-R[Trj]. Both Microsoft Defender Antivirus and Avast have patterns used to detect malware. I think some of these patterns are being written to virtual memory (pagefile.sys) when Microsoft Defender Antivirus or Avast executes. So, while what you suggest will probably work, the fix may be temporary. If I am right, then any execution of Microsoft Defender Antivirus or Avast may recreate the problem.
    – David Anderson
    Commented Apr 29, 2021 at 15:57
0

Kaspersky Threats says that the Beryllium virus is harmless, so you mightn't need to worry about it. I have zero knowledge of computer code, so if you still want it gone, I have no idea how.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .